Warning - Email Phishing Attacks

[Saf]

If you receive an email from a familiar email address with an odd looking link to a website, be careful before clicking on the link.

In the earlier hours of this morning, just after 2.00am, an email was sent to me, and apparently several other people here and in England, containing such a link. The link was to a phishing site. It was once the real email address of a business in Korat that has since been sold. It seems that the recipients' addresses were stolen from the real owner of the email address by the phisher. That suggests the person who sent the email stole the identity of the genuine owner rather than picked up a cancelled email address. It's been reported, of course. It's not the first time that someone in Korat has done this.

I'm sorry to have to be coy about the email address but it is instantly recognisable and I have no means of contacting the genuine owner to warn him. I am absolutely sure that he is innocent of this attack and would want to contact the other recipients but this warning is the best that I can do at the moment. If anyone reading this thinks he recognises the genuine owner and can contact him, please PM me. Who knows what is being done in the name of his old business.

[Saf]

Here's Yahoos reply to my report of the attempted fraud:

Hello,

Thanks for writing to Yahoo! UK & Ireland Customer Care.

Based on the information you have sent, it appears you may have received
an email containing a worm virus. This does not mean your computer has
been infected with the virus, but most likely a computer that contains
your email address within its address book has.

These particular viruses are termed a "worm" virus which attempts to
spread itself by sending email to unsuspecting recipients enticing them
to open the attachments they contain.

If you have recently updated your virus definitions and have scanned
your computer, your system is most likely clean.

There is no way to stop the virus from attempting to spread, however, if
you are receiving multiple emails, they should eventually subside.
Yahoo! does work to keep as many of these types of emails away from your
account as possible, however, some may trickle through.

Until these types of messages stop arriving to your account, you may
want to consider utilising our filter feature to direct these messages
to a folder of your choosing. Below, I have included a link containing
information about this feature should you decide you are interested in
using it:

   http://help.yahoo.com/help/us/mail/manage/manage-06.html

Thanks again for writing to Yahoo! UK & Ireland Customer Care

Regards

[Saf]

I've just received an expert opinion on this:

1. The Yahoo reply is a stock answer and misses the point. The email is merely an amateurish attempt at phishing. The damage is done if you click on the link in the email.

2. There was a suspected theft of passwords from a certain forum last year and the victim of this present attempted fraud was a member of the forum. In fact, I've just checked and he still is a member. His email address on the forum is the one that's been stolen so he can't be contacted that way. This means that other members' email addresses and address books may be at risk.

It's not connected in any way with this forum, by the way.

[Saf]

The victim has been sent a message about this so the matter is, thankfully, resolved satisfactorily.

Other tricks will be tried by the culprit so we all need to stay alert.

[Saf]

This is tiresome, I know, but better you are informed.

Another phishing email has arrived this morning from the same address. The list of recipients is different except for my address which appears on both emails. Now, I find that interesting.

Anyway, to the point, one of the new addressees is known to me and lives in Korat. Others seem to be quite private contacts of the victim. They will each have a copy by now.

[Johnnie F.]

Not tiresome at all, Saf! Keep the info coming. We all need to know, if there are people in the Korat expat community who not only don't respect other's privacy, but even spread personal and protected info like personal email contacts by abusing hacked email accounts for sending phishing and other mail from there.

I do remember one of our mates who died about six months ago in a tragic traffic accident. From his email account were lately sent out SPAM emails advertising a company selling iphones. You can imagine how somebody feels about getting an email from a deceased person telling he had just bought an iphone and how great and cheap that was and how well it works: FRIGHTENED!

I'm starting to get an idea now who that abuser is...

[Saf]

Thanks JF.

The dialogue elsewhere is, apparently, very revealing to some people who are now forming a clear idea of what is going on.

This is how I and others see it. It's very simple despite the attempts to create a smoke screen around it. Someone has gained access to an email account in breach of Thailand's Computer Crimes Act. He is either:

1. using that account, also illegally of course, to  send spam and phishing links to people in the address book, or

2. selling illegally to others the ability to email their own links.

Does it remind anyone of that illegal porn and gambling website? It seems that quite a few people are starting to have an idea who's doing this. For certain it's being controlled by a two legged worm rather than a software one. Perhaps it's just a coincidence.

I remember the tragic death that you mentioned. It happened not far from where I live. The theft of his email account serves to reinforce the suspicion that is now becoming quite strong.

The perverted person who is doing this is risking a hefty penalty under the law.

[dirtydog]

Have you checked in the header for the originating ip?

[Saf]

These are the originating IP's:

84.229.120.48

190.214.158.200

[Johnnie F.]

IP-Adresse:       84.229.120.48
Provider:       Golden Lines Cable
Region:       Tel Aviv (IL)

IP-Adresse:       190.214.158.200
Provider:       EasyNet S.A.
Region:       Guayaquil (EC)

That emails from the same email account "were sent from" two completely different locations already indicates that they might have been sent over proxy servers. Now who is the proxy specialist in Korat? 

[dirtydog]

None of those seem to have proxy servers, think your all barking up the wrong tree.

[dirtydog]

Do hackers in Isaan kill their mothers?

[Saf]

None of those seem to have proxy servers, think your all barking up the wrong tree.

But let's say that the piece of garbage doing this has, say, a Blackeberry or iPad. He could change his IP adress at will just bt moving around town - no need to use a proxy. He probably also knows how to change his computer settings to hide it's characteristics. Remember too that he has stolen internet accounts so there's no need to do much more work to hide his ID.

[Saf]

Do hackers in Isaan kill their mothers?

I don't know but probably someone who would kill his mother would not hesitate to steal and use the email account of a dead man.

[Johnnie F.]

I don't know but probably someone who would kill his mother would not hesitate to steal and use the email account of a dead man.

Checked on that again. In July he sent SPAM over the email account of the said deceased person. One month later he posted on my wall on Facebook from the Facebook account of the said deceased person. The latter I regard as an even worse intrusion. He hacked himself into my privacy that way, maybe attempting to hassle the circle of my relatives and old friends now in his quest for a "skeleton in my closet".

With these experiences expats in Korat will have to think more than just twice about social contacts to each other over the internet.

My experience leads me to giving this advice: Especially people opening businesses in Korat should be very careful with their trust in professionals helping them to set up their business. I remember a certain individual starting to argue with me personally (i. e. not on behalf of a client) and attempting to "get me to come to his office" after he had (under circumstances not so clear to me) read a PM I had sent to a local restaurant owner, that wasn't even compromising him or anybody else...

Yes, the same person who visited me once neither being invited nor announced, reported here and here. When will he start to respect other people's privacy and businesses?

[Saf]

There's no point in saying how disgusting that is. Normal people will already have decided that for themselves but the criminal behind these manually controlled attacks will never have a normal view of morality.

There was another similar email from the same email address today. He is now also emailing and revealing the email address of the current victim's bank contact. No decency whatsoever.