we saw that...

phishing santa barbara bank & trust

we received this phishing email yesterday and it concerns us a lot because the true url is different from what we are used to seeing. hmm how can we explain this. you see in the email the link the criminals are portraying to be the url to santa barbara bank and trust company? the long blue url: http://www.sbbt.com/wealth_management/trust_online_signup.jsp

when you hover your mouse over this url and look down in your status bar you will see the true url: http://3584400795:81/~wba/login.aspx now this url is very disturbing to us because its just a long number and when we enter that url into our trace-route program in order to find out who hosts that website it comes up blank. in other words (at least to us) its untraceable.

one clue as to who is behind this phishing email - you see at the top of the email it says "Account Security Measures ! - Cyrillic (Windows)" cyrillic is russian so perhaps the russian mafiya is behind this phish attack.

so anyway, the point is to always, always, always before you click on a link make it a habit to look down in the status bar and make sure that you trust the url. even if you are on a website that you trust you never know, hackers might have hacked into that site and changed around the hyperlinks. even with all the criminal element trolling around online the internet is still relatively safe as long as you stay alert and pay attention to detail.

EXTERNAL LINK

insidious phishing email

we received this phishing email this morning and its about the best phishing work we have seen.

if you hover your mouse over where it says "apply now" you will see the true url in your status bar in the lower left hand corner of your screen: capitalonesafecard.com/creditcard.html

we know that most large companies such as capital one instead of using third party hosting have their own servers.

a whois lookup of the capitalonesafecard.com domain reveals that sure enough its hosted by comcast.

the whois lookup of the capitalone.com domain shows that as we suspected they have their own servers:

if you receive these types of emails and you would like to help by reporting them then please copy and put in your address book this address: reportphishing@antiphishing.org and also the federal trade commission has an email address that we can send besides phishing spam, any spam to and its: spam@uce.gov

its important that when you send on spams that you include the complete unaltered email headers, antiphishing.org instructions are here.

our complaint regarding the above phishing email (shown for example purposes)

From:edited@msn.com
To: abuse@comcast.net,reportphishing@antiphishing.org
Cc: spam@uce.gov
Subject: Fw: Few tips for online shopping from Capital One
Date: Tue, 14 Mar 2006 10:50:41 -0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C64755.2386B1E0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01C64755.2386B1E0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Capital One - Credit Cards - Respond to an invitation

COMCAST.NET: this phising spam was sent to advertise a website that you host please would you terminate service to:

www.capitalonesafecard.com

*original email body here*

EXTERNAL LINK

phishing regions bank

heres a phishing email we received this morning. its directed against a bank that has some local branches - regions. so we thought we should include it in our collection.

regions used to be called security 1st national bank. it was a locally owned bank although it was before our time we've always been told that a lumberman named hardner from urania in lasalle parish founded security bank as it was called for short. whether that is 100% accurate or not doesnt matter now because a couple of years ago the stockholders of security, just like the boltons's with rapides bank sold out their depositors when they merged with the out of state regions.

in the phishing biz we have to give this attempt a poor rating. although as everyone knows we're hardly knowledgeable in the proper use of english grammar and punctuation so if even we can find grammatical mistakes in the text of the email - it must be poor. also poor grammar and punctuation in corporate emails is one of the clues you're supposed to be on the look out for in a phishing attack.

assuming the intended victim doesnt bother to look that closely at the grammar and punctuation of the email one of the most glaring clues that this is a phishing email is when you hover your mouse over the clickable hyperlink all phishing emails contain.

when you hover your mouse over the blue hyper-link, whilst looking at your status bar you can easily see that the link doesnt look like its an authentic regions url.

====
related posts

nutty nigerians still googling for suckers

ebay phishing email

sean scully's phishing story

irs targets sites that steal identities

bank of america phish

investigator.exe phish

email virus cartao.exe

====

windows live messenger phishing scam

we received this new style phishing email a few minutes ago - its claiming to be an invite for the windows live beta however if you hover your mouse over where it says "BAIXAR AGORA" you will see the true url: users.cjb.net/t0mt0m/messengerlive.exe

cjb.net is not a microsoft domain. this is probaby some sort of virus or trojan some criminal is attempting to install on your computer.
From: wesawthat@gmail.com
To: abuse@cjb.net
Cc: spam@uce.gov,reportphishing@antiphishing.org
Subject: Fw: Novo Live Messenger
Date: Tue, 4 Apr 2006 21:38:24 -0500
Organization: www.wesawthat.blogspot.com

CJB.NET: this spam was sent to phish the microsoft windows live messenger service website to trick computer users into installing a .exe file which it is phishing or misrepresenting to be to be the windows live beta please would you terminate service to:

http://users.cjb.net/t0mt0m/messengerlive.exe

EXTERNAL LINK

ebay phishing email

this morning we received not one but two ebay phishing emails. it seems to go in circles first "they" will phish ebay and paypal then the bank phishing ones arrive those are the easiest to spot because we dont have an account at any of the banks lol anyway you name it and someone will try and phish it. if you ever want to get a good education about phishing the Anti-Phishing Working Group keeps a great website with everything you will need to know its here. they even have an email address where you can forward any phishing emails that you receive to them its: reportphishing@antiphishing.org and dont forget to CC your email to spam@uce.gov you should also send any and all spam emails you receive to spam@uce.gov. - anyway these are two good email addys to add to your address book - just in case.

heres the first tip off (besides the fact that we dont have an ebay account) our email address isnt chellybrown@msn.com;

the second tip-off is if you mouse-over the blue link in the email while at the same time looking down into your status bar you will see that it actually goes to another non-ebay website -they dont match - so its always a good idea to look down in the status bar and compare what you see there with the url you see within an email.

sean scully's phishing story

abbey national plc phish

heres a new style phish we just received. it pretends to be a message alert to 1 unread message in the inbox folder of an abbey national plc account holder. this phish uses a different variation on a social engineering technique from past phishes we've seen.

the usual phish attempts to trick you into signing directly into your account usually by feigning an account emergency. this phish has no sense of urgency. it's innocuous. it comes across as just an alert sent to let an account holder know of a new abbey national message. if the spammer is lucky enough to reach a few new abbey national account holders it could trick them. in 2004 some 28% of internet users were tricked by phishing schemes...

What is Phishing and Pharming?
Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials.

Social-engineering schemes use 'spoofed' e-mails to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as credit card numbers, account usernames, passwords and social security numbers.

Hijacking brand names of banks, e-retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant crimeware onto PCs to steal credentials directly, often using Trojan keylogger spyware. Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning.~ source anti-phishing working group

To: abuse@everestkc.net, reportphishing@antiphishing.org
Cc: spam@uce.gov
Subject: Fw: Message Alert - You Have 1 Unread Message

EVERESTKC.NET: this spam was sent to advertise a phishing website that you host please would you terminate service to:

myonlineaccounts2.abbeynational.co.uk.pn3ekq976.com

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9Ng==
X-Message-Status: s4:0
X-SID-PRA: Abbey National plc secure.message@abbey.co.uk
X-Message-Info: 6sSXyD95QpU8xbv5wUfSQ1DqaMCFQETtiVr8z88oeK/5oHsiuv5QfAsFosZ1GwTVDCLY08fF82kXcxIXiI1WzOkAsBLZx8Oy
Received: from ensim.repairit.dk ([87.62.58.176]) by bay0-mc12-f14.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Mon, 1 Dec 2008 20:26:49 -0800
Received: from VPS368386 (wvps212-241-220-200.vps.webfusion.co.uk [212.241.220.200])
(authenticated bits=0)
by ensim.repairit.dk (8.12.10/8.12.10) with ESMTP id mB24NOO4016667;
Tue, 2 Dec 2008 05:23:24 +0100
Message-ID: 1D2DDF10C8FB47878D6A8E73D47037C1@VPS368386
Reply-To: "Abbey National plc" secure.message@abbey.co.uk
From: "Abbey National plc" secure.message@abbey.co.uk
To: @yahoo.co.uk, @btinternet.com,@yahoo.co.uk, @hotmail.co.uk,@hotmail.com, @hotmail.co.uk, @hotmail.com, @hotmail.co.uk,@hotmail.com, @hotmail.co.uk,@hotmail.com, @telia.co.uk, @telia.com, @hotmail.co.uk, @hotmail.com, @spray.se,@msn.co.uk, @msn.com, @yahoo.fr,@msn.co.uk, @msn.com, @hotmail.co.uk,@hotmail.com, @hotmail.co.uk,@hotmail.com
Subject: Message Alert - You Have 1 Unread Message
Date: Tue, 2 Dec 2008 05:26:28 +0100
Organization: Abbey National plc
MIME-Version: 1.0
Content-Type: text/html;
charset="koi8-r"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18000
Return-Path: secure.message@abbey.co.uk
X-OriginalArrivalTime: 02 Dec 2008 04:26:49.0775 (UTC) FILETIME=[31D48BF0:01C95436]

Abbey

PART OF THE SANTANDER GROUP

Dear Valued Customer,

You have a new message waiting in your Inbox Folder.

Click here to read.
http://myonlineaccounts2.abbeynational.co.uk.pn3ekq976.com/index.php

Best Regards.
Abbey National plc Security Department Team.

* Please do not reply to this email as your reply will not be received.

Abbey National plc. Registered Office: Abbey National House, 2 Triton Square, Regent's Place, London, NW1 3AN, United Kingdom. Registered Number 2294747. Registered in England. Telephone 0870 607 6000. Calls may be recorded or monitored. Calls may be recorded or monitored. Authorised and regulated by the Financial Services Authority. FSA registration number 106054. For more information visit www.fsa.gov.uk/register. Abbey and the flame logo are registered trademarks

phishing walmart

a little while ago we read this news item wal-mart's holiday opening disappoints via the town talk then a few minutes later noticed we had received several walmart based phishing emails -- to gmail's credit they were sorted to junk. naturally this made us wonder if the phishing had something to do with it. nah probably not. perhaps, could it be walmart's growing public perception as an evil empire?

anyway, one tip off that this is a phishing scam is that walmart has no reason to have our email address. we've never used this email address to order anything online much less from walmart or sams.

X-Gmail-Received: 9811646c1950f17050ef4ba53629ef1445eabeee
Delivered-To: wesawthat@gmail.com
Received: by 10.35.12.12 with SMTP id p12cs53194pyi;
Sat, 25 Nov 2006 13:22:43 -0800 (PST)
Received: by 10.35.21.1 with SMTP id y1mr9125209pyi.1164489763244;
Sat, 25 Nov 2006 13:22:43 -0800 (PST)
Return-Path:
Received: from gmlzqx ([85.103.97.216])
by mx.google.com with SMTP id p57si9673693pyb.2006.11.25.13.22.41;
Sat, 25 Nov 2006 13:22:43 -0800 (PST)
Received-SPF: neutral (google.com: 85.103.97.216 is neither permitted nor denied by best guess record for domain of pryyse@4rgroup.com)
Received: from mlqoqr by gmlzqx with local (Exim 4.42 (FreeBSD))
id 1Go4yw-000P6I-YY
for wesawthat@gmail.com; Sat, 25 Nov 2006 23:22:42 +0200
To:
Subject: Walmart Store! Christmas sale! Discounts up to 50%!
From: "Walmart"
Content-Type: text/html;charset=iso-8859-1
Content-Transfer-Encoding: 7BIT
Message-Id: <1go4yw-000p6i-yy@gmlzqx>
Sender: User mlqoqr
Date: Sat, 25 Nov 2006 23:22:42 +0200

another tipoff is that the pictures in the email wont display -- this is because the webhost of the phishing website has already terminated service to it. you can tell this by hovering your mouse over the hyperlink "sony playstation3 60gb bundle..." and you can see the domain walmart-estore.com which is the domain the pictures are hosted from.
i.e.
http://walmart-estore.com/product.php?productid=16455&cat=0&page=1

next, in order to to confirm our suspicions we look up (whois) the domain walmart-estore.com to see if its a walmart owned domain or not. -- its not.

as you can see its owned by someone allegedly named "larry shepard"

just to make sure we look up walmart.com to see how it is registered and hosted etc

EXTERNAL LINK

still phishing paypal

hard to believe but there are still people attempting to hack our personal information by exploiting the popularity of website merchants such as pay pal, ebay, banks and the day to day scams like the notorious nigerian perfected 419 advance fee fraud spammers. anyway here is a paypal phishing email we received this morning:

this is a very well crafted work of phishing it looks perfect - however we should always make it a good habit to automatically look down at the status bar to make sure that the url's match....the following screen grab was taken with the mouse hovering over the link the email presents to click to update your paypal account. then when you look down at the status bar in the lower left corner you see they dont match. hiding the true url as an ip number is very clever too as it makes it harder to identify who the domain belongs to. the part where they add :8110 at the end of the ip number must be some very clever coding ploy that hackers have discovered to redirect browsers.

From: wesawthat@gmail.com
To: abuse@rogers.com,reportphishing@antiphishing.org
Cc: spam@uce.gov
Subject: Fw: Notice: Account Review Necessity.
Date: Tue, 20 Jun 2006 16:22:07 -0500
Organization: www.wesawthat.blogspot.com

ROGERS.COM: this spam was sent to advertise a website that you host thats phishing the paypal.com website please would you terminate service to:

http://70.29.248.143
X-Gmail-Received: e4870c456a1517f3576d3ceb015973ba8dc20d7f
Delivered-To: wesawthat@gmail.com
Received: by 10.35.10.5 with SMTP id n5cs56235pyi;
Tue, 20 Jun 2006 13:50:14 -0700 (PDT)
Received: by 10.37.12.45 with SMTP id p45mr9483396nzi;
Tue, 20 Jun 2006 13:50:14 -0700 (PDT)
Return-Path:
Received: from black.tsimtung.com (static-ip-140-124-134-202.rev.dyxnet.com [202.134.124.140])
by mx.gmail.com with ESMTP id 5si11989260nzk.2006.06.20.13.50.13;
Tue, 20 Jun 2006 13:50:14 -0700 (PDT)
Received-SPF: pass (gmail.com: domain of igameadmin@igameconsoles.com designates 202.134.124.140 as permitted sender)
Received: from apache by black.tsimtung.com with local (Exim 4.50)
id 1Fsn7L-0004kp-WE
for wesawthat@gmail.com; Wed, 21 Jun 2006 04:46:36 +0800
To: wesawthat@gmail.com
Subject: Notice: Account Review Necessity.
From: PayPal.
Reply-To:
MIME-Version: 1.0
Message-Id:<1130384585.13653@paypal.com>
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Date: Wed, 21 Jun 2006 04:46:35 +0800

EXTERNAL LINK

firefox 2.0 released

as usual we are late again seeing as how firefox 2.0 was released 6 days ago. we are really surprised that we didnt know about this release before now. we would have thought that due to our hit counter that we would have noticed someone using the new version. *updated* naturally right after we posted this, the very next hit was a ff v 2.0 user.

firefox 1.5 released

live bookmarks [rss site feed] in firefox browser

EXTERNAL LINK

florida parishes bank phish going around

this morning we received an email representating itself to be from florida parishes bank. florida parishes bank is located in hammond, la. and ponchatoula, la.

we already knew that this was a phish because we dont have an account at this bank and banks never send unsolicited emails. so anyway, a simple google search for florida parishes bank leads us to its website: www.floridaparishesbank.com

in the email when you place your curser on the hyperlink (in blue) above and look down at your status bar you see that url is www.floridaparishesbanksignin.com -- see the difference? just to be sure a whois check of florida parishes bank real website shows that it is hosted by cavion.com and the url registrant information appears to be proper -- while a check of the url from the phishing email shows that it is hosted by yahoo and the registrant information looks suspect -- which results in our email:

From: wesawthat@gmail.com
To: network-abuse@cc.yahoo-inc.com,
reportphishing@antiphishing.org,info@floridaparishesbank.com
Cc: spam@uce.gov
Subject: Fw: You Have 1 New Alert Message!
Date: Mon, 12 May 2008 07:50:11 -0600

YAHOO.COM: this spam was sent to advertise a phishing website that you host please would you terminate service to:

www.floridaparishesbanksignin.com
--copy and paste message source--

====

learn more about phishing scams at the antiphishing working group: www.antiphishing.org

====

related posts

phishing regions bank

nutty nigerians still googling for suckers

bank of america phish

phishing walmart

irs targets sites that steal identies

sean scully's phishing story

===

air force to 'reconsider' its cyber command scam

word came out earlier this week that the united states air force has 'suspended plans to establish its much hyped cyber command program.' this cyber command was to be established at barksdale airforce base at shreveport, louisiana.

it never made any sense to locate cyber command at barksdale in the first place, as the obvious choice for its location should have always been within united states northern command [usnorthcom] at peterson air force base colorado springs, colorado.

more than likely whats happened is that the government has decided to run this massive domestic and international internet monitoring and spy program through one of its spook agencies instead of through the active duty military.

the government is probably afraid that after the military, a lot of whom still take their oath to the constitution seriously, finally catch on to what it's really up to -- will spill the beans.

a 'cyber command' has always been just another governmental scam. for instance, everyday we receive scores, if not hundreds of 419 as well as phishing emails as well as the regular run of the mill spam. this has been going on unabated for years. in fact its worse now than its ever been.

yet the government appears to remain clueless at catching whoever is behind all these online scams. phishing is a serious criminal offense too -- phishing is where someone sets up a website that looks like your bank or paypal or ebay, etc. website and tricks you into entering your username and password and other personal information which they then use to loot your account and/or steal your identity.

these criminals even phish the internal revenue service and impersonate our servicemen and women fighting in iraq. sometimes they try to trick us into installing a .exe file in order to take over or use our computer to perpetuate even more scams.

so if the government cant with the resources already available to them or wont stop all this -- then what can they possibly hope to accomplish against professional "chinese hackers" who have all the latest and most powerful computer equipment and systems paid for with (thanks to americans addiction to all things walmart) american money?

phishing story

the other day our friend sean scully almost got taken in by an ebay email phishing scam. scully is no dummy hes a writer for time and people magazines and it just shows as scully writes:

"I always figured I was just way too cool to be taken in by one of these Phishing scams...But then yesterday I got the most devilishly clever one.If I weren't so irked, I'd rather admire the skill of it..."

read what happened here.

bank of america phish

we received this excellent bank of america.com phish today. it even got around gmail's junk email filter and thats unusual so it could be a new style...

an easy way to tell is to run your mouse over the hyperlink while looking down toward the status bar...for instance in this phish the link looks legitimate but a second look in the status bar shows that they dont match see it begins: starlightdancestudio.com ...to make sure, next you (in firefox 2.0) right click the link and >copy shortcut > then you paste that in your trace route...

3d's traceroute truncates the url down to the domain name.
see starlightdancestudio.com is hosted by someone called ecommerce.com...its not a bank of america domain. then you forward the email complete to the abuse department and cc: reportphishing@antiphishing.org and spam@uce.gov

if you want to although theres no need to email them -- you can also use 3d's traceroute to find out who is the domain name registrar.

