we saw that...

joe betty sterkx's 'horrible vacation'

now here is an interesting phishing email the type of which we havent seen before.

of course we've heard of joe betty sterkx -- she is a prominent central louisiana real estate agent -- although to our knowledge and memory, we've never corresponded with her before -- so why our email address is in her address book is a mystery.

anyway, what likely happened is that someone hacked into her email account by guessing or brute forcing her password and sent out this email probably to everyone in her address book.

according to the email header, the originating ip number of: 64.120.50.81 originates in the united states.

this is a good time for her and you (and us) to change your email (and other account) password(s).

city of monroe la hires a nigerian to collect taxes; fraud ensues

UPDATE: 21 march 2011 onyemechara pleads guilty
UPDATE 24 november 2010: onyemechara trial delayed four mMonths

anyone from nigeria, who wants to be work around or with money should be regarded with suspicion.

patrick onyemechara, a native nigerian and tax collector for the city of monroe was arrested thursday on 11 counts of felony theft and malfeasance in office in a taxpayer fraud scheme that could involve hundreds of thousands of dollars.

onyemechara exploited a flaw in the city's finance system. see monroe free press city tax collector jailed in tax scheme click here to download article in a two page .pdf [29 kb]

====heres an example of a recent nigerian 419 spam that we just received.
according to the email header, this spam originated from
ip # 41.219.148.174 which is located in lagos, nigeria.

EXTERNAL LINK

abbey national plc phish

heres a new style phish we just received. it pretends to be a message alert to 1 unread message in the inbox folder of an abbey national plc account holder. this phish uses a different variation on a social engineering technique from past phishes we've seen.

the usual phish attempts to trick you into signing directly into your account usually by feigning an account emergency. this phish has no sense of urgency. it's innocuous. it comes across as just an alert sent to let an account holder know of a new abbey national message. if the spammer is lucky enough to reach a few new abbey national account holders it could trick them. in 2004 some 28% of internet users were tricked by phishing schemes...

What is Phishing and Pharming?
Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials.

Social-engineering schemes use 'spoofed' e-mails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames, passwords and social security numbers.

Hijacking brand names of banks, e-retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan keylogger spyware. Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning.~ source anti-phishing working group

To: abuse@everestkc.net, reportphishing@antiphishing.org
Cc: spam@uce.gov
Subject: Fw: Message Alert - You Have 1 Unread Message

EVERESTKC.NET: this spam was sent to advertise a phishing website that you host please would you terminate service to:

myonlineaccounts2.abbeynational.co.uk.pn3ekq976.com

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9Ng==
X-Message-Status: s4:0
X-SID-PRA: Abbey National plc secure.message@abbey.co.uk
X-Message-Info: 6sSXyD95QpU8xbv5wUfSQ1DqaMCFQETtiVr8z88oeK/5oHsiuv5QfAsFosZ1GwTVDCLY08fF82kXcxIXiI1WzOkAsBLZx8Oy
Received: from ensim.repairit.dk ([87.62.58.176]) by bay0-mc12-f14.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Mon, 1 Dec 2008 20:26:49 -0800
Received: from VPS368386 (wvps212-241-220-200.vps.webfusion.co.uk [212.241.220.200])
(authenticated bits=0)
by ensim.repairit.dk (8.12.10/8.12.10) with ESMTP id mB24NOO4016667;
Tue, 2 Dec 2008 05:23:24 +0100
Message-ID: 1D2DDF10C8FB47878D6A8E73D47037C1@VPS368386
Reply-To: "Abbey National plc" secure.message@abbey.co.uk
From: "Abbey National plc" secure.message@abbey.co.uk
To: @yahoo.co.uk, @btinternet.com,@yahoo.co.uk, @hotmail.co.uk,@hotmail.com, @hotmail.co.uk, @hotmail.com, @hotmail.co.uk,@hotmail.com, @hotmail.co.uk,@hotmail.com, @telia.co.uk, @telia.com, @hotmail.co.uk, @hotmail.com, @spray.se,@msn.co.uk, @msn.com, @yahoo.fr,@msn.co.uk, @msn.com, @hotmail.co.uk,@hotmail.com, @hotmail.co.uk,@hotmail.com
Subject: Message Alert - You Have 1 Unread Message
Date: Tue, 2 Dec 2008 05:26:28 +0100
Organization: Abbey National plc
MIME-Version: 1.0
Content-Type: text/html;
charset="koi8-r"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000
Return-Path: secure.message@abbey.co.uk
X-OriginalArrivalTime: 02 Dec 2008 04:26:49.0775 (UTC) FILETIME=[31D48BF0:01C95436]

Abbey

PART OF THE SANTANDER GROUP

Dear Valued Customer,

You have a new message waiting in your Inbox Folder.

