***Urgent Fraud Prevention Group Notice***
You have received this email because we have strong reason to believe that your Amazon account had been recently compromised. In order to prevent any fraudulent activity from occurring we are required to open an investigation into this matter. To speed up this process, you are required to verify your Amazon account by following the link below.
The above is the start of another phishing scam trying to get my Amazon account information. Here is the email snapshot:
[click to enlarge]I'm told to visit the following link:
http://www.amazon.com/exec/obidos/flex-sign-in/
Yet when I mouse hover it, I see this in the status:
http://www.vereine-noe.at/mambo/images/amazon/index.html
So I check out that page and this is whats displayed:
[click to enlarge]
This page actually brings up a frameset which points to:
http://www.vereine-noe.at/mambo/images/amazon/index.php?MfcISAPICommand=SignInFPP&UsingSSL=1&email=&userid=
But careful, if you enter your information and click the Continue button you are not sending the information to amazon, you are sending it to here:
http://www.vereine-noe.at/mambo/images/amazon/index.php?MfcISAPICommand=VerifyFPP&UsingSSL=1&login=&pass=
Bingo, someone now has your data for Amazon on a phishing site. The domain vereine-noe.at is registered by:
domain: vereine-noe.at
registrant: SF1536198-NICAT
admin-c: WM1542233-NICAT
tech-c: WM1542233-NICAT
zone-c: WM1542233-NICAT
nserver: ns1.max4eu.net
remarks: 80.64.128.10
nserver: ns2.max4eu.net
remarks: 80.64.129.10
nserver: ns3.max4eu.net
remarks: 80.64.128.100
nserver: ns4.max4eu.net
remarks: 80.64.129.100
changed: 20040510 10:23:15
source: AT-DOM
personname: Walter Kirchler
organization: Service Freiwillige
street address: Hofgarten 3/4
postal code: A-2801
city: Katzelsdorf
country: Austria
phone: +43262278467
fax-no: +432622784674
e-mail: service@vereine-noe.at
nic-hdl: SF1536198-NICAT
changed: 20040323 10:03:14
source: AT-DOM
personname: Werner Muss
organization:
street address: Burgholzstrasse 9
street address: A-3352 St. Peter / Au
street address: Austria
postal code:
city:
country:
phone: +43 676 3078533
fax-no: +43 1 212 127 222
e-mail: wmuss@freasy.com
nic-hdl: WM1542233-NICAT
changed: 20040603 11:23:07
source: AT-DOM
So don't be fooled by messages like this. Amazon won't be sending these kinds of emails to you. Instead, report these immediately. Get them shut down.
This particular phishing scam's email header portion:
Return-Path: <IUSR_websrv05@websrv05.globalpoint.ch>
Received: from websrv05.globalpoint.ch (websrv05.globalpoint.ch [212.60.53.31])
by bugsbunny.castlecops.com (8.13.4/8.13.4) with ESMTP id jBVCpE6t015154
for <zx@castlecops.com>; Sat, 31 Dec 2005 07:51:14 -0500
Received: by websrv05.globalpoint.ch (Postfix, from userid 500)
id 39C8E1B5EF; Sat, 31 Dec 2005 13:51:19 +0100 (CET)
