WebApp Sec mailing list archives

Re: Smells like a phish, is a fish?


From: Mat Farrington <mat () holon net>
Date: Thu, 27 Oct 2005 18:05:33 +1000

It's indeed that time.  Real phish, phlat out:

"Please take a moment to review your WHOIS information associated with each of the domain names you currently have registered with us. If your WHOIS information has changed or is...."

http://info1.networksolutions.com/h/XXXX/XXXX/NN/XXXX?a1=KFPE57&a2=aaa () yyy com

redirecting to

http://netsol.ed4.net/whois/retail.cfm?c=XXXXXX&e=aaa () yyy com

Andrew van der Stock wrote:
I have my domains registered with a popular registrar, and they've sent the most phishy e-mail I've ever seen from a major provider:

---

Dear Andrew van der Stock,

It's that time of year again. ICANN (the Internet Corporation for Assigned Names and Numbers) annually requires that all accredited registrars (like Go Daddy(R)) ask their domain administrators/ registrants to review domain name contact data, and make any changes necessary to ensure accuracy.

To review/update your contact data, simply:
     + Go to www.godaddy.com/?isc=ICANNKEY
+ Click on the "ICANN Domain Confirmation" icon at the top of the page + You will be taken to a landing page and asked to enter your Domain Information Key: <removed>
     + Enter your key and click "Go."

(more phish deleted)
---

I confirmed with the registrar that indeed they did send this phishy e-mail. How do we get through to large organizations - who really should know better - that they most of all shouldn't smell like a phish market?

thanks,
Andrew





--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.361 / Virus Database: 267.12.5/149 - Release Date: 25/10/2005


Current thread: