Example of a “Phishing,” and Web Site ECE Communications Network Security Prof. John A. Copeland Georgia Tech

"

Your phony password does not work. Clicking “Forgot Your Password” takes you here, a real Yahoo Web page. If your password did work, you would have been logged in to the real Yahoo Web site (and “they” would have your username and password).

Return-Path: Received: from mail.ee.gatech.edu (mail.ee.gatech.edu [ ]) by imap.ece.gatech.edu (Cyrus v2.3.13) with LMTPA; Thu, 08 Jan :50: X-Sieve: CMU Sieve 2.3 Received: from karmalarm1.cniweb.net (karmalarm1.cniweb.net [ ]) by mail.ee.gatech.edu (8.14.0/8.13.7) with ESMTP id n08FoZcJ for ; Thu, 8 Jan :50: (EST) Received: from localhost.localdomain ([ ]) (authenticated bits=0) by karmalarm1.cniweb.net (8.13.7/8.13.7) with ESMTP id n08Fm1ss for ; Thu, 8 Jan :48: (EST) Date: Thu, 8 Jan :48: (EST) Message-Id: From: "YAHOO MARKETING SOLUTIONS" To: Subject: SERVICES EXPIRED Content-type: text/html; charset=us-ascii Look at “source code” of HTML - headers Sender info - IP address Sender mail server - IP address

~ copeland$ nslookup (original server) Non-authoritative answer: in-addr.arpname = karmalarm1.cniweb.net. Authoritative answers can be found from: in-addr.arpanameserver = ns1.cniweb.net. ns1.cniweb.netinternet address = ~ copeland$ whois cniweb.net Creative Network Innovations 6905 N. Wickham Road Melbourne, FL US Administrative Contact, Technical Contact: Creative Network Innovations, Inc N WICKHAM RD MELBOURNE, FL US fax: To install whois on a PC:

On what network was the sending host (probably a “bot” compromised PC)? ~ copeland$ host mail.irv2.com. ~ copeland$ whois irv2.com ( ISP of sending host) Registrant: Social Knowledge, LLC 3523 McKinney Ave #419 Dallas, Texas United States

<img border="0" src= " > Dear Client, Your Yahoo Marketing Solutions account has expired. You must renew it immediately or your account will be closed. If you intend to use this service in the future, you must take action at once! To continue <a href= " click here, login to your Yahoo Marketing Solutions account and follow the steps. Thank you for using Yahoo Marketing Solutions! Yahoo Marketing Solutions Services Department. Look at links in the text (“click here”) Image Source Link, when clickedWeb page

~ copeland$ whois chesterfieldsofuk.com DOMAIN: CHESTERFIELDSOFUK.COM RSP: CdWDesign URL: owner-contact: O-HOU71 owner-organization: House of England owner-street: Gildeweg 30 owner-city: Nootdorp owner-zip: 2632 BA owner-country: NL owner- This phishing Web site is registered in the Netherlands, but duplicates could be distributed over a botnet if a “fast fluxing” DNS server is used. Look up URL of Phishing server

From: To: Subject: Support Mccane on our site Date: Thu, 8 Jan :55: When you are aged and never give up, it gives your he confidence, at any chance, at any place,. Visit. Expanded When you are aged and never give up, it gives your he confidence, at any chance, at any place,. Visit. from Russia with (no) love. Simple “click me”