Click here to read.
http://myonlineaccounts2.abbeynational.co.uk.pn3ekq976.com/index.php

Best Regards.
Abbey National plc Security Department Team.

* Please do not reply to this email as your reply will not be received.

Abbey National plc. Registered Office: Abbey National House, 2 Triton Square, Regent's Place, London, NW1 3AN, United Kingdom. Registered Number 2294747. Registered in England. Telephone 0870 607 6000. Calls may be recorded or monitored. Calls may be recorded or monitored. Authorised and regulated by the Financial Services Authority. FSA registration number 106054. For more information visit www.fsa.gov.uk/register. Abbey and the flame logo are registered trademarks

stimulus payment phish

criminals will phish anything. heres a new phish going around that purports to be from the internal revenue service but in the emails "from" line it says: bvs credit union.

when you mouse over the hyperlink that says "click here" (in blue) and look down in the status bar you see the link doesnt contain the irs.gov domain like you would expect -- instead it goes to a website whose domain is tel.artwifi.net

when you do a whois of that domain, you see its hosted by a company in belgrade, serbia. if you would have clicked on the link and filled in the form with your personal information, etc. you would have been giving the criminals your name, social security number, banking information and who knows what else.

EXTERNAL LINK

air force to 'reconsider' its cyber command scam

word came out earlier this week that the united states air force has 'suspended plans to establish its much hyped cyber command program.' this cyber command was to be established at barksdale airforce base at shreveport, louisiana.

it never made any sense to locate cyber command at barksdale in the first place, as the obvious choice for its location should have always been within united states northern command [usnorthcom] at peterson air force base colorado springs, colorado.

more than likely whats happened is that the government has decided to run this massive domestic and international internet monitoring and spy program through one of its spook agencies instead of through the active duty military.

the government is probably afraid that after the military, a lot of whom still take their oath to the constitution seriously, finally catch on to what it's really up to -- will spill the beans.

a 'cyber command' has always been just another governmental scam. for instance, everyday we receive scores, if not hundreds of 419 as well as phishing emails as well as the regular run of the mill spam. this has been going on unabated for years. in fact its worse now than its ever been.

yet the government appears to remain clueless at catching whoever is behind all these online scams. phishing is a serious criminal offense too -- phishing is where someone sets up a website that looks like your bank or paypal or ebay, etc. website and tricks you into entering your username and password and other personal information which they then use to loot your account and/or steal your identity.

these criminals even phish the internal revenue service and impersonate our servicemen and women fighting in iraq. sometimes they try to trick us into installing a .exe file in order to take over or use our computer to perpetuate even more scams.

so if the government cant with the resources already available to them or wont stop all this -- then what can they possibly hope to accomplish against professional "chinese hackers" who have all the latest and most powerful computer equipment and systems paid for with (thanks to americans addiction to all things walmart) american money?

the light: martin johnson named new city president at regions bank

JACKSON, Miss. – Martin W. Johnson is Region Bank’s new city president responsible for all bank operations within the Greater Alexandria market, which includes Pineville, according to a press release. ~ read more

EXTERNAL LINK

hallmark.exe e-card scam

we just received a new email scam masquerading as a hallmark.com e-card.

as you can see the (forged) email address appears to be from hallmark.com and has the subject line: "You've received A Hallmark E-Card!"

however, when you mouse over the hyperlink ("To see it, click, here") in the card and look down at your status bar you notice that the hyperlink doesnt go to the hallmark.com website and the end of the url shows that its a direct link to a .exe file which will be downloaded into your computer to do who knows what.

the spammers/hackers are clever in that they end the url with hallmark.exe as most people will just look at the end of the url instead of the domain name at the front [www.pariupenet.com]. also in the body of the email they mispelt received -- recieved.

florida parishes bank phish going around

this morning we received an email representating itself to be from florida parishes bank. florida parishes bank is located in hammond, la. and ponchatoula, la.

we already knew that this was a phish because we dont have an account at this bank and banks never send unsolicited emails. so anyway, a simple google search for florida parishes bank leads us to its website: www.floridaparishesbank.com

in the email when you place your curser on the hyperlink (in blue) above and look down at your status bar you see that url is www.floridaparishesbanksignin.com -- see the difference? just to be sure a whois check of florida parishes bank real website shows that it is hosted by cavion.com and the url registrant information appears to be proper -- while a check of the url from the phishing email shows that it is hosted by yahoo and the registrant information looks suspect -- which results in our email:

From: wesawthat@gmail.com
To: network-abuse@cc.yahoo-inc.com,
reportphishing@antiphishing.org,info@floridaparishesbank.com
Cc: spam@uce.gov
Subject: Fw: You Have 1 New Alert Message!
Date: Mon, 12 May 2008 07:50:11 -0600

YAHOO.COM: this spam was sent to advertise a phishing website that you host please would you terminate service to:

www.floridaparishesbanksignin.com
--copy and paste message source--

====

learn more about phishing scams at the antiphishing working group: www.antiphishing.org

====

related posts

phishing regions bank

nutty nigerians still googling for suckers

bank of america phish

phishing walmart

irs targets sites that steal identies

sean scully's phishing story

===

phishing regions bank

heres a phishing email we received this morning. its directed against a bank that has some local branches - regions. so we thought we should include it in our collection.

regions used to be called security 1st national bank. it was a locally owned bank although it was before our time we've always been told that a lumberman named hardner from urania in lasalle parish founded security bank as it was called for short. whether that is 100% accurate or not doesnt matter now because a couple of years ago the stockholders of security, just like the boltons's with rapides bank sold out their depositors when they merged with the out of state regions.

in the phishing biz we have to give this attempt a poor rating. although as everyone knows we're hardly knowledgeable in the proper use of english grammar and punctuation so if even we can find grammatical mistakes in the text of the email - it must be poor. also poor grammar and punctuation in corporate emails is one of the clues you're supposed to be on the look out for in a phishing attack.

assuming the intended victim doesnt bother to look that closely at the grammar and punctuation of the email one of the most glaring clues that this is a phishing email is when you hover your mouse over the clickable hyperlink all phishing emails contain.

when you hover your mouse over the blue hyper-link, whilst looking at your status bar you can easily see that the link doesnt look like its an authentic regions url.

====
related posts

nutty nigerians still googling for suckers

ebay phishing email

sean scully's phishing story

irs targets sites that steal identities

bank of america phish

investigator.exe phish

email virus cartao.exe

====

semantic.exe phish

heres a pretty decent phishing email thats currently making the rounds. it must be new seeing as gmail hasnt begun to filter it yet since we've received about six of these emails in the past hour.

at first glance it appears to be a legitimate email -- however, when you hover your mouse over any of those three "start" buttons while looking down at your status bar, shown in the lower left of our screen grab, you see if you click one, the real url that you will be taken to:

http://sath.hs.kr/bbs/skin/zero_vote/Symantec.exe

if you google semantic.exe you will quickly find out that this is a trojan that:

Gathers email addresses from all .txt and .html files located on the following drives:

* C
* D
* E
* G
* F

Sends a copy of itself in an email...~source~

so apparently someone who has our email address is infected. lovely.

new trojan tempts mac users with free porn

excerpt:

By Kevin McLaughlin, CMP Channel
7:29 PM EDT Thu. Nov. 01, 2007

The appearance this week of a malicious Trojan Horse targeted specifically at Mac users is fanning the flames of the Mac-versus-PC security debate.

On Monday, security vendor Intego reported a flood of spam being sent to several Mac user forums, which lures users with the promise of free pornographic videos. But when the user visits the Website, an alert box informs them that they need to download a missing video codec before the fun can begin.

Overeager users that click the link will have a disk image file (.dmg) downloaded to their machine, but the installation won't proceed unless the user enters the administrator password, and doing so gives the Trojan full root privileges on the machine, according to Intego.

Once installed, the Trojan operates in the background until the user visits online banking, payment, or auction Websites, at which time it alters the Mac's DNS server and redirects users to nearly identical Websites set up for phishing purposes.

click link to read more

EXTERNAL LINK

bye turd blossom

you know things are bad when der chimpenfuhrer's brain hauls ass. oh well, we guess it really is true that there is no honor among thieves.

sean scully tells us about his very first encounter with karl rove, "it was just a few days before the new hampshire primary in 2000," and how the experience left him so "unsettled...that i pretty much stayed away from rove for the rest of the campaign, talking to him mostly in the small groups of reporters."

click the link to read more

reporter gets banned from facebook for life

anna nicole smith dead at 39

four kinds of political corruption

sean scully's phishing story

EXTERNAL LINK

reporter gets banned from facebook 'for life'

sean scully is a free lance reporter living in philadelphia. we've been reading mr. scully's blog "seanibus"ever since washington times reporter audrey hudson introduced us to it from her "audrey's right" blog sometime in late 2005.

in fact mr. scully is responsible for this blog because he has his comments set in such a way that you must have a google account to comment there. anyway, recently mr. scully was working on a story about the virginia tech massacre and was using facebook to find story ideas (hmm imagine that, a reporter actually using online resources to find story ideas)

mr. scully writes:

Somehow, Facebook decided that I have become a Spammer. I don't understand - they won't explain. It has something to do with my efforts to contact friends of Virginia Tech students in the wake of the shooting there in the spring, a story I was reporting for People magazine.
[...]
At first I was really pissed off, because no other website has had any problem with the way I and other reporters operate. But then I cooled off and began to wonder if it might not be kinda cool to be one of the few people banned for life from Facebook.

click link to read more

questions for nbc president steve capus

rick gallot is an idiot!

virginia tech massacre

newsboycott.com

a louisiana republican hollis downs supports gun control

anna nicole smith dead at 39

four kinds of political corruption

sean scully's phishing story

miss audrey's back!

EXTERNAL LINK

nutty nigerians still googling for suckers

it's been awhile since we did a 419 post and as luck would have it we received one this morning and since its cold and windy here today and this one is just too easy to pass up we thought this would be a good time to post another one.

notice the ip number for this hit: 80.78.16.172

so we wait a few minutes then check the old inbox...sure enough nigerian 419 spammer scammers never fail to disappoint - at least as far as sending the spam goes...

email header:

Delivered-To: wesawthat@gmail.com
Received: by 10.100.252.8 with SMTP id z8cs276303anh;
Sat, 7 Apr 2007 05:55:17 -0700 (PDT)
Received: by 10.35.50.1 with SMTP id c1mr7238005pyk.1175950516847;
Sat, 07 Apr 2007 05:55:16 -0700 (PDT)
Return-Path: barr_miltonchambers2@hotmail.com
Received: from bay0-omc3-s17.bay0.hotmail.com (bay0-omc3-s17.bay0.hotmail.com [65.54.246.217])
by mx.google.com with ESMTP id f51si5592694pyh.2007.04.07.05.55.16;
Sat, 07 Apr 2007 05:55:16 -0700 (PDT)
Received-SPF: pass (google.com: domain of barr_miltonchambers2@hotmail.com designates 65.54.246.217 as permitted sender)
Received: from hotmail.com ([207.46.10.110]) by bay0-omc3-s17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Sat, 7 Apr 2007 05:55:07 -0700
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Sat, 7 Apr 2007 05:55:07 -0700
Message-ID: BAY121-F30AF072333F7877756DB0EBD5B0@phx.gbl
Received: from 207.46.10.123 by by121fd.bay121.hotmail.msn.com with HTTP;
Sat, 07 Apr 2007 12:55:03 GMT
X-Originating-IP: [80.78.16.172]
X-Originating-Email: [barr_miltonchambers2@hotmail.com]
X-Sender: barr_miltonchambers2@hotmail.com
Reply-To: milton_walters2@yahoo.co.uk
From: "BARRISTER MILTON WALTERS" barr_miltonchambers2@hotmail.com
Bcc:
Subject: URGENT ATTN.
Date: Sat, 07 Apr 2007 07:55:03 -0500
Mime-Version: 1.0
Content-Type: text/html; format=flowed
X-OriginalArrivalTime: 07 Apr 2007 12:55:07.0827 (UTC) FILETIME=[F82B3830:01C77913]
Return-Path: barr_miltonchambers2@hotmail.com

see in the line: X-Originating-IP: [80.78.16.172] same ip number as our hit...

so we put that number in our trace route to find out who the internet service provider for that ip number is:

we can also trace the ip number this way: (last few hops redacted for our privacy)

our email response:

Reply-To: wesawthat@gmail.com
From: wesawthat@gmail.com
To: abuse@constellationnetcorp.com,report_spam@hotmail.com,
abuse@yahoo-inc.com,TBright@Kuzola.com
Cc: "spam @ uce.gov" spam@uce.gov
Subject: Fw: URGENT ATTN.
Date: Sat, 7 Apr 2007 08:03:20 -0500
Organization: www.wesawthat.blogspot.com

CONSTELLATIONETCORP.COM / TBRIGHT: this advance fee (419) fraud spam came from an a ip address that you host please would you terminate service to:

80.78.16.172

HOTMAIL.COM: this advance fee (419) fraud spam references an email account that you host please would you terminate service to:

barr_miltonchambers2@hotmail.com

YAHOO.COM: this advance fee (419) fraud spam references an email account that you host please would you terminate service to:

milton_walters2@yahoo.co.uk

EXTERNAL LINK

investigador.exe phish

we received another exquisite phishing email tonight, yet another one that managed to get around gmail's junk email filter. we're not sure but we have a strong suspicion that this is the work of the same crime gang that started out with the cartao.exe ecard email that we blogged about here. this is obviously a professional hi-tech crime gang and they have been doing this for awhile now. we wonder why interpol hasnt come knocking at their door yet. these particular phishing emails arrive presenting themselves to be a regular ecard....

however, when we mouse over the red box where it says "Ver meu Cartao" (which we have no clue what this means btw) the first thing we notice down in the status bar -- bottom left in our picture -- we see the true url: mimundo.americaonline.com.ar/atualizaorkut10/investigador.exe and notice that it ends in .exe -- a .exe file extension is an executable file "whose contents are meant to be interpreted as a program by a computer." hackers can use .exe files to install and launch viruses, trojans, worms and what not to take over your computer. we think that the particular crime gang thats behind this is building a botnet.

this particular email does not contain any attachments. its cleverly designed to trick you into thinking that its an ecard. so you click the link in that box thinking you are going to fetch your ecard but instead you are taken to a website and thats where the .exe file is installed on your computer.
Reply-To: wesawthat@gmail.com
From: wesawthat@gmail.com>
To: TosWeb@aol.com,reportphishing@antiphishing.org
Cc: spam@uce.gov
Subject:Você Recebeu um Cartão OCarteiro.com.br
Date: Fri, 8 Dec 2006 00:07:26 -0600

AOL.COM: this spam was sent to advertise a phishing website that you host that is tricking computer users into installing a .exe file please would you terminate
service to:

http://mimundo.americaonline.com.ar/atualizaorkut10/investigador.exe

search this blog * phish

EXTERNAL LINK

bank of america phish

we received this excellent bank of america.com phish today. it even got around gmail's junk email filter and thats unusual so it could be a new style...

an easy way to tell is to run your mouse over the hyperlink while looking down toward the status bar...for instance in this phish the link looks legitimate but a second look in the status bar shows that they dont match see it begins: starlightdancestudio.com ...to make sure, next you (in firefox 2.0) right click the link and >copy shortcut > then you paste that in your trace route...

3d's traceroute truncates the url down to the domain name.
see starlightdancestudio.com is hosted by someone called ecommerce.com...its not a bank of america domain. then you forward the email complete to the abuse department and cc: reportphishing@antiphishing.org and spam@uce.gov

if you want to although theres no need to email them -- you can also use 3d's traceroute to find out who is the domain name registrar.

Process query: 'starlightdancestudio.com'
1. Step: Querying com.whois-servers.net:43 with whois.
2. Step: Querying whois.godaddy.com:43 with whois -- From: com.whois-servers.net:43 Domain Name: STARLIGHTDANCESTUDIO.COM
Registrar: GO DADDY SOFTWARE, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
-- End -- --
From: whois.godaddy.com:43

====

Reply-To: wesawthat@gmail.com
From: wesawthat@gmail.com
To: abuse@ecommerce.com
Cc: reportphishing@antiphishing.org ,spam@uce.gov
Subject: Fw: Bank of America: Important Notice On Your Account Information (Re-Confirm)
Date: Wed, 6 Dec 2006 15:41:15 -0600

ECOMMERCE.COM: this spam was sent to advertise a phishing website that you host please would you terminate service to:

starlightdancestudio.com/

[message source]

click properties>details>message source>select all to copy and paste the message source to the top of your forward

click the link to read more about phishing from the anti-phishing working group

====
related posts

search this blog * phishing

search this blog * 419

EXTERNAL LINK

phishing walmart

a little while ago we read this news item wal-mart's holiday opening disappoints via the town talk then a few minutes later noticed we had received several walmart based phishing emails -- to gmail's credit they were sorted to junk. naturally this made us wonder if the phishing had something to do with it. nah probably not. perhaps, could it be walmart's growing public perception as an evil empire?

anyway, one tip off that this is a phishing scam is that walmart has no reason to have our email address. we've never used this email address to order anything online much less from walmart or sams.

