[Dshield] Anyone seen this obviously baited hook?

Brance Amussen :)_S brance at jhu.edu
Tue Jun 7 15:03:44 GMT 2005


(don't they make nearly invisible monofilament these days??)

Hi All, 

Got this (below) in my mailbox this morning.. Anyone else come across one of
these? Ball-sy I'd say, the link to "phishost" isn't even, remotely
obscured.. But then with the promise of free stuff, it wouldn't surprise me
if a whole lot of people let the consumer-devil in them pop up on a shoulder
and whisper repeatedly, "it's free stuff, free stuff, come on, it's FREE!!"
drowning out the computer security-angel on the other shoulder..  

Anyhow, a check on the surii.com domain shows up as belonging to a
georgewhite.net, and has a billing contact of mediadreamland.com.
Georgewhite.net seems to be the main register, mediadreamland, is an expired
and available domain.. Http requests to both phishost.surii.com, and
georgewhite.net, both return "No suitable nodes are available to service
your request" (this was done using firefox, not about to try IE). A quick
netcat hit shows it is up and running, and a GET /index.html (within NC)
returns the same error.. Hmm.. 
Perhaps it has been taken out of phishing service?? Was it ever recruited
into the phishing service?? 
Any thoughts?? (the full html version of the email is available on request)
If it is a soldier in the phishing forces, It would be nice to take it out..

But then maybe I am just paranoid of the obvious, and it is completely
legit.. But it don't smell like it..

Brance :)_S
 


-----------------------------------------------------------
$300 Visa Gift Card Order Confirmation #3658-VACC6735
To: Member #4031
-----------------------------------------------------------

To receive your gift, please click on or cut and paste:

http://phishost.surii.com/unip

We have been trying to reach you in order to deliver your free $300 Visa
Gift Card .

Please verify your shipping address and zipcode.

Consumer Incentive Promotions has given you this $300 Visa Gift Card for
just following instructions on our website.

Please visit our website:

http://phishost.surii.com/unip

Thank you and ENJOY!

Sincerely,

Mary Henderson
Customer Service Rep.
Your Smart Rewards



This promotion is sponsored exclusively by Your Smart Rewards and is subject
to participation terms and conditions. Receipt of the membership incentive
gift requires completion of offer terms, including: age and residency
requirements, registration with a valid email address, completion of user
survey, sponsor promotions and shipping address verification. Upon
completion of all requirements, we will promptly ship your membership
incentive gift to your verified shipping address. You may review the status
of your account via the member account area at anytime. Participation
eligibility is restricted to US residents 18 and over. The trademark owners
above have not endorsed this promotion, nor are they affiliated or connected
with this promotion in any way. This is a limited time promotion and may
expire in the near future. Restrictions may apply. If you no longer wish to
receive Your Smart Rewards emails, visit the unsubscribe page on the Your
Smart Rewards site, or you can write us at: Your Smart Rewards, 4846 N.
University Drive #323, Lauderhill, FL 33351, USA. 

To unsubscribe, go to:
http://phishost.surii.com/unip/tr.cgi?m=oht0567sk&x=h77667mmu&k=u3686aiy&x=g
tx456f6sgz&up=sd7a33z&xu=ry6a697agn&r=zsow





More information about the list mailing list