linkedlne.com - LinkedIn / Webmail PhishThis laughable fake LinkedIn login page is trying to harvest webmail addresses, being sent out via a spam message and leading to a link at [donotclick]www.linkedlne.com/login/user/:
From: Linkedln Support [Support@supportlinkedln.com]Really this is just phishing for webmail addresses and passwords rather than LinkedIn credentials:
Date: 18 June 2013 06:53
Subject: You need to confirm your email address.
We write to inform you that your LinkedIn account has been blocked due to inactivity.
To ensure that your online services with LinkedIn will no longer be interrupted
Click here to unblock your account.
You will be asked to log into your account to confirm this email address. Be sure to log in with your current primary email address.
We ask you to confirm your email address before sending invitations or requesting contacts at LinkedIn. You can have several email addresses, but one will need to be confirmed at all times to use the system.
If you have more than one email address, you can choose one to be your primary email address. This is the address you will log in with, and the address to which we will deliver all email messages regarding invitations and requests, and other system mail.
Thank you for using LinkedIn!
--The LinkedIn Team
Learn why we included this. © 2013, LinkedIn Corporation. 2029 Stierlin
suncoaslfcn.org - Suncoast Schools Federal Credit Union phishHosted on the same server is an attempted phish for something called the "Suncoast Schools Federal Credit Union" which has an actual website at suncoastfcu.org rather than suncoaslfcn.org. The phish page is at [donotclick]sunnet.suncoaslfcn.org/SignIn/ but the phishers have left a full copy of the phishing kit which is available at [donotclick]sunnet.suncoaslfcn.org (more of which in a moment)
reported at [donotclick]co-operativebank.co.uk.suncoaslfcn.org/login/online-access/login.php.
There are two email addresses than can be phone in the phishing site themselves (for research purposes you can download a copy here, password is "phish"). The file verification_data.php reveals two email addresses, firstname.lastname@example.org and email@example.com.
A quick bit of Googling around links firstname.lastname@example.org to the following phishing domains:
A similar bit of Googling around links the other email address to the following domains: