Examples of Phishing Scams

**Big Booger** · February 4th, 2005, 09:20 AM

Take a look at the image attached. Really look closely at the FROM: line.

You'll see an authentic-looking ebay address. But if you look at it a little longer, you'll see the [email protected]

Reply3 is where the BS begins... That is a fake.

Next when we click the URL, it takes us to a fake site:

http://click3.ebay.com/14460512.54805.0.46540

click3 signifies more BS...

Just in case you've never seen a fake phishing mail.. the one attached is as fake as they come..

Though you really have to be careful because the phishing scams are getting more clever by the minute.

**rohitk89** · February 4th, 2005, 11:46 AM

nice one bb...should help a lot of people that...did u come accross that one in ur inbox?

**Big Booger** · February 4th, 2005, 13:00 PM

Yep,
I got that one today.. I get them all the time.. usually ebay, paypal, or amazon...

**rohitk89** · February 4th, 2005, 13:27 PM

lol..i get ones containing details abt libido enhancers...

**rik** · February 4th, 2005, 13:57 PM

It sure looks real enough...

**FastGame** · February 4th, 2005, 15:13 PM

Originally Posted by rohitkumar

lol..i get ones containing details abt libido enhancers...

yeah like you really need that

Hey could you send me your emails ? I'll send you mine that have porn links

I get those eBay scams too

**rohitk89** · February 4th, 2005, 16:24 PM

Hey could you send me your emails ? I'll send you mine that have porn links

for a minute there i took that seriously..i began typing "okay. wat's ur e-m..." and stopped..ROFL..

**rik** · February 4th, 2005, 16:26 PM

I run SpoofStick both for IE and FireFox. When I cick the "click3" URL SpoofStick actually shows that I am on Ebays site...

**egghead** · February 4th, 2005, 19:18 PM

If you get this in any future email, delete it with confidence - egghead

Dear Valued Customer,

M&I Bank, is committed to maintaining a safe environment for our customers. To protect the security of your account, M&I Bankemploys some of the most advanced security systems in the world and our anti-fraud teams regularly screen the M&I Bank system for unusual activity.

We are contacting you to remind you that on Jan. 25, 2005 our Account Review Team identified some unusual activity in your account. In accordance with M&I Bank`s User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved.

We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.
Visit to unlock your https://cib.ibanking-services.com/cib/

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience. Sincerely,
M&I Bank,Account Review Department

**egghead** · February 5th, 2005, 00:50 AM

If you get this email you can confidently delete it without worry - Egghead

Dear eBay customer,

During our regularly scheduled account maintenance and verification procedures,
we have detected a slight error in your billing information.

This might be due to either of the following reasons:

1. A recent change in your personal information ( i.e.change
of address).
2. Submiting invalid information during the initial sign up
process.
3. An inability to accurately verify your selected option of
payment due to an internal error within our processors.

Please update and verify your information by clicking the link below:

https://arribada.ebay.com/saw-cgi/eB...ll?PlaceCCInfo

If your account information is not updated within 48 hours then your ability to sell or bid on eBay will become restricted.

Thank you

The eBay Billing Deptartment .

Copyright
Â© 1995-2005 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective
owners.
Use of this Web site constitutes acceptance of the eBay User
Agreement and Privacy
Policy.

**egghead** · February 5th, 2005, 00:55 AM

If you get this email DO NOT REPLY to them for any reason - Egghead

Subject: URGENT REPLY NEEDED
To: Egghead
From: [email protected]
Date: Fri, 4 Feb 2005 01:15:20 -0800

Dear Beloved,

I humbly crave your indulgence in sending you this mail, if the contents does not meet with your personal and business ethics, I apologise in advance, I am Mark Ncube the first Son of Mr Solomon.D.Ncube former national security advicer to the ousted Sierria Leonean military head of state, Paul Koroma.I am writing to express my interest in real estate or landed properties in your country. Though my father died in detention a couple of months ago while been detained by the new government. Before his untimely death, he instructed me to leave the country for my safety and start up a business somewhere out side Africa with a total sum of
USD7.300.000 ( Seven million three hundred thousand United States Dollars) which he deposited in a Security Company here in Bangkok Thailand.

Actually, I have never met you before, but it was a friend of my father who happened to be present at his bural that adviced me to consider your country for my investments. After due
consideration, I started searching the web side where I got your email address. No one else is
aware of my proposal to you.Due to social, economic and political instability in west African
region, I decided to seek your assistance in transfering this money into your private or institutional account for my investment purposes.I have all the vital documents that covers the deposit which could be faxed to you upon request. Transaction of this nature demands the
highest trust and confidence between both parties. This transaction is 100% risk
free. For your assistance in this transfer, I have decided to give 20% of the total sum involved and 5% mapped out for miscellaneous expenses that we may incure during the process.
Your acceptance of this proposal or otherwise should please be communicated through my E.MAIL address. Your quick response will be appreciated. However, if you are not disposed to assist, kindly distroy this letter to protect the identity and confidentiality of the
parties involved.

I look forward to hearing from you soon.

Thanks.
Yours Sincerely,
Mark Ncube.

**rik** · February 5th, 2005, 01:53 AM

Once again, I am running SpoofStick.

"What is SpoofStick?
SpoofStick is a simple browser extension that helps users detect spoofed (fake) websites. A spoofed website is typically made to look like a well known, branded site (like ebay.com or citibank.com) with a slightly different or confusing URL. The attacker then tries to trick people into going to the spoofed site by sending out fake email messages or posting links in public places - hoping that some percentage of users won't notice the incorrect URL and give away important information. This practice is sometimes known as “phishing".

SpoofStick makes it easier to spot a spoofed website by prominently displaying only the most relevant domain information. It's not a comprehensive solution, but it's a good start."

Now when I opened both this link and the one that BB posted earlier my SpoofStick said that I am on the page I am supposed to be. Now is SS correct or is it reporting incorrectly? Is this just a false sense of security that I have been falling prey to?

**Big Booger** · February 5th, 2005, 02:09 AM

It's odd.. now that I have had a second chance at looking it over rik, I'm not sure either way...

That page that I posted looked fake.. and real at the same time. Then when I went back to double check, I think it might be real... but I am not too sure.

I'd trust spoofstick and say that it is correct and that maybe we are not.. but I dunno.

The link click3 that I posted seems legit. But it is a redirect and that is rather odd....

**rik** · February 5th, 2005, 02:23 AM

Agreed. Either it is real or the "Phishers" are getting very good. I really recommend you try SpoofStick, both for IE and FireFox.

It can be downloaded here: http://www.corestreet.com/spoofstick/