Facebook Scam Email WOT SAVED me from

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Facebook Scam Email WOT SAVED me from Nov 15, 2010 14:14:47 GMT -5

Quote

Post by kas on Nov 15, 2010 14:14:47 GMT -5

I am so glad that I have WOT installed!!!

www.mywot.com/

For Firefox:
addons.mozilla.org/en-US/firefox/addon/3456/

WOT saved me from believing an email I got telling me to log into my Facebook account! It looks legit and all and by default most browsers do NOT have the status bar visible. I always do because I like to mouse over links before I click to them.

Actually this one doesn't being you to a fake facebook page like I thought it would! It brings you to an illegal pharma site! Why would anyone trust that being brought there under false pretenses??

Domain status of that pharma site: LOCKED

This kind .. looking at the code .. seems it could fool spam filters in email as at first it looks legit even in code .. except for a few things like the return address and the landmarkinternet.ca (10.18.255.176:35072) and customprintedchristmascards.org (206.130.116.64) and the dangerous part .. the phishing attempt .. if you allow HTML .. will bring you to dietpharmacyrx.net instead of Facebook!

Delivered-To: 
Received: by 10.227.135.144 with SMTP id n16cs236680wbt;
        Tue, 2 Nov 2010 08:35:10 -0700 (PDT)
Received: by 10.227.72.196 with SMTP id n4mr17119619wbj.153.1288712110062;
        Tue, 02 Nov 2010 08:35:10 -0700 (PDT)
Return-Path: <info@landmarkinternet.ca>
Received: from customprintedchristmascards.org (customprintedchristmascards.org [206.130.116.64])
        by mx.google.com with SMTP id c36si11767971wbc.4.2010.11.02.08.35.08;
        Tue, 02 Nov 2010 08:35:10 -0700 (PDT)
Received-SPF: fail (google.com: domain of info@landmarkinternet.ca does not designate 206.130.116.64 as permitted sender) client-ip=206.130.116.64;
Authentication-Results: mx.google.com; spf=hardfail (google.com: domain of info@landmarkinternet.ca does not designate 206.130.116.64 as permitted sender) smtp.mail=info@landmarkinternet.ca
Received: from [10.18.255.176] ([10.18.255.176:35072])
        by mta013.snc1.facebook.com (envelope-from <update+klmysmpzurym@facebookmail.com>)
        (ecelerity 2.2.2.45 r(34067)) with ECSTREAM
        id 7C/6D-15360-48AC750A; Tue, 2 Nov 2010 09:35:09 -0700
X-Facebook: from zuckmail ([MTI3LjAuMC4x]) 
        by www.facebook.com with HTTP (ZuckMail);
Date: Tue, 2 Nov 2010 09:35:09 -0700
To: <>
From: Facebook <update+klmysmpzurym@facebookmail.com>
Reply-to: Facebook <update+klmysmpzurym@facebookmail.com>
Subject: You have notifications pending
Message-ID: <63b4ef5be28f7feb40474567ad556c0e@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
X-Facebook-Camp: stale_email
X-Facebook-Notify: stale_email; mailid=b1ca276ddb041463b23bd44426d73f
Errors-To: update+klmysmpzurym@facebookmail.com
X-FACEBOOK-PRIORITY: 1
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="b1_63b4ef5be28f7feb40474567ad556c0e"

--b1_63b4ef5be28f7feb40474567ad556c0e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
To login to Facebook, follow the link below:
http://www.facebook.com/n/?find-friends%2F&mid=3Db1ca276ddb041463b23bd444=
26d73f&bcode=3DaxL6N&n_m=3D**********%40gmail.com
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Hi,

You haven't been back to Facebook recently. You have received notificatio=
ns while you were gone.

You have the following notifications:
1 messages

Thanks,
The Facebook Team

To login to Facebook, follow the link below:
http://www.facebook.com/n/?find-friends%2F&mid=3Db1ca276ddb041463b23bd444=
26d73f&bcode=3DaxL6N&n_m=3D**********%40gmail.com

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This message was intended for . If you do not wish t=
o receive this type of email from Facebook in the future, please follow t=
he link below to unsubscribe.
http://www.facebook.com/o.php?k=3D204866&u=3D100001868348548&mid=3Db1ca27=
6ddb041463b23bd44426d73f
Facebook, Inc. P.O. Box 10005, Palo Alto, CA 94303


