« Monday Night Clippings 12-5 | Main | Wednesday is Pulse Day »
December 06, 2005
Disguising the Hook Might Help
I just got another phishing e-mail -- well, there were two of them.
They had the same sender and subject, and were adjacent in my Inbox. I opened the first one, because I'm always curious about the graphics people choose, the spelling mistakes they make, and so on, in these poor attempts to gather my non-public personal information. The graphic for First Tennessee Bank was okay, but the e-mail was pretty lame. The first option they listed was a link where I could just give them my ATM/VISA check card number and PIN. Ha ha. Oh, the problem, this e-mail said, is that my account has been locked due to incorrect logins.
The second e-mail is where this starts to get a little bit interesting, and I'm going to ask you readers for input on what some of it might mean. The raw HTML came through as plain text. Oh, goody. I can see hrefs and so on. There is one that looks like this: [a href="http://www.shlong.at/red/.www.firsttennessee.com/"] https://banking.firsttennessee.biz/servlet/ftb/index.html[/a] (I replaced the open and close indicators with brackets so that you could see it.)
So tricky, these guys. Use an authentic URL as the text of a hyperlink when the link itself points to another server entirely. Do they expect to catch many with this?
But the real question I have for you is: what does an Austrian band named "Shlong" have to do with this phishing attempt? Anything? Nothing? Is there a double-theft going on with these things, where not only the phishing target is tricked, but an unsuspecting site may play host to the faux links? Or does someone need to tell Interpol about these Shlong fellows?
Miscellaneous | By joe lance | 11:45 PM