jingfrey.tumblr.com

Wednesday, July 04, 2007

Virus in mail masquerading as e-card

Since this week started, or maybe even as early as last week, I've received messages at my office e-mail address telling me a family member or a friend has sent me an e-card. Based on the structure of the letter, I ignored them. Now I got one in my lycos account as well, so I finally got curious. This is what the message contained:

Good day.

Your family member has sent you an ecard from VintagePostcards.Com.

Send free ecards from VintagePostcards.Com with your choice of colors, words and music.

Your ecard will be available with us for the next 30 days. If you wish to keep the ecard longer, you may save it on your computer or take a print.

To view your ecard, choose from any of the following options:

--------
OPTION 1
--------

Click on the following Internet address or copy & paste it into your browser's address box.

http://12.182.46.11/?c46dc539e3b14a79bb24c4d2c855844a4912b62

--------
OPTION 2
--------

Copy & paste the ecard number in the "View Your Card" box at http://12.182.46.11/

Your ecard number is c46dc539e3b14a79bb24c4d2c855844a4912b62

Best wishes,
Postmaster,
VintagePostcards.Com


Why I think this is SPAM:
  1. The e-mail is supposedly from VintagePostcards.Com but the address attached to the mail is fgta@67.hrcoxmail.com. Real e-card notices either show the domain name of the e-card site OR the e-mail of the card sender on the "From" field, but not together. Which means that if the name used is VintagePostcards.Com, the e-mail should also be vintagepostcards.com. I don't know anyone with an hrcoxmail.com address so that makes this letter suspicious.
  2. The message never tells me who the ecard is from. Every decent website that offers electronic greeting card services will tell the recipient who sent the e-card.
  3. The link within the message uses a dotted decimal IP address. If I created this template for Vintage Postcards, wouldn't I simply use the VintagePostcards.Com url? The inconsistency within the letter is another warning that the ip address might be different from www.vintagepostcards.com


Instead of clicking the IP address, I used a search engine to check if there are articles on the web warning the public about vintagepostcards.com. I learned that clicking that link will bring me to a malicisiou site and infect my computer with trojan/virus.

Typing www.vintagepostcards.com on the address bar brought me to the real Vintage Postcards site. It is a legitimate company selling postcards but they do not have an e-card service. Searching the web further, I find out that there are many versions to this scam. Many pretend to be from legitimage websites, but the "link to the e-card" uses a different url or a dotted decimal IP address other than that of the legitimate address. VintagePostcards.com is a little known site, some versions of the mail however use the name of known sites like freewebs.com or greeting-cards.com.

Reminds me of the love bug virus, which fooled people into thinking the mail came from someone they know.

1 comment:

Heart of Rachel said...

Good thing I was absent from work when that Love Bug virus broke out. Many of my colleagues were fooled, even our MIS. Imagine that!

My Other Blogs

Followers

Awards Received by this Blog

From Rachel, given July 23, 2007:

From Rachel, given February 21, 2008:

Rachel's blogs

Sam's Blogs

More Blogs