New Egg phishing e-mail - BEWARE!

MarkyMarkD

I received a very convincing phishing e-mail purporting to be from Egg today. It was convincing because it is headed "Your Egg card statement is ready" rather than the usual cobblers about confirming your account details.

I have told Egg about this by phone, but the site linked to is still up and running right now - so BEWARE! The linked site is an exact clone of Egg's login page but the URL begins with http://www.shamahluv.com which is a bit of a giveaway - (1) silly URL; (2) not https.

Apologies for posting this in multiple places but I wanted everyone relevant to see this post before they give away their banking details.

chriz1000

The thing is, I warned them about this about a year ago. They ended up phoning me about 3 times, but still decided in the end not the personalise there emails with at least your full name.

MarkyMarkD

This phishing site has now been closed down - following an e-mail from ME to its host, because Egg didn't do anything (at least, not soon enough) when I phoned and e-mailed them.

D'oh!

You'd think that Egg would take phishing seriously.

sloughflint

MarkyMarkD wrote:

This phishing site has now been closed down - following an e-mail from ME to its host, because Egg didn't do anything (at least, not soon enough) when I phoned and e-mailed them.

D'oh!

You'd think that Egg would take phishing seriously.

Well done but how do you email a host or indeed find out who the host is?

MarkyMarkD

Ah, I hoped someone would ask that. And I'm happy to share.

I'll use the example of the Egg phishing site.

The site was https://www.shamahluv.com.

You can go to a useful site like http://www.dnsstuff.com/ which lets you search for all sorts of things, including IP addresses, website URLs, etc. In this case we know the URL so stick "www.shamahluv.com" into the "whois" box on the bottom left hand side.

This brings up the name and address of the foolish phisher (or perhaps some made-up details - depends how stupid they are) and details of the host which is christianwebhost.com.

Now, at this stage you might get stuck as the host may be in China or Latvia or somewhere like that - very likely for fraudulent sites - and they might not be very responsive. But fortunately, christianwebhost.com are reputable.

Then, e-mail abuse@christianwebhost.com telling them they have a fraudulent site on their server.

Bob's your uncle!

They e-mailed back a few hours later saying

"I shut'em down"

Very satisfying!

Even more satisfying if the numpty has registered his dodgy site with his real name and real (Scottish) address ... hopefully he'll be getting his collar felt pretty quickly.


**** Note that it's possible that the owner of the shamahluv.com site was a completely genuine individual who'd had the fake Egg page planted on it by some uber-hacker - in which case, I apologise unreservedly for any wrong impression given. ****