Is this scam or real thing?

[Jorge Cervantes]

A few minutes ago, I received this email possibly from Microsoft:

The title of email was: Microsoft Outlook Notification.
From: Support [[email protected]]

The contents of the message was;


You have (1) New Message from Outlook Microsoft



- Please re-configure your Microsoft Outlook again

- Click on the link below:



http://microsoft.com.outlook.amsy4.org/outlook/setup.htm?id=537765





*************************



When I checked the domain name of servicesecurity.com, its IP was
208.109.78.121.

This IP belongs to GoDaddy.com, Inc.



I assume that this is a scam. The email really looks like from
Microsoft.com.



James

 

[Alias]

A few minutes ago, I received this email possibly from Microsoft:

The title of email was: Microsoft Outlook Notification.
From: Support [[email protected]]

The contents of the message was;


You have (1) New Message from Outlook Microsoft



- Please re-configure your Microsoft Outlook again

- Click on the link below:



http://microsoft.com.outlook.amsy4.org/outlook/setup.htm?id=537765





*************************



When I checked the domain name of servicesecurity.com, its IP was
208.109.78.121.

This IP belongs to GoDaddy.com, Inc.



I assume that this is a scam. The email really looks like from
Microsoft.com.



James

It's a scam for sure.

Alias

 

[Keith]

A few minutes ago, I received this email possibly from Microsoft:

The title of email was: Microsoft Outlook Notification.
From: Support [[email protected]]

The contents of the message was;


You have (1) New Message from Outlook Microsoft



- Please re-configure your Microsoft Outlook again

- Click on the link below:



http://microsoft.com.outlook.amsy4.org/outlook/setup.htm?id=537765





*************************



When I checked the domain name of servicesecurity.com, its IP was
208.109.78.121.

This IP belongs to GoDaddy.com, Inc.



I assume that this is a scam. The email really looks like from
Microsoft.com.

You are correct that this is a scam. In the future when posting emails
include the full header and remove your email address so people can better
trace the origin of the scam/spam.


Best Regards, Keith

 

[VanguardLH]

A few minutes ago, I received this email possibly from Microsoft:
...
- Click on the link below:
http://microsoft.com.outlook.amsy4.org/outlook/setup.htm?id=537765

Oh, come on. Even /YOU/ can read the URL to see it did *NOT* come from
Microsoft! Does amsy4.org look like a Microsoft domain?

 

[Duncan McC]

If you're using IE8, well I get this screen (well done MS ...

http://homepages.paradise.net.nz/duncanm4/Clipboard01.jpg

 

[VanguardLH]

If you're using IE8, well I get this screen (well done MS ...

http://homepages.paradise.net.nz/duncanm4/Clipboard01.jpg

I don't know how many users reported that site. I did. It's easy with
the "Tools -> SmartScreen Filter -> Report Unsafe Site" menu. Of
course, this requires that you have the SmartScreen filter enabled in
IE8 to make use of Microsoft's phish list; however, SmartScreen will
slow down IE8, not much but some (one of the tweaks to speed up IE8 is
to disable the SmartScreen filter). The lookup against the dynamically
updated phish database is done in parallel but still requires some
bandwidth and lookup time. You have to open a LOT of sites to measure
any perceptible lag. It's there but you probably won't notice. See
http://blogs.msdn.com/ie/archive/20...protection-with-ie8-s-smartscreen-filter.aspx.

I also reported the phish site to http://www.ic3.gov/. I gave up on
reporting it to the FCC since they're geared towards spam e-mails rather
than phish sites.

I was going to report the phish site to http://www.phishtank.com/ but
they require registration to issue reports (and I was too busy at the
time to bother). I'll go back and review that anti-phishing site to see
if I want to bother using them to report phish sites. I know that some
anti-phish toolbars use them as a source for a phish site database.

I tried to report the registrant's phishing site to its domain registrar
(moniker.com) but they have no abuse reporting e-mail address and ALL of
their contact e-mail addresses result in undeliverable e-mails -- so I
have to assume they are spam/phish friendly. The registrant says (in
their domain registration) that they are located in North Carolina, US
but if you do a traceroute on the domain you will find it is hosted on a
Brazilian host (200-204-44-212.dsl.telesp.net.br) which is some dial-up
user there.

 

[VanguardLH]

...
I also reported the phish site to http://www.ic3.gov/. I gave up on
reporting it to the FCC since they're geared towards spam e-mails rather
than phish sites.

I was going to report the phish site to http://www.phishtank.com/ but
they require registration to issue reports (and I was too busy at the
time to bother). I'll go back and review that anti-phishing site to see
if I want to bother using them to report phish sites. I know that some
anti-phish toolbars use them as a source for a phish site database.
...

Oh, another anti-phishing site to report phish e-mails or sites is
http://www.antiphishing.org/. You send them an e-mail to report the
phish. They're a bit slower than other phish lists. A lot of their
phish info comes from http://www.millersmiles.co.uk/ but, as I recall,
that site is only interested in phish e-mails, not phish sites; that is,
you forward (as attachment to preserve all headers) the phish e-mail to
millersmiles. I didn't see a web form where you could report a phish
*site* to them.

 

[VanguardLH]

I found this one for reporting phish sites but never used it. Symantec
manages this phish list. I don't know with whom Symantec shares its
list.

https://submit.symantec.com/antifraud/phish.cgi