Tech: Yahoo Phishing Alert (Identity theft)

Subject: BS: Yahoo Phishing Alert (Identity theft)
From: Wincing Devil
Date: 19 Mar 05 - 10:56 PM

This is the REAL Vince Wilding, who knows that
Wincing Devil is an anagram of
Vince Wilding.

If you get a rather cryptic IM or email from me, telling you to go to a GeoCities page ending in "stvhng" DO NOT GO THERE! It's brings up a page that looks exactly like a Yahoo Sign-in page, but it takes your User_id and password and sends them, literally, to the Czech Republic. I consider myself rather e-adroit, but I fell for this one. I've sent notice to the folks at Yahoo, but when last I checked, the page was still there.
(Yes, I've already changed my password!)

What drew my suspision was that I entered my password, and the screen just reappeared. After the 2nd try, I did a "View Source" and saw that the form was being submitted to a server in the Czech Republic (www.mailform.cz)

Also, the following comment was in the source:

<!-this is a fake yahoo page and I take no resposibility for anything you enter in this form. This page is meant only for educational purpose. -->

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: CarolC
Date: 20 Mar 05 - 12:42 AM

Wow. That's scary stuff. Yesterday I had an odd experience with my Yahoo e-mail. I was logged on and trying to send a message. Then I got a message saying I had to log in again. So I did, and then tried to send my message. The message disappeared and I got a message saying that I wasn't logged on. Then a few seconds later, I was routed back to my home page as if I had been logged on the whole time, except that the e-mail I'd tried to send just vanished, and I couldn't even find any trace of it in my sent messages folder.

Does anyone know if this sounds like it could have been a case of phishing? I read somewhere that phishing sometimes just happens with log-in pages that show up independently of e-mails.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: Don(Wyziwyg)T
Date: 20 Mar 05 - 07:51 AM

Carol,

Change your password NOW!

Yesterday would be even better.

I am UK side of the pond, and I am bombarded with these almost daily. Fortunately most pretend to be from banks with which I do not have accounts.

Setting your firewall to high security, and reducing only for sites you trust, is a nuisance, but a worthwhile one.

If they ever manage to get mMY bank details, they're welcome to help themselves to my overdraft (grin).

Don T.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: Mr Red
Date: 20 Mar 05 - 03:38 PM

I never enter truthful data on any webform. And as for giving data that could be used to identify me - they can be Mr Red anytime. There are a few rougeophiles out there.

Same on the telephone, If they don't know my name they are spamming - which is extremely rare - I am not in the book.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: CarolC
Date: 20 Mar 05 - 04:33 PM

Thanks, Don(Wyziwyg)T. I changed my password yesterday as soon as I made the connection in my mind about what might have happened. I had one or two e-mails stored that may have contained sensitive info (passwords), but they were to credit card accounts, one of which was canceled last week, and the other I changed the password for yesterday also. I don't know if any harm might have been done by those passwords having been there, but I am hoping for the best.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: Rapparee
Date: 20 Mar 05 - 05:10 PM

Yesterday I received an email from PayPal, asking for a verification of my account ("Click here to....").

Various things triggered an alert in my mind, not the least of which is that I've never, ever used PayPal, and that even if I did, I most certainly wouldn't be doing it from work (which is where the email was sent).

Being somewhat familiar with things networkable, I did a whois lookup at ARIN.net on the IP (which I got from the email header). Well, imagine my surprise when I found that it was registered to a Royal Signals establishment in the UK!

Golly, I said to myself, could this be an attempt to worm financial information out of me?

So I reported the whole this to PayPal (the real one). And yes, I included the header in my report. Wouldn't do much good without it.

My rule: Be suspicious of everything and everyone that wants your financial data or, in fact, ANY data about you.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: Layah
Date: 20 Mar 05 - 07:17 PM

I've gotten emails like that from both paypal and ebay, usually telling me my account has been hijacked and I should sign in to verify I am who I say I am. Or some such thing that is fairly confusing. I reported them to paypal or ebay and always got back the response that it was a hoax. So the answer is don't ever click on a link and type in a name and pasword. If you need to sign in to something type in the address rather than using a link that could bring you to a fraudulent page.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: Mingulay
Date: 20 Mar 05 - 07:18 PM

Similar thing happened to me recently on AOL. Someone, somehow got hold of my password and bashed out a load of e-mails purporting to come from me. Changed password and notified aol. Don't know who did it though.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: Don(Wyziwyg)T
Date: 21 Mar 05 - 03:07 PM

Don't know if it's the same in the US of A, but here in the UK, no reputable company ever asks for personal details by E-Mail.

I agree with the guy above. If it is not addressed to me by name, I hit delete, and I've never yet lost a piece of mail that I would have wanted to receive.

I never use a link given in an E-Mail. If I am interested I do my own web search for the site and contact through that.

I work on the principle:- "There's only two people I trust, me and thee, and I'm not too sure about thee".

It works.
Don T.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: CarolC
Date: 21 Mar 05 - 03:16 PM

If what I experienced was, indeed, an incident of phishing, it happened with a pop-up that looked just like the Yahoo log-in page and not an e-mail. So people have to be careful, not only with e-mails, but also with log-in pages that don't behave quite right.

The Yahoo people say that with their log-in page, you should see a URL that has a back slash after the .com, like this:

http://login.yahoo.com/

...and that bogus Yahoo log-in pages will not have the back slash after the .com.

Ironically, I had turned my pop-up blocker off so I could update my McAffee virus protection and forgot to turn it back on again when I was finished. I suspect that's how the bogus log-in page was able to get through.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: CarolC
Date: 21 Mar 05 - 03:19 PM

Oops. I should have said foreward slash.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: GUEST
Date: 22 Mar 05 - 12:34 PM

What drew my suspision was that I entered my password, and the screen just reappeared. After the 2nd try, I did a "View Source" and saw that the form was being submitted to a server in the Czech Republic (www.mailform.cz)


What is a "view source" and how do you do it?

Thanks.

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: jeffp
Date: 22 Mar 05 - 01:04 PM

If you are using Netscape, pull down the View menu and select Page Source. If you are using Internet Explorer, pull down the View menu and select Source. If you are using something else, someone else will have to help you.

Jeff

Subject: RE: BS: Yahoo Phishing Alert (Identity theft)
From: GUEST
Date: 22 Mar 05 - 03:07 PM

I'm kind of computer illiterate. I use Internet Explorer. Where is the source supposed to be displayed. I went into my e-mail trash file and got to a spam e-mail. I clicked on Source and didn't see anything different. What else do I need to do.

Thanks