Phishing emails

By , May 7, 2005 12:57 am

Keep getting the damn things. The latest is from SouthTrust Bank. It goes as follows:

————————————

During our regular update and verification of the Internet Banking Accounts , we could not verify your current information. Either your information has been changed or incomplete, as a results your access to use our service has been limited. Please update your information.

Click on the link below to update your account information.

https://www.southtrust.com/st/OnlineBanking/update/

Copyright 2004, SouthTrust. All Rights Reserved
Copyright & Proprietary Information
Terms and Conditions
SouthTrust Bank, Member FDIC

————————————

That looks okay but when you go to the source (Luke) of the offending line then it looks a bit different:

————————————

    Click on the link below to update your account
information.

   
https://www.southtrust.com/st/OnlineBanking/update/

 


————————————

The indication that it’s not leget is instead of southtrust.com in the url link it has a group of numbers: 200.199.203.235

So we copy that, switch to the Terminal and do a WhoIs Search as follows:

————————————

Last login: Wed May 4 12:13:48 on console
Welcome to Darwin!
Daves-iBook:~ dave$ whois 200.199.203.235

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

ReferralServer: whois://whois.lacnic.net

NetRange: 200.0.0.0 – 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details, or check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2005-03-29

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Whois Info
OrgTechPhone: (+55) 11 5509-3522
OrgTechEmail: whois-contact@lacnic.net

# ARIN WHOIS database, last updated 2005-05-05 19:10
# Enter ? for additional hints on searching ARIN’s WHOIS database.

% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2005-05-06 15:40:37 (BRT -03:00)

inetnum: 200.128/9
status: allocated
owner: Comite Gestor da Internet no Brasil
ownerid: BR-CGIN-LACNIC
responsible: Frederico A C Neves
address: Av. das Na??es Unidas, 11541, 7? andar
address: 04578-000 – S?o Paulo – SP
country: BR
phone: +55 11 9119-0304 []
owner-c: CGB
tech-c: CGB
inetrev: 200.128/9
nserver: A.DNS.BR
nsstat: 20050504 AA
nslastaa: 20050504
nserver: B.DNS.BR
nsstat: 20050504 AA
nslastaa: 20050504
nserver: C.DNS.BR
nsstat: 20050504 AA
nslastaa: 20050504
nserver: D.DNS.BR
nsstat: 20050504 AA
nslastaa: 20050504
nserver: E.DNS.BR
nsstat: 20050504 AA
nslastaa: 20050504
remarks: These addresses have been further assigned to Brazilian users.
remarks: Contact information can be found at the WHOIS server located
remarks: at whois.registro.br or at http://whois.registro.br
created: 19950104
changed: 20020902

nic-hdl: CGB
person: Comite Gestor da Internet no Brasil
e-mail: blkadm@NIC.BR
address: Av. das Na??es Unidas, 11541, 7? andar
address: 04578-000 – S?o Paulo – SP
country: BR
phone: +55 19 9119-0304 []
created: 20020902
changed: 20020902

————————————

So this one comes to us courtisy of Brazil. Most of the ones I have gotten lately have been registered to Taiwan.

The moral to this rather long post is to NEVER trust links in emails. Even ones from someone you know. Always either show source and copy and paste or right click (control-click on mac and copy the link and paste it into a new browser window url bar and check that what has pasted is the correct link before pressing Enter (Return for Mac).

HTH

Leave a Reply

You must be logged in to post a comment.

Panorama Theme by Themocracy