twitter Phishing

This was a Phishing mail related to twitter in my SPAM box, out of curiosity I opened this mail to dig deeper. Sample mail cam be seen in the picture below.


When you take mouse over the URL in the mail or on to "Twitter Support" link we can see the Phishing URL.

http://84.51.21.51/~chatliam/mepw.html

Opening the link will redirect us to

http://tirearoma.com/

Didn't find anything malicious in the tirearoma.com page. The Phishing might be just to increase hits to "tirearoma.com", pay-per-click !!!

The redirected page has plethora of capsules related to Viagra etc. etc.


Happy browsing !!!

SPAM Mails: Part 2

Following is the SPAM mail which most of us has received and many ended up in replying to it.

Dearest One,

Good a thing to write you. I have a proposal for you; this however is not
mandatory nor will I in any manner compels you to honour against your
will.

I am Aisha Al- Salam, 23years old and the only daughter of my late
parents Mr.and Mrs.Hassan Al-salam my father was a highly reputable
business magnet - (a cocoa merchant) who operated in the capital of Cote
D Ivorie during his days.

It is sad to say that he passed away mysteriously in France during one of
his business trips abroad year 12th.Febuary 2007. Though his sudden death
was linked or rather suspected to have been masterminded by an uncle of
his who travelled with him at that time. But God knows the truth! My
mother left me when I was just 4 years old, and since then my father took
me so special.

Before his death on February 12th 2007 he called his secretary who
accompanied him to the hospital and told him that he has the sum of 7.5
million, United States Dollars.(USD$7,500.000 ) left in one of the
Leading Bank in Cote D Ivorie and he deposited the money in my name in
the bank as the next kins.

I am just 23 years old and a university undergraduate and really don't
know what to do. Now I want a foreign partner overseas where I can
transfer this fund. This is because I have suffered a lot of set backs as
a result of incessant political crisis here in Cote D Ivorie . The death
of my father actually brought sorrow to my life.

Sir, I am in a sincere desire of your humble assistance in this
regards.Your suggestions and ideas will be highly regarded. Now permit me
to ask these few questions:-

1. Can you honestly help me as your daughter?
2. Can I completely trust you?
I have decided to offer you 30% of the total amount for your willingness
to help me, Please kindly response to my mail immediately with your full
personal information, telephone number so that I can call and speak with
you on the telephone.

Please, consider this and get back to me as soon as possible.

Thank you so much.
Insallah .

My sincere regards,
Ms Aisha Al Salam.

SPAM Mails: Part 1

Below is the SPAM mail which I received in my INBOX. To make it realistic spammers had gone one step ahead and provided with contact numbers and few images to make it realistic and entice users to give their personal information.

FROM THE DESK OF THE DIRECTOR:
UK INTERNATIONAL LOTTERY PRIZE AWARD DEPT

WINNING NOTIFICATION FOR CATEGORY "A" WINNER ONLY

Amount Won: £1,000,000.00 Pounds

Dear Lucky winner,

We are glad to inform you that you have won a prize money of One Million
Great Britain Pound Sterlings (£1,000,000.00) in our last lottery promotional
draw.

We are pleased to inform you of the final announcement of the result in
UK INTERNATIONAL LOTTERY PRIZE AWARD DEPT. Your email address was selected by our Electronic Random Selection System (ERSS) from an exclusive list of e-mail addresses of individual and corporate bodies. No tickets were sold.

With Ref.Number: GP 14-M-246-04,
Batch Number: 573881545-UK/2010
Ticket Number: PP3502/8707-01.

CONGRATULATIONS!!!:
To file for Your Claims Please contact.
********************************************
Name: MR JOSEPH POUNCH
Tel:+447014275315
Email: josephpounch18@gmail.com
*******************************************
However you will have to fill and submit this form to the events manager for
verification & direction on how you canclaim your winning fund.
Fill the Details Below:
1. Full name...............
2. Contact Address......
3. Age.........................
4. Mobile Number.........
5. Marital Status..........
6. Sex.........................
7. Occupation..............
8. Company................
9.State:......................
10.Country..................
11.Nationality...............
12.Address.................
13.Valid ID Proof (Send as email attachment)
Your Reference and Batch number at the top of this mail:

Mrs Vivian Jones.
Lottery Coordinator

Most of the netizens fall pray for this and end up providing their information. Above details can be used to crack passwords with intelligent guesses.

Before providing information in reply to such mails think once, "who the hell in this world is going to give free money !!! "

AXIS Bank Phishing2...Be Careful !

Don't be surprised if you get a mail from AXIS bank (infact not from AXIS bank but from malicious user) saying "MPORTANT NOTICE: Update Your Axis Bank Ltd® Net Banking Details" (this is the subject). Notice the missing "I" for word IMPORTANT in the subject. Most people might end up reading reading "MPORTANT" as "IMPORTANT".
The mail looks like
Clicking "Update Your NetBanking Account" will redirect us to
http://axisaccountsummary.t35.com/axisbank.co.in/RetailSignOn.htm
which looks like

Write anything in "Login ID" and "Password" text boxes and Click "Submit" tab without selecting the radio buttons, this will redirect us to
http://axisaccountsummary.t35.com/axisbank.co.in/authenticate.php
The authenticate.php page looks like

On this page we find "Download","Click Here" hyperlinks, on clicking them will redirect to
https://www.axisbank.co.in/BankAway/(b5zbwu55bnaszw55d2iyuz55)/web/L001/retail/jsp/user/%5Cdownload%5Ciconnectform.pdf
https://www.axisbank.co.in/BankAway/(b5zbwu55bnaszw55d2iyuz55)/web/L001/retail/jsp/user/%5Cdownload%5Cicoftfform.pdf
respectively. Above URL's which point to the real website are using HTTPS request to get the resource and we can see the Phishing filter(Lock symbol) on down left but we get "The page cannot be found" error while downloading the PDF's.
Enter any arbitrary data into "ATM Card No.", "ATM Pin No.","Transaction Password" and click "Continue" tab which will redirect to
http://christkingdomorphanage.org/idbi2/accountsummary.php

I browsed to the Contact Us page (http://www.christkingdomorphanage.org/contactus.php) where the address is mentioned as
CHRIST KINGDOM ORPHANAGE HOME
UMUEZEALAKPA ALAENYI
OGWA, MBAITOLI LGA,
IMO STATE, NIGERIA
p: (+234) 8033738658
e: http://www.christkingdomorphanage.org/info@christkingdomorphanage.org
w: http://www.christkingdomorphanage.org/

Well, this might be the phishing mail originating from Nigeria, most probably.

Safe Surfing...Enjoy!!!

AXIS Bank Phishing1...Be Careful !

I has been seeing these mails from long time. I never used to open such mails, instead delete the mails. This time thought of writing about the issue. Got a mail from "AXIS Bank" (fake) with Subject "AXIS Bank Security Service Notification (IMPORTANT)". When opened, the mail looks like

We can find the following URL in the mail

h ttps://www.axisbank.com/security/New 2FA Token=a cct

When we hover mouse over the URL we can see http://eyering.com/interaction/cache/update/axis.php

link below the page.

The page below is original AXIS BANK's login page

When we click the link in the mail it will redirect us to the URL http://iamthecompetition.com/subscription/axisbank.co.in/RetailSignOn.htm

and the page looks like

This is the phishing page used by attackers to collect user names and passwords.

If you click "Submit" tab below radio button's it'll reidrect to other page which asks for ATM Pin !!

Safe Surfing...Enjoy!!!