Yahoo! phishing attempt :: How Yahoo! allows phishing attempts to your inbox

Yahoo! phishing attempt

Posted on November 21st, 2009 at 0:48, in .com.

Since I have this domain, one of the main concerns was to use Google as my mail provider instead of the mail server that was offered by my hosting provider. It’s not that I do not trust them, but the availability of Google’s servers is something more precise than every other average data center can offer and there is that concern that everybody has regarding SPAM. We all agree that SPAM is a vicious thing that deserves hate. And I generally do not like to hate.

Anyways today, on my Yahoo mail account (which I’ve never really used for more than the side of having an instant messaging account associated with) I got an interesting phishing attempt that got into my inbox (Yahoo sucks at caching SPAM). The content of the email is the following:

Subject: Verify this email address
Date: Fri, November 20, 2009 7:05:41 PM
From: "yahoo-account-services-us@yahoo-inc.com" inf0@yahoo.com

Account Suspended !

Dear Yahoo Member

Due to the number of incorrect login attempts, your Yahoo Account has been Suspend for

your security. This has been done to secure your accounts and to protect your private

information in case the login attempts where not done by you..

follow this link to Unsuspend Your Account:

http://www.yahoo.com/unsuspend/user

Thank you for your prompt attention to this matter.

where of course the link took the user to http://vaigroup.ru/yahoo-account-services/. Now really, can anybody really believe that their account was suspended and that Yahoo would send them that notice to a suspended account (forget about the link’s domain)?

Just for posterity, as from the moment I began to write the post and the moment I’ve reached to this paragraph Mozilla Firefox identifies that specific page as forgery, the phishing attempt’s cloned page looked like this:

while the original (I still don’t use that stupid seal they provide) looks like this:

Do you see the differences?

This is just one of the reasons for which I really like Google’s services: they offer a lot of functionality (for free) while being simple to use, secure and without hogging your bandwidth with flash annoying banners and with unresponsive JavaScript. And above all, I do not get warnings that I use an unsupported operating system for something that runs in a browser (Firefox for the matter, even if the screenshots from above were made using Chrome).

Good luck, Yahoo, as you apparently need it!

One Comment

Scott said

on December 5th, 2009,

at 00:55 hours

I just got one of these myself. Almost fell for it.

The url went back to a real looking website, which must be infected somehow.

Think you've got something to say?

For leaving comments including source code or terminal output, please use the the following tags like in the next example:

[language]
code lines
[/language]

where you substitute language with the programming laguage used throught the code example (for terminal output that would be bash), e.g:

[bash]
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
[/bash]

To see a list of all the supported languages, please check this page.

If you want to include code bits inline, please use the code tags like in the following example:

The <code>$USER</code> variable holds the current logged in username.

Radu Cotescu's blog