Nasty Phishing E-mail

heavensbug

Now I am professionally a computer consultant so a Phishing e-mail has to be good to get past me.

This one did not but it did cause some alarm bells to ring so thought I would run it past you guys/gals and see what you reckon.

Phishing mail came through from a totally bogus e-mail address. I knew it was bogus purely because the wife works for the company that it came from so it was easy to tell it was a Phish and hence no links clicked.

The thing that worries me is that at the top they had my post code.

And the post code was correct.

Like I say I am very savvy with these things. Don't install software I don't know the origin of.

So how did they get it?

If it was keyboard logger they could have got a lot more info such as passwords which would be much more fruitful.

So I am guessing they must have hacked an e-mail database somewhere to be able to tell my e-mail against my Post Code.

Any Ideas? Is there something I should be more worried about?

I can't see how they can do anything as I have not clicked any links so they won't have any UN or PW.

[Deleted User]

Could it be someone your wife works with?

Have you checked the headers of the email?

banger9365

if your a computer consultant why don't you do the usall thing to find any keylogger that you may/maynot have,how can they put a e-mail addy to a post code and how can they put your isp addy to a post code unless there your isp thats not true they can get an area

Belnahua

Cotton Trader's got their website hacked, so could they have got your details from there? I suppose any mailing list would do, any competitions you've entered, any newsletters you've signed up for?

I got a spam email from my boss once, from his personal account to my personal account!

Then it dawned on us both, that we both deal with the same contractor personally.

He doesn't know the first thing about computers, so when we asked him, he doesn't have any virus gaurd or firewall running (uses Win 98!). So we guessed that his Outlook address book had been compromised, as on further investigation, he downloads everything he can find, into !!!!!! etc! And opens and responds to all emails regardless of how dodgy they are, as they could be important.

There's no telling some people?

heavensbug

I got to do the keyboard loggers etc tonight.

Also gonna run through Hijackthis etc.

Unfortunatly my desktop knowledge is limited when it comes to tracking loggers etc down.

All D/L's are done to my desktop which is clean. It was the laptop if anything that has been compromised.

Cotton Traders could be the nail on the head. Life long Gloucester Rugby Fan here and guess who supplies there kit

Definatly not from my wife's co. as I checked the links with a hover and the domain and @ address is completly wrong.

Something like @nationwidebuildingsociety-email.com

NW's e-mail addresses are solely nationwide.co.uk.

Their phishing/fraud department also confirmed it was a Phish.

chris667

Wouldn't it be good if all banks and building societies made it clear that they never, ever put any kind of links or graphics, or other attachments in email?
All they need to do is send a message that says "Please login and check your messages".

Belnahua

chris667 wrote: »

Wouldn't it be good if all banks and building societies made it clear that they never, ever put any kind of links or graphics, or other attachments in email?
All they need to do is send a message that says "Please login and check your messages".

Not really! As banks already tell you they'd never send you an email with a link asking you to login, and people still click the link. So if they adopted that ploy, the spammers would just adapt their tactics and send plain text emails!

heavensbug

Internet banking security is getting more stringent.

I know that I have to use a special code machine now for my transactions.

Just spoken to our security guy here at work who is a friend and he was showing me how easy it is by just using IP Address lookup to get hold of your post code.

Althugh that would still mean that they had to have gotten my IP at some point. But that can be as simple as embedding an advert on a webpage you visit.

I also know that a place I signed up to a year ago was hacked and I am still getting spam mail from it.

Tag a read receipt to your e-mail. And you have an IP Address

e.g.

Send out a spam e-mail to easy addresses (firstname.surname@domain is common)
Tag with read receipt.
Read receipt/non-read comes back and you have the IP Address.
Do IP look up and you have a post code.

Not difficult if you want to do it. Add that to the Phish to make is plausible and you have less tech aware people clicking links everywhere.

The other way is the image in the e-mail can actually look it up when you open the mail and then display the postcode.

This particular one said we have added your post code to the start and the end so you know we are genuine.

But nothing else. So you could tell it was a phish.

Guess it is proof at how these people are getting cleverer and devoting more time to relinquishing you or your money.

HoofeHearted

"Do IP look up and you have a post code"

Correct me if I am wrong, but doing the above will provide the Post Code of the recipient's ISP, or their Company (if a company email address).

heavensbug

Depends what site you look at.

Some give you the actual location that the IP is registered to by the company outsourcing the locations.

e.g.

http://www.ip-adress.com/ipaddresstolocation/

This is more for static addresses but some can go deeper dependant on the info they want.

Some can go even deeper than that.

Blacksheep1979

HoofeHearted wrote: »

"Do IP look up and you have a post code"

Correct me if I am wrong, but doing the above will provide the Post Code of the recipient's ISP, or their Company (if a company email address).

You're wrong.

I'm sure the op as a

professionally a computer consultant

will know exactly how/why this happened and is just testing us

It's not hard to get a list of peoples postcodes etc could be from cottontraders as said above, someone bin dipping, or any other number of sources as for

domain and @ address is completly wrong

even if they're right doesn't mean a thing - I can send you a mail from bill.gates@microsoft.com with that as a reply address, or that as a link in the email but goes to gordon.brown@no10.gov.uk or anything - surely as a

professionally a computer consultant

you know this and shoudl be looking at the ip's in the message header (not that this is anywhere near 100% either)....