It seems to be standard phishing.
I received nine copies, using three different real IPs in the URI; All of the URI's used port 3180, though. I imagine the messages are sent through machines turned zombies through recent viruses.
The IP's of the sending machines: 24.190.170.234 24.202.111.221 24.202.7.19 24.226.181.155 63.139.158.202 128.39.54.28 148.240.16.95 200.103.136.197 220.27.216.46 These IPs are cable modems, etc. Again, probably zombies.
The Phishing URI's were: 5 http://[EMAIL PROTECTED]:3180/index.htm 3 http://[EMAIL PROTECTED]:3180/index.htm 1 http://[EMAIL PROTECTED]:3180/index.htm These three are assigned through APNIC.
The "%01" trick will cause some browsers to stop displaying the rest of the URI. So the user may actually see only "http://www.fdic.gov"; in some cases!
It's been my opinion as of late that user education is absolutely critical to preventing viruses and phishing alike. So don't pursue a 100% technical solution.
Regards, Michael Hudson
>From - Sun Jan 25 17:59:46 2004
X-UIDL: 374993730
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from SMTP32-FWD by mail.example.com
(SMTP32) id A000000E5; Sun, 25 Jan 2004 16:54:56 -0800
Received: from bbtec.net [220.27.216.46] by mail.example.com
(SMTPD32-6.00) id A559280174; Sun, 25 Jan 2004 16:54:49 -0800
Received: from YahooBB220027216046.bbtec.net (YahooBB220027216046.bbtec.net
[220.27.216.46])
by bbtec.net (8.12.8p1/8.12.8) with ESMTP id xyzew940644
for <[EMAIL PROTECTED]>; Mon, 26 Jan 2004 00:46:38 -0400 (EST)
Message-ID: <[EMAIL PROTECTED]>
From: "FDIC" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Important News About Your Bank Account
Date: Mon, 26 Jan 2004 00:46:36 -0400 (EST)
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_000F_01C33095.9F84B280"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2720.3000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
X-UIDL: 374993730
Status: U
X-Text-Classification: spam
This is a multi-part message in MIME format.
------=_NextPart_000_000F_01C33095.9F84B280
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0010_01C33095.9F84B280"
------=_NextPart_001_0010_01C33095.9F84B280
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_0010_01C33095.9F84B280
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<head>
</head>
<body>
To whom it may concern;
<p>In cooperation with the Department Of Homeland Security, Federal, S=
tate and Local Governments your account has been denied insurance from=
the Federal<br>
Deposit Insurance Corporation due to suspected violations of the Pat=
riot Act. While we have only a limited amount of evidence gathered on =
your account at<br>
this time it is enough to suspect that currency violations may have =
occurred in your account and due to this activity we have withdrawn Fe=
deral Deposit<br>
Insurance on your account until we verify that your account has not =
been used in a violation of the Patriot Act.</p>
<p>As a result Department Of Homeland Security Director Tom Ridge has =
advised the Federal Deposit Insurance Corporation to suspend all depos=
it insurance on<br>
your account until such time as we can verify your identity and your=
account information.</p>
<p>Please verify through our IDVerify below. This information will be =
checked against a federal government database for identity verificatio=
n. This only takes<br>
up to a minute and when we have verified your identity you will be n=
otified of said verification and all suspensions of insurance on your =
account will be<br>
lifted.<br>
<br>=20
<a href=3D"http://[EMAIL PROTECTED]:3180/index.htm">ht=
tp://www.fdic.gov/idverify/cgi-bin/index.htm</a>
</p>
<p>Failure to use IDVerify below will cause all insurance for your acc=
ount to be terminated and all records of your account history will be =
sent to the<br>
Federal Bureau of Investigation in Washington D.C. for analysis and =
verification. Failure to provide proper identity may also result in a =
visit from Local,<br>
State or Federal Government or Homeland Security Officials.</p>
<p>Thank you for your time and consideration in this matter.</p>
<p>Donald E. Powell</p>
<p>Chairman Emeritus FDIC </p>
<p>John D. Hawke, Jr. </p>
<p>Comptroller of the Currency </p>
<p>Michael E. Bartell </p>
<p>Chief Information Officer</p>
</body>
</html>
------=_NextPart_001_0010_01C33095.9F84B280--
