June 2010 Archives

Another variant of the "Your webmail quota has exceeded the set quota" scam.  This one is sent from "Localhost" and one of the BIGGEST CLUE that this is a scam...  Do you know someone named "Localhost"?

There's nothing very specific in the details of this e-mail to lead you to believe that they have any information about you and was sent out to see if anyone would take the bait.  Definitely something you can simply throw away and not worry about.  Just don't click on the link provided.

Your webmail quota has exceeded the set quota which is 20GB. you are currently running on 20.9GB. To re-activate and increase your webmail quota please click the link below.


http://ow.ly/244BZ


Failure to do so may result in the cancellation of your webmail account.


Thanks, and sorry for the inconvienence.

Localhost


This email originated from Treasure Valley Community College and it appears as though someone's account got hacked/compromised.

webmail_scam_01.png

Enhanced by Zemanta
Image representing Amazon as depicted in Crunc...

Image via CrunchBase

You may have done business with Amazon-dot-COM in the past and if you have, this is something you'll need to beware and scrutinize. An e-mail was received stating that my Amazon order had been shipped.  Everything about the e-mail looks legit except for the fact that I didn't order anything recently.  This quickly let to closer examination of the e-mail and found the links were NOT pointing to Amazon's website.

The header information of this particular e-mail showed that it originated from Russia (net218.186.188-49.dynamic.omsk.ertelecom.ru/188.186.218.49), this may not be the only source of the spoofed email and in fact, one of the routes that the e-mail went through Amazon's own servers.

Always scrutinize e-mails that you've received from businesses, especially e-mail from businesses you seldom have contact, if any at all.

amazon_scam_01.png

Enhanced by Zemanta
Image representing Twitter as depicted in Crun...

Image via CrunchBase

Recently, I've gotten an e-mail from Angelina Jolie asking me to join her on Facebook.  Needless to say, that was a bogus request.  Today, I've gotten a supposedly e-mail notification from Twitter stating that I recently changed my e-mail address associated with an Twitter account and that I needed to click on a link to confirm.  That automatically threw up flags everywhere.

twitter_app_fake_01.pngWhile this e-mail originated from someplace in the United Kingdom (78.150.94.45), the link in the e-mail points to some Russian website (http://bygirl.ru/vcqf.html).

As always, examine your e-mail very carefully, if at all possible, try going to the directly on your web browser and not through the link that's provided within the e-mail.  Check for spelling errors, though this is not direct proof that the e-mail you've received is bogus/fake, it does warrant further investigation.

Reblog this post [with Zemanta]
Angelina Jolie at the premiere of Alexander in...

Image via Wikipedia

"Angelina Jolie" invited me to join Facebook and the invite looks all legit and everything or does it?  The email address that the invite was sent to is already registered with Facebook so then "WHY" would it be asking me to sign up?  "WHY" would it be asking me to add the email address to my Facebook account?

This new phishing attempt tries to get users to click on the link(s), drawing them to a website that's not Facebook, for reasons unknown but definitely nefarious.

facebook_invite_fake_01.png
Like any phishing emails, the links do not taking you to the actual site (e.g. Facebook) and in this instance, if you click on the button or the links, it will take you to some compromised site(s).  In fact, all the links on the email has been substituted with the alternate site (see below for list of sites).

The email itself originated from a different IP locations:

217.12.70.152 (RU)
95.72.115.111 (RU)


So, the bottom line, the email request looks very authentic if weren't for the following, "Why would Angelina Jolie be asking me to join Facebook"?  Be warned, be cautious and be alert.

Compromised/Free Hosting Sites used by Phishers:

  • http://xyddds.110mb.com/index.htm
  • http://grapevinephotography.com.au/1.htm


Reblog this post [with Zemanta]

About this Archive

This page is an archive of entries from June 2010 listed from newest to oldest.

May 2010 is the previous archive.

August 2010 is the next archive.

Find recent content on the main index or look in the archives to find all content.