X-Gmail-Received: 9811646c1950f17050ef4ba53629ef1445eabeee
Delivered-To: wesawthat@gmail.com
Received: by 10.35.12.12 with SMTP id p12cs53194pyi;
Sat, 25 Nov 2006 13:22:43 -0800 (PST)
Received: by 10.35.21.1 with SMTP id y1mr9125209pyi.1164489763244;
Sat, 25 Nov 2006 13:22:43 -0800 (PST)
Return-Path:
Received: from gmlzqx ([85.103.97.216])
by mx.google.com with SMTP id p57si9673693pyb.2006.11.25.13.22.41;
Sat, 25 Nov 2006 13:22:43 -0800 (PST)
Received-SPF: neutral (google.com: 85.103.97.216 is neither permitted nor denied by best guess record for domain of pryyse@4rgroup.com)
Received: from mlqoqr by gmlzqx with local (Exim 4.42 (FreeBSD))
id 1Go4yw-000P6I-YY
for wesawthat@gmail.com; Sat, 25 Nov 2006 23:22:42 +0200
To:
Subject: Walmart Store! Christmas sale! Discounts up to 50%!
From: "Walmart"
Content-Type: text/html;charset=iso-8859-1
Content-Transfer-Encoding: 7BIT
Message-Id: <1go4yw-000p6i-yy@gmlzqx>
Sender: User mlqoqr
Date: Sat, 25 Nov 2006 23:22:42 +0200

another tipoff is that the pictures in the email wont display -- this is because the webhost of the phishing website has already terminated service to it. you can tell this by hovering your mouse over the hyperlink "sony playstation3 60gb bundle..." and you can see the domain walmart-estore.com which is the domain the pictures are hosted from.
i.e.
http://walmart-estore.com/product.php?productid=16455&cat=0&page=1

next, in order to to confirm our suspicions we look up (whois) the domain walmart-estore.com to see if its a walmart owned domain or not. -- its not.

as you can see its owned by someone allegedly named "larry shepard"

just to make sure we look up walmart.com to see how it is registered and hosted etc

EXTERNAL LINK

firefox 2.0 released

as usual we are late again seeing as how firefox 2.0 was released 6 days ago. we are really surprised that we didnt know about this release before now. we would have thought that due to our hit counter that we would have noticed someone using the new version. *updated* naturally right after we posted this, the very next hit was a ff v 2.0 user.

firefox 1.5 released

live bookmarks [rss site feed] in firefox browser

EXTERNAL LINK

phishing santa barbara bank & trust

we received this phishing email yesterday and it concerns us a lot because the true url is different from what we are used to seeing. hmm how can we explain this. you see in the email the link the criminals are portraying to be the url to santa barbara bank and trust company? the long blue url: http://www.sbbt.com/wealth_management/trust_online_signup.jsp

when you hover your mouse over this url and look down in your status bar you will see the true url: http://3584400795:81/~wba/login.aspx now this url is very disturbing to us because its just a long number and when we enter that url into our trace-route program in order to find out who hosts that website it comes up blank. in other words (at least to us) its untraceable.

one clue as to who is behind this phishing email - you see at the top of the email it says "Account Security Measures ! - Cyrillic (Windows)" cyrillic is russian so perhaps the russian mafiya is behind this phish attack.

so anyway, the point is to always, always, always before you click on a link make it a habit to look down in the status bar and make sure that you trust the url. even if you are on a website that you trust you never know, hackers might have hacked into that site and changed around the hyperlinks. even with all the criminal element trolling around online the internet is still relatively safe as long as you stay alert and pay attention to detail.

EXTERNAL LINK

four kinds of political corruption

sean scully has written a post about what he calls the four kinds of political corruption and gives examples of each.

click here to read more.

sean scully's phishing story

EXTERNAL LINK