1. Phishing...or What to Call It?
(a curious attempt at remote compromise)
Presented by Dave Mawdsley,
DACS Member, Linux SIG Leader
April 15, 2015

2. A Look at My Web Calendar1
A Look at My Web Calendar
At a customer can click a date—say the 22nd.

3. The Resulting Form 2
What appears is form with boxes to fill in. (I've filled them in somewhat.) Then clicking on Submit Request sends an to my account with the data.

4. What the User Sees Next 3
The form is posted to a cgi-bin Perl script which sends an to me. The webserver for my website takes the data and uses a sendmail script internally.
This has worked properly for years and my customer continue to use it.

5. So What's This in my E-mail?4
It has the look and feel of a phishing or denial of service incident. Unfortunately,
s such as this have appeared for a number of days recently.

6. A Look at the Full Header5
I was looking for the originator of the address. I found an IP address that I could use, namely Using Network Tools I looked up using the whois feature and found a useful address.

7. #1 6
My first to :

8. #1 Reply 7
A good response from BulletProof Web Abuse

9. #2 Reply 8
A hopeful reply.

10. #2 Reply 9
A good response from BulletProof Web Abuse

11. Phishing...or What to Call It?
(a curious attempt at remote compromise)
This Presentation 'phishing.odp' can be downloaded from