[ale] Fraud? [Fwd: Visa Security Update]

[da Black Baron]

On Fri, 2003-12-05 at 14:03, Stephen Touset wrote:
> This email absolutely reeks of fraud. There are grammar mistakes, the 
> layout is boring, but bad, etc. However, when you click on the link, it 
> actually takes you to Visa's website. I'm almost certain that this is a 
> scam, but everything checks out so far. Has anyone else gotten one of 
> these, and is it legit?

Nope.  It's a scam.  If you look at your e-mail source, you'll see that
you're actually getting your page served from:

GetFrom at 61.252.126.191/verified_by_visa.html"

Which is an IP hosted by:

dabaron at monster:~$ whois 61.252.126.19
% [whois.apnic.net node-2]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html
 
inetnum:      61.248.0.0 - 61.255.255.255
netname:      KRNIC-KR
descr:        KRNIC
descr:        Korea Network Information Center
country:      KR
admin-c:      HM127-AP
tech-c:       HM127-AP
remarks:      ******************************************
remarks:      KRNIC is the National Internet Registry
remarks:      in Korea under APNIC. If you would like to
remarks:      find assignment information in detail
remarks:      please refer to the KRNIC Whois DB
remarks:      http://whois.nic.or.kr/english/index.html
remarks:      ******************************************

while the *real* visa.com:

visa.com has address 128.11.100.130

hosted by:

dabaron at monster:~$ whois 128.11.100.130
 
OrgName:    Genuity
OrgID:      GNTY
Address:    Genuity
Address:    225 Presidential Way
City:       Woburn
StateProv:  MA
PostalCode: 01888
Country:    US


You make up your own mind... ;-)


-- 
	
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
                                                         
(,,oBo,,)         |           Wylde  Bill                    
  ||||            |    http://mrpooter.sytes.net
http://lyst.org   |    wyldechylde at geocities.com   
      
"Here's my family tree.  As far as I can tell, my
relatives were carnival folk who were touring this place called
Hiroshima in the summer of 1945.  Because they lost most of their hair,
they mostly married each other.  And here I am." --The Oblongs
 
----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------                                                                                                                                                                                                                                                           
                D.E.A. = State Sponsored Terrorism
          Disempowering government means empowering people.
        http://flag.blackened.net/daver/anarchism/nlm/nlm.html  

--------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------