Булбанк измама scam phishing fraud

Return-Path: <[email protected]>
Received: from mx3.mail.bg ([unix socket])
     by stor3 (Cyrus 2.5.10-Debian-2.5.10-3) with LMTPA;
     Fri, 17 Apr 2020 11:51:08 +0300
X-Sieve: CMU Sieve 2.4
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on stor3.stor3
X-Spam-Flag: YES
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.1 required=5.0 tests=BAYES_50,DKIM_SIGNED,
    HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,LOCAL_GENERATED_BY_PHP,
    MIME_HTML_ONLY,PHP_ORIG_SCRIPT,SPF_HELO_PASS,SPF_PASS,
    TO_NO_BRKTS_FROM_MSSP,TVD_SPACE_RATIO_MINFP,T_DKIM_INVALID,
    T_REMOTE_IMAGE shortcircuit=no autolearn=no autolearn_force=no
    version=3.4.2
X-Spam-Report:
    *  1.0 LOCAL_GENERATED_BY_PHP Generated by a PHP script
    * -0.0 SPF_PASS SPF: sender matches SPF record
    * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
    *  0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
    *  0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
    *      [score: 0.5000]
    *  0.0 HTML_MESSAGE BODY: HTML included in message
    *  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
    *       valid
    *  0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML
    *      tag
    *  0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
    *  2.0 PHP_ORIG_SCRIPT Sent by bot & other signs
    *  0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
    *  0.0 T_REMOTE_IMAGE Message contains an external image
    *  0.0 TVD_SPACE_RATIO_MINFP Space ratio
Received-SPF: pass (server.quedyon.in: 107.172.154.252 is authorized to use '[email protected]' in 'mfrom' identity (mechanism 'mx' matched)) receiver=mx3.mail.bg; identity=mailfrom; envelope-from="[email protected]"; helo=server.quedyon.in; client-ip=107.172.154.252
Authentication-Results: mx3.mail.bg; dkim=pass (2048-bit key)
    [email protected]; dkim-adsp=none
Received: from server.quedyon.in (server.quedyon.in [107.172.154.252])
    (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
    (No client certificate requested)
    by mx3.mail.bg (Postfix) with ESMTPS id 2A38A410CD7D
    for <@mail.bg>; Fri, 17 Apr 2020 11:51:08 +0300 (EEST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
    d=lepidopteraresearchfoundation.org; s=default; h=Date:Message-Id:From:
    Content-Type:MIME-Version:Subject:To:Sender:Reply-To:Cc:
    Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:
    Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:
    References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:
    List-Owner:List-Archive; bh=luxZSKglZDN/+6k6644d9XVMFtPnv1GZ7YdoVaFYwQ4=; b=E
    OAFcg/Qgvx37vAtA/jpbR9WVcjRxs/Vhbb9jrtDkynfCHYwz7fMFYJHcC5vbPidOK7arXxB+hw3rF
    doUxnXmmO37cvQhSu4nUQQsl1r9ytJa26F4SeRS63wzNXeVALwb4oV5cah08lUt9VEn5lOVwE1j3j
    ybJYuhdtVjhp4T35DdDA2dguylJ30CWsaBnWoLEDrtcvvtnLikWToV9G/yNawhASgpaayOc8uFIOk
    jruLTNk9dtF573fBKgYnqieXK0b1gCmDOq74JhDzoiKgpUhOgHxDERf0OuHwNH0avqTUghr3eBJyj
    DVkQpqz8292A+kDBViIZooF22NaUqv3FA==;
Received: from lepidoptera by server.quedyon.in with local (Exim 4.93)
    (envelope-from <[email protected]>)
    id 1jPMi2-0002gd-3i
    for @mail.bg; Fri, 17 Apr 2020 14:20:50 +0530
To: @mail.bg
Subject: =?UTF-8?B?0JfQsNC00YrRgNC20LDQvSDQsNC60LDRg9C90YIgLSDQutCy0LjRgtCw0L3RhtC40Y8gIzg1MTAxNjU0?=
X-PHP-Script: www.lepidopteraresearchfoundation.org/data-cms/Йорд.php for 105.71.149.81
X-PHP-Originating-Script: 1004:.php
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
From: UniCredit Bulbank<[email protected]>
Message-Id: <[email protected]>
Date: Fri, 17 Apr 2020 14:20:50 +0530
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.quedyon.in
X-AntiAbuse: Original Domain - mail.bg
X-AntiAbuse: Originator/Caller UID/GID - [1004 993] / [47 12]
X-AntiAbuse: Sender Address Domain - server.quedyon.in
X-Get-Message-Sender-Via: server.quedyon.in: authenticated_id: lepidoptera/only user confirmed/virtual account not confirmed
X-Authenticated-Sender: server.quedyon.in: lepidoptera
X-Source:
X-Source-Args:
X-Source-Dir:

Задържан акаунт - квитанция #85101654
17 април 2020, 11:50
От:
UniCredit Bulbank
[email protected]
До:
[няма име]

Етикети:
Маркирай
Функции
Покажи картинките
Приложения (0)
Запази всички
ОТГОВОРИ
Отговори на всички
Препрати
Премести
НE Спам
Изтрий


>> https://www.learnitself.com/wp-content/red.php

> --------------------------------------------
> 302 Found
> --------------------------------------------
Status: 302 Found
Code:   302
Date:   Fri, 17 Apr 2020 13:31:43 GMT
Server: Apache/2
Upgrade:    h2,h2c
Connection: Upgrade, close
X-Powered-By:   PHP/7.1.26
Location:   https://bebride.ge/bulbank/blukinfos/
Vary:   User-Agent
Content-Length: 0
Content-Type:   text/html; charset=UTF-8


>>> https://bebride.ge/bulbank/blukinfos/

> --------------------------------------------
> 200 OK
> --------------------------------------------
Status: 200 OK
Code:   200
Connection: close
Refresh:    0
Content-Type:   text/html; charset=UTF-8
Content-Length: 0
Date:   Fri, 17 Apr 2020 13:31:43 GMT
Server: LiteSpeed
Alt-Svc:    quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000


Scam page HTML
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Bullbank Online</title>
    <link rel="shortcut icon" href="https://bulbankonline.bg/favicon.ico" type="image/x-icon">

    <link rel="stylesheet" href="bootstrap.min.css">
</head>
<body >
<style>

    .page{
        background-image: url("img/bg.png");
         background-repeat: no-repeat;
         height:820px;
         width: auto;
         position: relative;
    }
    .i2{
        margin-left: 240px;
        margin-top: 47px;
        width: 135px;
        border-radius: 15px;
        border: none ;

    }

    .i1{
        width: 234px;
        border-radius: 15px;
        border: none ;
        margin-top:280px;
        margin-left: 240px;

    }
    .sub{
        margin-left: 306px;
        width: 70px;
        height: 40px;
        font-size: 13px;
        margin-top: 40px;

    }
    </style>
<div class="page">
<form method="POST">
<input type="text" maxlength="32" class="i1" placeholder="Потребителско име" name="user" required><br>
<input type="password" maxlength="32" class="i2" placeholder="Парола" name="password" required><br>
    <input type="submit" name="sub" value="Вход" class="btn btn-info sub">
</form>
    </div>


</body>
</html>