It is amazing to me how many malicious emails one can get!
Just today, I got one that purported to be from CNBC, however, the link was not any of the CNBC franchise websites. So I thought, well, maybe I missed one?
I searched Google for the root domain name in email link and it tried to give me real life news channel results which were of course all legitimate websites, not the dangerous one that was in the email.
However, it did give the ability to search on the exact domain again if I really meant it, which of course I did. The only links available — which I was very happy to see — for that domain name were several links to malwareURL.com – (The MalwareURL Team is a group of Internet security experts dedicated to fighting malware, Trojans and a multitude of other web-related threats) that exposed the website in the email as a malware site for a work at home scam:
This web site is a known security risk – Detailed web site security report
Security Category: Work-At-Home scam
The results on the link above about the website stated the following:
Domain matching reallivenewschannel.com were found in our database.
1348 other active domains were found on 707 IP(s) for AS30058 (FDCSERVERS)
Show the report for AS30058 (FDCSERVERS)
Malicious URLs on reallivenewschannel.com
/weeknews/lastnews.php
/weeknews/go.php
Blacklist
Google
Google Diagnostic Page
My WOT
WOT Score Card
hpHosts
hpHosts listing
MalwareDomainList
MDL listing
After the above information, there was information specific to the domain.
Interestingly, the domain appears to be registered in NY, USA.
The name servers are in .RU/Ukranian domain origins.
In addition, this malware link in the email had a prefix that looked like the following, except I changed the numbers in the link:
cf533cb444.reallivenewschannel.com
NOTE: Notice the above is not a live link as we don’t want to visit under any circumstances, unless you are a security researcher preferably using a throwaway Virtual Machine or live CD.
If I had looked at this email in full HTML as it was intended by the malware purveyors, it would have looked somewhat like the following in simple HTML except it would likely have had the look of a CNBC website rather than just the text as it does in simple HTML:
A CNBC Event – Work At Home Mom Makes Almost $10,000/Month, Part-Time
Patricia Feeney of , never thought she’d have a job working at home until she filled out a simple form online, one afternoon. Before she knew it, she had discovered her secret to beating the recession and no longer had worries about being able to provide for her family – and she did all of this by working from home. » Continue reading
CNBC
To unsubscribe to this email click here. If this e-mail was forwarded to you and you’d like to sign up for additional alerts from CNBC click here.
© 2012 CNBC, Inc. All Rights Reserved. 900 Sylvan Avenue, Englewood Cliffs, NJ 07632
See where the Continue reading is? That was the link, totally obfuscated from view to trick users into thinking it was a CNBC link when actually it was linked to the full malware URL I have been discussing in this posting.
Pretty convincing isn’t it? Looks like a legitimate email from CNBC.
If you looked at the email source, you would also have seen that the real Return path is not CNBC, but a user from a .pl domain.
Thankfully, SpamAssassin did give it a 6.5 Spam Status level (required was 5 so it was 1.5 beyond the level required to be considered Spam. X-Spam-Report says the following:
X-Spam-Report:
* 2.3 FROM_STARTS_WITH_NUMS From: starts with many numbers
* 1.8 URI_HEX URI: URI hostname has long hexadecimal sequence
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 2.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
Sadly, many emails that look like they originate from legitimate sites come in every day and people are often fooled by them. Many times just because they look at emails in HTML.
These types of things would fall by the wayside if everyone was more wary and understood that when they send out millions of emails like this likely every day or every week, it only takes 1.5% of the people to respond to make it well worth while to the spam, malware, phishing, spear phishing, or scam (or any combination together) purveyors.
Also check out the Anti-Phishing Workgroup website for more information.
There are many of us who have been using email clients that allow you to view emails as Plain Text such as; Thunderbird (opensource – free – accepts donations), Postbox ($9.95 – based on Thunderbird and by original Thunderbird developers), Pegasus (free but proprietary – accepts donations), and there are many others that allow plain text. Most Linux based email clients give this ability as well.
Oddly, however, although Apple Mail granularly allows you to choose (after already choosing the email message) to read in plain text on an email by email basis — Apple Mail DOES NOT have an option in Preferences that allows you to choose to view emails as Plain Text by default which would prevent many problems with these dangerous types of emails. This is very sad news for Apple users. Microsoft Outlook DOES NOT give users the ability to view emails in Plain Text either (on an email by email or by option in preferences). I would very much like to know why Microsoft and Apple do not give that option to people. These are the two most ubiquitous email clients used in OS X and Windows.
I have read emails in plain text from the very beginning. Intentionally. Simply because I don’t want to be accidentally fooled by this type of spam, malware, phishing, spear phishing, or scam.
Email clients like Thunderbird (opensource – free – accepts donations), Postbox ($9.95 based on Thunderbird and by original Thunderbird developers), Pegasus (free but proprietary – accepts donations) give the ability to view in original HTML, simple (non-executable) HTML or Plain text. They also give you the ability to allow or disallow images inline! Very important if you wish not to be tracked by email senders with beacon ads, web beacons, web bugs. These email clients also give an easy way to view the source of an email so you can do your own investigation of information in the headers or body of the email, and to facilitate sending comprehensive email information about spammers, etc. to sites like PayPal, Google, eBay, your bank, etc.
Sadly even many website based email clients, like GMail, Yahoo Mail, Outlook.com, Hotmail, MSN Email, etc, go only half way in regard to these very necessary capabilities … if that.
Fran's Computer Services' Blog 
You must be logged in to post a comment.