B.I.S.S. Forums > Phishing e-mail

B.I.S.S. Forums > Malware Research Forum > Malware IP Research Section

craig

May 7 2006, 10:50 AM

So, I got a phishing e-mail today - nothing unusual there ...

CODE

Date: Sun, 07 May 2006 06:43:09 -0400
From: South Trust Bank <pw-conf@southtrust.com>
Message-ID: <2604857818.20060507064309@southtrust.com>
To: <<my email>>

What I found new to me is when I looked at the html of the email for the "click here" bit, I found:

CODE

Please
confirm your
identity
here:
<a href="rnddomains.txt">Restore My
Online
Banking
Account</a>
and complete
the "Steps
to Remove
Limitations."

I didn't click, but what is the href pointing at? There was no attachment? How does this work? I'm just curious ...

Aaron.Walkhouse

May 7 2006, 11:25 AM

Copy the whole message and paste it. There was probably a script in there to generate
the URL or decode it because it was hidden from view to avoid spam filters.

If it still resists analysis export the message in whatever mode your program uses to
preserve all of it's structure and PM me for my email address.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.