--b1_63b4ef5be28f7feb40474567ad556c0e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional //EN">
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; chars=
et=3Dutf-8"><title>Facebook</title></head><body style=3D"margin: 0; paddi=
ng: 0;" dir=3D"ltr"><table width=3D"98%" border=3D"0" cellspacing=3D"0" c=
ellpadding=3D"40"><tr><td bgcolor=3D"#f7f7f7" width=3D"100%" style=3D"fon=
t-family: 'lucida grande', tahoma, verdana, arial, sans-serif;"><table ce=
llpadding=3D"0" cellspacing=3D"0" border=3D"0" width=3D"620"><tr><td styl=
e=3D"background: #3b5998; color: #fff; font-weight: bold; font-family: 'l=
ucida grande', tahoma, verdana, arial, sans-serif; padding: 4px 8px; vert=
ical-align: middle; font-size: 16px; letter-spacing: -0.03em; text-align:=
 left;">facebook</td><td style=3D"background: #3b5998; color: #fff; font-=
weight: bold; font-family: 'lucida grande', tahoma, verdana, arial, sans-=
serif; padding: 4px 8px; vertical-align: middle;font-size: 12px; text-ali=
gn: right;"></td></tr><tr><td colspan=3D"2" style=3D"background-color: #f=
ff; border-bottom: 1px solid #3b5998; border-left: 1px solid #ccc; border=
-right:
1px solid #ccc;font-family: 'lucida grande', tahoma, verdana, arial, sans=
-serif; padding: 15px;" valign=3D"top"><table width=3D"100%"><tr><td widt=
h=3D"470px" style=3D"font-size: 12px;" valign=3D"top" align=3D"left"><div=
 style=3D"margin-bottom: 15px; font-size: 13px;">Hi,</div><div style=3D"m=
argin-bottom: 15px;">You haven't been back to Facebook recently. You have=
 received notifications while you were gone.</div><div style=3D"margin-bo=
ttom: 15px;"><div style=3D"border-bottom: 1px solid #ccc; line-height:5px=
;"> </div><table style=3D"color: #3B5998;padding-top:5px;"><tr><td s=
tyle=3D"font-size: 12px;"><img src=3D"http://static.ak.fbcdn.net/rsrc.php=
/z2ENL/hash/cl3tql6g.gif" alt=3D"" style=3D"border: 0; " /></td><td width=
=3D"2px;"></td><td style=3D"font-size: 12px;"><a href=3D"http://dietpharm=
acyrx.net"><b>1</b> messages</a></td><td width=3D"2px;"></td></table><div=
 style=3D"border-bottom: 1px solid
#ccc; line-height:5px;"> </div></div><div style=3D"margin-bottom: 15=
px; margin: 0;">Thanks,<br />
The Facebook Team</div></td><td valign=3D"top" width=3D"150" style=3D"pad=
ding-left: 15px;" align=3D"left"><table cellspacing=3D"0" cellpadding=3D"=
0" style=3D"border-collapse:collapse;"><tr><td style=3D"padding:10px;back=
ground-color:#fff9d7;border-left:1px solid #e2c822;border-right:1px solid=
 #e2c822;border-top:1px solid #e2c822;border-bottom:1px solid #e2c822;"><=
div style=3D"margin-bottom: 15px; font-size: 12px;">Sign in to Facebook a=
nd start connecting</div><table cellspacing=3D"0" cellpadding=3D"0" style=
=3D"border-collapse:collapse;"><tr><td style=3D"border-width: 1px; border=
-style: solid; border-color: #3b6e22 #3b6e22 #2c5115; background-color: #=
69a74e;"><table cellspacing=3D"0" cellpadding=3D"0" style=3D"border-colla=
pse:collapse;"><tr><td style=3D"padding: 4px 10px 5px; border-top: 1px so=
lid #95bf82;"><a href=3D"http://dietpharmacyrx.net"
style=3D"color:#fff;text-decoration:none;font-weight:bold;font-size:13px;=
">Sign In</a></td></tr></table></td></tr></table></td></tr></table></td><=
/tr></table><table cellspacing=3D"0" cellpadding=3D"0" style=3D"border-co=
llapse:collapse;margin-top:20px;"><tr><td style=3D"padding:10px;backgroun=
d-color:#fff9d7;border-left:1px solid #e2c822;border-right:1px solid #e2c=
822;border-top:1px solid #e2c822;border-bottom:1px solid #e2c822;"><div s=
tyle=3D"font-weight: bold; margin-bottom: 2px; font-size: 11px;">To login=
 to Facebook, follow the link below:</div><a href=3D"http://dietpharmacyr=
x.net" style=3D"color:#3b5998;text-decoration:none;font-size:11px;">http:=
//www.facebook.com/n/?find-friends%2F&mid=3Db1ca276ddb041463b23bd4442=
6d73f&bcode=3DaxL6N&n_m=3D**********%40gmail.com</a></td></tr></=
table><img
src=3D"http://www.facebook.com/email_open_log_pic.php?k=3Dklmysmpzurym&am=
p;t=3D2&mid=3Db1ca276ddb041463b23bd44426d73f" alt=3D"" style=3D"borde=
r: 0; height:1px; width:1px; " /></td></tr><tr><td colspan=3D"2" style=3D=
"color: #999; padding: 10px; font-size: 11px; font-family: 'lucida grande=
', tahoma, verdana, arial, sans-serif;">This message was intended for ***=
*******@gmail.com. If you do not wish to receive this type of email from=
 Facebook in the future, please click <a href=3D"http://dietpharmacyrx.ne=
t" style=3D"color: #3b5998">here</a> to unsubscribe.<br/>Facebook, Inc. P=
.O. Box 10005, Palo Alto, CA 94303</td></tr></table></td></tr></table></b=
ody></html>



--b1_63b4ef5be28f7feb40474567ad556c0e--

Attachments:

Last Edit: Nov 15, 2010 14:46:20 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Facebook Scam Email WOT SAVED me from Nov 15, 2010 14:29:13 GMT -5

Quote

Post by kas on Nov 15, 2010 14:29:13 GMT -5

More on this online:

ksforum.inboxrevenge.com/viewtopic.php?f=1&t=2521&start=30

groups.google.com/group/news.admin.net-abuse.sightings/browse_thread/thread/0e9f3757df1bbafa?pli=1

www.mail-archive.com/ietf-dkim@mipassoc.org/msg12204.html

Last Edit: Nov 15, 2010 14:45:13 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Facebook Scam Email WOT SAVED me from Dec 14, 2010 13:14:59 GMT -5

Quote

Post by kas on Dec 14, 2010 13:14:59 GMT -5

Another one I got but this one at least ended up in the spam filter and gmail caught on to this one and warned me about it not being from who it says it is from. The source code verified that.. Wonder how these scammers can make emails say their are from facebook and return email is facebook .. when they are NOT?

Attachments:

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.