Isellst00f is involved with phishing

Scammer's Sythe profile link: http://www.sythe.org/members/323100-isellst00f.html
Prove that the user is the same: http://www.sythe.org/10211444-post1.html

Proof of offsite scam/blackhat:


Message with SMTP headers -

Code:

                                                                                                                                                                                                                                                               
                                                                                                                                                                                                                                                               
Delivered-To: [email protected]
Received: by 10.182.36.70 with SMTP id o6csp93048obj;
        Tue, 3 Feb 2015 14:18:55 -0800 (PST)
X-Received: by 10.140.82.234 with SMTP id h97mr50938100qgd.75.1423001934627;
        Tue, 03 Feb 2015 14:18:54 -0800 (PST)
Return-Path: <[email protected]>
Received: from smtps.bol.com.br (a4-smart2.bol.com.br. [200.147.96.169])
        by mx.google.com with ESMTP id w103si30497470qgd.53.2015.02.03.14.18.54
        for <[email protected]>;
        Tue, 03 Feb 2015 14:18:54 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 200.147.96.169 as permitted sender) client-ip=200.147.96.169;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 200.147.96.169 as permitted sender) [email protected]
Received: from localhost (localhost.localdomain [127.0.0.1])
	by a4-smart2.bol.com.br (Postfix) with ESMTP id 18D32E00009B
	for <[email protected]>; Tue,  3 Feb 2015 20:18:53 -0200 (BRST)
X-UOL-SMTP: SMTPS587
Received: from bol.com.br (unknown [194.135.152.110])
	(Authenticated sender: [email protected])
	by a4-smart2.bol.com.br (Postfix) with ESMTPA id F07B9E00008D
	for <[email protected]>; Tue,  3 Feb 2015 20:18:50 -0200 (BRST)
From: "Alex Holbrook" <[email protected]>
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)
Subject: From: Alex Holbrook
Message-Id: <[email protected]>
Date: Tue, 3 Feb 2015 23:01:27 +0100
To: <[email protected]>
X-Mailer: iPhone Mail (5B108)
X-SIG5: fefec11e69879487d1fb62557017dc63


Hi Noam

http://vvsjes.dk/century.php?blood=3Dteg6nycz3m5e1 [this is a phishing link, and google will warn you if you click it in a chrome browser]




[email protected]


Sent from my iPhone

On one hand, this message was sent through bol.com.br, so I'm not sure we can verify its authenticity (maybe the authenticated sender [email protected] will give some information), on the other hand, it's clear this message was manually sent because it addresses me by name and the X-Mailer field is iPhone Mail.

Because it's deliberate, I expect that either he's been hacked or he's gone blackhat. Even so it could be someone else is spoofing his email address. Whatever happened I think this should be on file.

 

I've given him 48hrs to respond, though I doubt he will as he's been inactive for over a year.

 

Just confirmation that the site is malicious and a phishing site, indeed:

https://www.virustotal.com/en/url/4...f90d4c8ba031f249a44a92e8/analysis/1423279478/

 

He's either

1. involved in phishing or
2. his email is hacked, nevertheless he's banned and can dispute it once he's safe