Spyware Warrior

MagicalAndy · Posted: Sat Jun 30, 2007 3:03 am Post subject: Dodgey Looking Email

I got sent the following today from From: "NetFunCards.Com" aka osfq@acostamed.com:

Nightmaretony · Posted: Sat Jun 30, 2007 7:02 am Post subject:

hint 1: if they give an ip as the email thing, then most likely it is bad news. Do NOt go there under any circumstances.

hint 2: do a google search on it. get Search Advisor to help out. For example, if it seemed more honest and said www. myfunEcards.com, then type that into google and see what comes up.

The same applies to job search websites. I was able to avoid a bunch of fraudulent ones while job hunting by just using that simple trick. Worked like a champ.

Potentially dangerous link broken by admin.

Edit by Tony: link was fictional but good call there, but it gets the point across)
_________________
For this is the place
where dreams
and nightmares
are birthed
and bred

Nightmare Park

ld · Posted: Sat Jun 30, 2007 8:18 am Post subject:

These emails have been spammed out heavily in the past few days and take you to sites that try to exploit your browser and install bad stuff. Here is some more information:

http://isc.sans.org/diary.html?storyid=3072
http://isc.sans.org/diary.html?storyid=3063

olliver · Posted: Sat Jun 30, 2007 1:04 pm Post subject:

This nonsense hit my spamtrap, too. Smile

MagicalAndy, if there were such a service and it were used by any of your family members, it would contain a familiar name or at least email address that would reveal the sender. This one here, however is entirely anonymous and can be sent in bulk without the necessity to adjust anything.

Furthermore:

both the sender's address and the download location would be something with NetFunCards.com.
the sender's MTA would be within the same ip allocation (first received line involving an ip address not from your isp's or domain's mail server) of NetFunCards.com.
the postmaster surely hasn't got that much to do with sending postcards as it's the administrator of the email servers. His/her job would be keeping the system up and running.

As already suggested, if something has a fishy odour, searching Google for characteristic sequences may soon reveal the true nature of the postcard. Such a search will pe particularily successful if you try searching the NANAS archives, which should be up to date regarding the latest spam runs.

Olliver

MagicalAndy · Posted: Sun Jul 01, 2007 2:21 am Post subject:

Thanks for the info guys, I appreciate your comments/advice.

Apologies for leaving the email links in the post, I wasn't concentrating.