Windows

New eCard Phishing Trick To Be Aware Of

Posted by on Jun 26, 2006 | 3 Comments

The beauty of a Mac is I can investigate what phishing e-mail I’ve just been sent has in store for me, safely. In this case, I received an e-mail “from” 123Greetings.com (see the full resolution screen capture of the message) that said, “A friend has sent you an ecard from 123Greetings.com.” The card was to “Dear darling” and the message was short, yet sweet, stating, “i hope you like this card that i have made only for you.” ‘Oh, boy, who’s calling me darling and what did they send?’ would probably be the average person’s reaction and when they click the hyperlinked URL that states 123greetings.com on it, they actually get a page at a server IP of 64.34.149.37 that then downloads something. Something nasty, I’m sure. The Web page with a META tag that automatically starts your download reads:

A friend has sent you an e-card from 123Greetings.com

- download and view your e-card

Your ecard number is:

GreetingCardNr0410112528543.flash

Best wishes,
123Greetings.com


What the download (and the META tag) links to is this: http://64.34.149.37/GreetingCardNr0410112528543.flash.exe. Copy and paste and try at your own risk! Since the Mac cannot run executables (yet), I was safe from this payload. Man, what a bomb I’m sure is packed into this package. Yikes.

Be careful, folks. Phishing, a term used to identify fraudulent e-mails enticing one with an offer that ends up stealing your personal information or causes you to download something, is a very common thing now. Firefox and IE both have anti-phishing protection, but things like this e-mail I got can still get by them. So just keep your eyes open and never click a click in an HTML e-mail until your pop-up (in Outlook) or the info bar shows what the real address is behind that URL. If it’s all numbers, don’t click it. Just delete the e-mail.

[tags]phishing,123greetings,dear darling,64.34.149.37,greetingcardnr0410112528543.flash[/tags]

  • bobby dias

    I learned this trick long ago- when there is reason for doubt, right click the page, click properties. The address in the browser window should match the url on the properties page. If it doesn’t you have a fake.
    I had a lot of experience during the last Michael Jackson criminal trial when he had somebody fake at least 373 internet pages that said cnn.com, fox.com, newyorktimes.com, losangelestimes.com and other majors were saying MJ was being harassed and much more- to and succeeded in prejudicing the jurors. One child rapist is free- now onward to nasty downloads!

  • Pingback: fourwhitefeet

  • http://www.JewishBastard.com Samantha

    People are even using these type of ecards to get people’s aol passwords. When they receive the ecard they are redirected to a logon page where they are prompted to enter their login information to gain access to their ecard. Their username and passwords are then stolen.