Matt
Mike wrote:
Mike
Thanks for the info, but I think we would appreciate it if you did not send the actual virus to us thru this forum. We are doing enough to keep it off of our systems.
McAfee E-mail Scan : Has detected potentially unwanted e-mail message body. Scanner Detected: Exploit-URLSpoof.gen Message was sent by : [EMAIL PROTECTED] Sender E-mail Address : [EMAIL PROTECTED] Carbon Copy to : None
Michael Otte ISD/Internet Developement Division 562-940-3020 [EMAIL PROTECTED]
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Michael Hudson Sent: Wednesday, January 28, 2004 4:07 PM To: [EMAIL PROTECTED] Subject: Potentially unwanted message body detected, entire message has been moved to quarantine folder~Re: [IMail Forum] Alert! - fraudulent e-mail - FBI and FDIC
Attached is a copy for everyone's reference. I've taken references to my domain name out and replaced them with example.com.
It seems to be standard phishing.
I received nine copies, using three different real IPs in the URI; All of the URI's used port 3180, though. I imagine the messages are sent through machines turned zombies through recent viruses.
The IP's of the sending machines: 24.190.170.234 24.202.111.221 24.202.7.19 24.226.181.155 63.139.158.202 128.39.54.28 148.240.16.95 200.103.136.197 220.27.216.46 These IPs are cable modems, etc. Again, probably zombies.
The Phishing URI's were: 5 http://[EMAIL PROTECTED]:3180/index.htm 3 http://[EMAIL PROTECTED]:3180/index.htm 1 http://[EMAIL PROTECTED]:3180/index.htm These three are assigned through APNIC.
The "%01" trick will cause some browsers to stop displaying the rest of the URI. So the user may actually see only "http://www.fdic.gov"; in some cases!
It's been my opinion as of late that user education is absolutely critical to preventing viruses and phishing alike. So don't pursue a 100% technical solution.
Regards, Michael Hudson
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
