Subject: Most impressive Phish I've seen (Fw: Visa Security Update)

From: Mark Smith <[email-masked]>
Date: Wed, 24 Dec 2003 14:46:59 +1030

Just received this Phish email.

What is amazing about it is that, while it looks like a plain ascii email, it was actually in HTML, and HTML had been used to make it look like an plain ascii email.

I don't remember giving Visa any of my "nosense.org" email addresses, so I was suspicious. Clicking the "http://www.visa.com" link took me to this URL

http://server445.servers101.com/suspended.page/

Fortunately, it looks like the phishermen have been noticed, and the bogus site shut down.

The only way I discovered it was bogus was to view the original email source, to then see the HTML.

Just goes to show, you should never click any URLs in emails that are asking about any private or sensitive information, irrespective of how legitimate or harmless they appear to be.

(Now to find where to disable HTML in my mail client ...)

Regards,
Mark.

Begin forwarded message:

Date: Wed, 24 Dec 2003 07:04:20 -0500
From: Visa International Service <[email-masked]>
To: [email-masked]
Subject: Visa Security Update

Secure with Visa

Dear Customer,

Our latest security system will help you to avoid possible fraud actions and
keep your investments in safety.

Due to technical security update you have to reactivate your account

Click on the link below to login to your updated Visa account.

To log into your account, please visit the Visa Website at

http://www.visa.com

We respect your time and business.
It's our pleasure to serve you.

Please don't reply to this email. This e-mail was generated by a mail handling system.

Copyright 1996-2003, Visa International Service Association. All rights reserved.

---

From: "Frederic" <[email-masked]>
Date: Wed, 24 Dec 2003 07:38:20 -0500

phishing can be reported to the Federal Trade Commision

"The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop and avoid them. To file a complaint or to get free information on consumer issues, visit www.ftc.gov or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters Internet, telemarketing, identity theft and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad."
http://www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt.htm

Frederic
MCP,  IT Project+, i-Net+, CIWA, A+
member of: CompTIA-ITPRO, HDI, IETF
------------------------------------------------------
http://fredsfastcram.netfirms.com
------------------------------------------------------
 
  ----- Original Message ----- 
  From: Mark Smith 
  To: [email-masked] 
  Cc: [email-masked] 
  Sent: Tuesday, December 23, 2003 11:16 PM
  Subject: Most impressive Phish I've seen (Fw: Visa Security Update)

  Regards,
  Mark.

  Begin forwarded message:

  Secure with Visa

  Dear Customer,

  http://www.visa.com

---

From: [email-masked]
Date: Wed, 24 Dec 2003 01:32:54 -0500

On Wed, 24 Dec 2003 14:46:59 +1030, Mark Smith said:

> What is amazing about it is that, while it looks like a plain ascii email, it
> was actually in HTML, and HTML had been used to make it look like an plain
> ascii email.

> I don't remember giving Visa any of my "nosense.org" email addresses, so I
> was suspicious. Clicking the "http://www.visa.com" link took me to this URL

> Fortunately, it looks like the phishermen have been noticed, and the bogus site shut down.

Yeah.  Notice that the URL is (if it's the same scam being discussed on the
Full-Disclosure list):

http://www.visa.com:[email-masked]/verified-by-visa.html

or some such. Just be glad there wasn't an x'01' in there, or you'd probably
STILL be scratching your head wondering how it happened. :)