Process query: 'starlightdancestudio.com'
1. Step: Querying com.whois-servers.net:43 with whois.
2. Step: Querying whois.godaddy.com:43 with whois -- From: com.whois-servers.net:43 Domain Name: STARLIGHTDANCESTUDIO.COM
Registrar: GO DADDY SOFTWARE, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
-- End -- --
From: whois.godaddy.com:43

====

Reply-To: wesawthat@gmail.com
From: wesawthat@gmail.com
To: abuse@ecommerce.com
Cc: reportphishing@antiphishing.org ,spam@uce.gov
Subject: Fw: Bank of America: Important Notice On Your Account Information (Re-Confirm)
Date: Wed, 6 Dec 2006 15:41:15 -0600

ECOMMERCE.COM: this spam was sent to advertise a phishing website that you host please would you terminate service to:

starlightdancestudio.com/

[message source]

click properties>details>message source>select all to copy and paste the message source to the top of your forward

click the link to read more about phishing from the anti-phishing working group

====
related posts

search this blog * phishing

search this blog * 419

EXTERNAL LINK

IRS targets sites that steal identities

Concerned about a growing identity theft scheme as tax time approaches, the Internal Revenue Service issued a warning last week about Internet sites "phishing" for taxpayers' personal financial data. The IRS has identified sites in 18 countries posing as the IRS and using the agency's official logo. Targeted taxpayers are sent e-mails promising refunds and are lured to one of the sites. The IRS created an e-mail box -- phishing@irs.gov -- to report the sites. The agency never sends out unsolicited e-mails or asks for passwords or PINs. "I commend the IRS for its quick response in setting up a mechanism to investigate this fraud and track down these criminals," said Rep. Richard Baker, R-Baton Rouge, who reported the problem to the agency. "I am also grateful to those who brought the issue to my attention for demonstrating the value of constituent contact with my office."

EXTERNAL LINK

nutty nigerians still googling for suckers

it's been awhile since we did a 419 post and as luck would have it we received one this morning and since its cold and windy here today and this one is just too easy to pass up we thought this would be a good time to post another one.

notice the ip number for this hit: 80.78.16.172

so we wait a few minutes then check the old inbox...sure enough nigerian 419 spammer scammers never fail to disappoint - at least as far as sending the spam goes...

email header:

Delivered-To: wesawthat@gmail.com
Received: by 10.100.252.8 with SMTP id z8cs276303anh;
Sat, 7 Apr 2007 05:55:17 -0700 (PDT)
Received: by 10.35.50.1 with SMTP id c1mr7238005pyk.1175950516847;
Sat, 07 Apr 2007 05:55:16 -0700 (PDT)
Return-Path: barr_miltonchambers2@hotmail.com
Received: from bay0-omc3-s17.bay0.hotmail.com (bay0-omc3-s17.bay0.hotmail.com [65.54.246.217])
by mx.google.com with ESMTP id f51si5592694pyh.2007.04.07.05.55.16;
Sat, 07 Apr 2007 05:55:16 -0700 (PDT)
Received-SPF: pass (google.com: domain of barr_miltonchambers2@hotmail.com designates 65.54.246.217 as permitted sender)
Received: from hotmail.com ([207.46.10.110]) by bay0-omc3-s17.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668);
Sat, 7 Apr 2007 05:55:07 -0700
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Sat, 7 Apr 2007 05:55:07 -0700
Message-ID: BAY121-F30AF072333F7877756DB0EBD5B0@phx.gbl
Received: from 207.46.10.123 by by121fd.bay121.hotmail.msn.com with HTTP;
Sat, 07 Apr 2007 12:55:03 GMT
X-Originating-IP: [80.78.16.172]
X-Originating-Email: [barr_miltonchambers2@hotmail.com]
X-Sender: barr_miltonchambers2@hotmail.com
Reply-To: milton_walters2@yahoo.co.uk
From: "BARRISTER MILTON WALTERS" barr_miltonchambers2@hotmail.com
Bcc:
Subject: URGENT ATTN.
Date: Sat, 07 Apr 2007 07:55:03 -0500
Mime-Version: 1.0
Content-Type: text/html; format=flowed
X-OriginalArrivalTime: 07 Apr 2007 12:55:07.0827 (UTC) FILETIME=[F82B3830:01C77913]
Return-Path: barr_miltonchambers2@hotmail.com

see in the line: X-Originating-IP: [80.78.16.172] same ip number as our hit...

so we put that number in our trace route to find out who the internet service provider for that ip number is:

we can also trace the ip number this way: (last few hops redacted for our privacy)

our email response:

Reply-To: wesawthat@gmail.com
From: wesawthat@gmail.com
To: abuse@constellationnetcorp.com,report_spam@hotmail.com,
abuse@yahoo-inc.com,TBright@Kuzola.com
Cc: "spam @ uce.gov" spam@uce.gov
Subject: Fw: URGENT ATTN.
Date: Sat, 7 Apr 2007 08:03:20 -0500
Organization: www.wesawthat.blogspot.com

CONSTELLATIONETCORP.COM / TBRIGHT: this advance fee (419) fraud spam came from an a ip address that you host please would you terminate service to:

80.78.16.172

HOTMAIL.COM: this advance fee (419) fraud spam references an email account that you host please would you terminate service to:

barr_miltonchambers2@hotmail.com

YAHOO.COM: this advance fee (419) fraud spam references an email account that you host please would you terminate service to:

milton_walters2@yahoo.co.uk

EXTERNAL LINK

semantic.exe phish

heres a pretty decent phishing email thats currently making the rounds. it must be new seeing as gmail hasnt begun to filter it yet since we've received about six of these emails in the past hour.

at first glance it appears to be a legitimate email -- however, when you hover your mouse over any of those three "start" buttons while looking down at your status bar, shown in the lower left of our screen grab, you see if you click one, the real url that you will be taken to:

http://sath.hs.kr/bbs/skin/zero_vote/Symantec.exe

if you google semantic.exe you will quickly find out that this is a trojan that:

Gathers email addresses from all .txt and .html files located on the following drives:

* C
* D
* E
* G
* F

Sends a copy of itself in an email...~source~

so apparently someone who has our email address is infected. lovely.

investigador.exe phish

we received another exquisite phishing email tonight, yet another one that managed to get around gmail's junk email filter. we're not sure but we have a strong suspicion that this is the work of the same crime gang that started out with the cartao.exe ecard email that we blogged about here. this is obviously a professional hi-tech crime gang and they have been doing this for awhile now. we wonder why interpol hasnt come knocking at their door yet. these particular phishing emails arrive presenting themselves to be a regular ecard....

however, when we mouse over the red box where it says "Ver meu Cartao" (which we have no clue what this means btw) the first thing we notice down in the status bar -- bottom left in our picture -- we see the true url: mimundo.americaonline.com.ar/atualizaorkut10/investigador.exe and notice that it ends in .exe -- a .exe file extension is an executable file "whose contents are meant to be interpreted as a program by a computer." hackers can use .exe files to install and launch viruses, trojans, worms and what not to take over your computer. we think that the particular crime gang thats behind this is building a botnet.

this particular email does not contain any attachments. its cleverly designed to trick you into thinking that its an ecard. so you click the link in that box thinking you are going to fetch your ecard but instead you are taken to a website and thats where the .exe file is installed on your computer.
Reply-To: wesawthat@gmail.com
From: wesawthat@gmail.com>
To: TosWeb@aol.com,reportphishing@antiphishing.org
Cc: spam@uce.gov
Subject:Você Recebeu um Cartão OCarteiro.com.br
Date: Fri, 8 Dec 2006 00:07:26 -0600

AOL.COM: this spam was sent to advertise a phishing website that you host that is tricking computer users into installing a .exe file please would you terminate
service to:

http://mimundo.americaonline.com.ar/atualizaorkut10/investigador.exe

search this blog * phish

EXTERNAL LINK

stimulus payment phish

criminals will phish anything. heres a new phish going around that purports to be from the internal revenue service but in the emails "from" line it says: bvs credit union.

when you mouse over the hyperlink that says "click here" (in blue) and look down in the status bar you see the link doesnt contain the irs.gov domain like you would expect -- instead it goes to a website whose domain is tel.artwifi.net

when you do a whois of that domain, you see its hosted by a company in belgrade, serbia. if you would have clicked on the link and filled in the form with your personal information, etc. you would have been giving the criminals your name, social security number, banking information and who knows what else.

EXTERNAL LINK