New Phish?

[Chris Santerre <cs...@MerchantsOverseas.com>]

I don't get it? Phish for Postcard.org, is the "donation" the phishers
intent?

I HAVE NOT VIEWED THE PAGE. I don't allow 'odd' http port viewing here. I
only munged the unsubscribe address. 
___________________________________________________________________

You have just received a virtual postcard from Aunt Edna!<p>

You can pick up your postcard at the following web address:<br>
<a
href="http://24.74.30.29:8180/009/">http://www.postcards.org/?35-dodge-tread
s-aunt</a><p>

If you can't click on the web address above, you can also<br>
visit 1001 Postcards at <a
href="http://24.74.30.29:8180/009/">http://www.postcards.org/postcards/</a><
br>
and enter your pickup code, which is: 35-dodge-treads-aunt<p>

(Your postcard will be available for 60 days.)<p>

We hope you enjoy your postcard, and if you do,<br>
please take a moment to send a few yourself!<p>

Regards,<br>
1001 Postcards<br>
<a
href="http://24.74.30.29:8180/009/">http://www.postcards.org/postcards/</a><
p>

P.S. If you're happy with our service, let us know by<br>
making a donation to help us pay our server hosting costs!<br>
Please visit our donation page at Amazon.com!<br>
<a
href="http://24.74.30.29:8180/009/">http://www.amazon.com/paypage/PHVNBUIYDI
UYD98QH</a><p>

------------------------------------------------<br>
Introducing the 1001 Postcards weekly newsletter!<br>
Click here to subscribe for free to 'Greetings from Marty & Alice':<br>
<a
href="http://24.74.30.29:8180/009/">http://browse.postcards.org/go/postcards
/newsletter?action=subscribe&email=snagglebrst@mmungedsoverseas.com</a><br>
------------------------------------------------<br>
sender-ip: 79.38.77.74

___________________________________________________________________

I did NOT put that sender-IP line in there, it was in the code. It came from
60.176.251.158

--Chris

Re: New Phish?

[Jeff Chan <je...@surbl.org>]

On Wednesday, January 26, 2005, 1:56:33 PM, Chris Santerre wrote:
> I don't get it? Phish for Postcard.org, is the "donation" the phishers
> intent?

> I HAVE NOT VIEWED THE PAGE. I don't allow 'odd' http port viewing here. I
> only munged the unsubscribe address. 
> ___________________________________________________________________

> You have just received a virtual postcard from Aunt Edna!<p>

> You can pick up your postcard at the following web address:<br>
> <a
> href="http://24.74.30.29:8180/009/">http://www.postcards.org/?35-dodge-tread
> s-aunt</a><p>

Looks like they're trying to get victims to go to their hijacked
computer at 24.74.30.29:8180 .  I doubt it has anything to do
with postcards.org.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/

Re: New Phish?

[Loren Wilton <lw...@earthlink.net>]

At a guess, new spam.  Since these postcard sites let the postcards be
customized with plain text and sometimes HTML, someone can write a robot to
plug their message into a postcard and send it to everyone on their spam
list.

        Loren

Re: New Phish?

[Dan Hollis <go...@anime.net>]

On Wed, 26 Jan 2005, jdow wrote:
> > 60.176.251.158
> China - send the ISP a nice note thanking them for their order for
> 100,000 Feng Shui manuals that will take some time to process because
> of the size of the order.

Here's a better one:

Dear fellow freedom-fighter:

Your message has been received and decoded. As per your request,
$2,000,000 has been transferred to your "Free Tibet Now!/Falun
Gong/Free and Democratic China" account. The weapons and
explosives shipments will be sent to the usual location. Please
ensure that the Chinese authorities do not find out about this
transaction, as I have heard that the Chinese government is still
monitoring email in your country.

Regarding the Falun Gong section of your communication, I take to
heart the points you made and appreciate you informing me about
this culture which is so heavily oppressed in your country. Your
refrences to the two web pages below are great! The second page
really emphasises how important your beliefs are and you should
take care not to be discovered by the authorities and imprisoned!

http://dir.yahoo.com/Society_and_Culture/Religion_and_Spirituality/
Faiths_and_Practices/Meditation/Falun_Gong/

http://www.cesnur.org/testi/falun_updates.htm

By the way, your idea of encrypting the messages from our friends
inside to look like "spam" is brilliant. The Red Army monitors
are far too stupid to figure out what you are doing. Keep up the
great work, fellow freedom fighter!

Also, thank you for allowing this spam/encoded communication to
be passed through your open mail server at IP address [60.176.251.158].
This is very brave of you, my friend, and is very
helpful to the cause of ending human rights abuses in China and
ending Chinese occupation of Tibet and oppression of the Falun Gong
cult.

Now that it is no longer needed, please see http://www.mail-
abuse.org/tsi/ or http://www.orbs.org/otherresources.html for
information on securing your mail server.

Thank you again for your valiant efforts to bring democracy and
human rights to the repressive communist dictatorship of Red
China.

Free Tibet! Democracy Now!

-Dan

Re: New Phish?

[jdow <jd...@earthlink.net>]

From: "Chris Santerre" <cs...@MerchantsOverseas.com>
> <a
>
href="http://24.74.30.29:8180/009/">http://www.postcards.org/?35-dodge-tread
> s-aunt</a><p>

Carolina RR connection.

> sender-ip: 79.38.77.74

IANA reserved block. (DNS test spoiler?)

> 60.176.251.158

China - send the ISP a nice note thanking them for their order for
100,000 Feng Shui manuals that will take some time to process because
of the size of the order.

I bet the poor suckers who visit the site get a nice reward for their
efforts as their Windows machine dissolves into the night due to the
downloaded malware.

{^_^}

Re: New Phish?

[Kelson <ke...@speed.net>]

Chris Santerre wrote:
> I don't get it? Phish for Postcard.org, is the "donation" the phishers
> intent?
> 
> I HAVE NOT VIEWED THE PAGE. I don't allow 'odd' http port viewing here. I
> only munged the unsubscribe address. 
> ___________________________________________________________________
> 
> You have just received a virtual postcard from Aunt Edna!<p>

Not a standard phish so much as a virus (using the term loosely -- 
trojan is probably more accurate).  It's just that the malware is spread 
by visiting the website rather than loading an attachment.  They don't 
care whether you fill out any forms, since once you're infected with 
spyware and downloaders they can grab whatever they want.

I don't think I still have it, but about a month ago one of these came 
in to MAILER-DAEMON.  Something about the idea that MAILER_DAEMON had an 
Aunt Edna just struck me as funny.

-- 
Kelson Vibber
SpeedGate Communications <www.speed.net>