Phishing email doing the rounds

[Shane]

Hi there all,

If you see the following email in your inbox please do not click its links.

---------------------------------------------

From: Support (RFB)
Sent: Thursday, October 15, 2009 2:54 AM
To: hclnzb@referback.com
Subject: A new settings file for the hclnzb@referback.com has just been released

Dear user of the referback.com mailing service!

We are informing you that because of the security upgrade of the mailing
service your mailbox (hclnzb@referback.com) settings were changed. In
order to apply the new set of settings click on the following link:

http://referback.com/owa/service_dir...romname=hclnzb

Best regards, referback.com Technical Support.

---------------------------------------------

This is NOT a referback email but a phishing mail.

Shane

PS - for more phishing please see wikipedia

[pgaming]

Wow Shane that is a nasty one.

Thanks for the warning!

greek39

[universal4]

I have seen a lot of these for the last week.

In fact my guess is this one will be somewhat effective since it employs the technique of masking the sender and the link in the email with the domain of the recipient.

The OWA in the link is there for enterprise users who use "Outl\ook Web Access" of Microsoft Exchange since that is a very common link structure of the web based portion of corporate mail servers.

I have seen this on 3 different domains to day alone and have only read 3 different email accounts today...

Rick
Universal4

[Chips]

Thanks Shane! Those nasty bastards never stop do they?

[Shane]

Yeah its a tricky one but if you mouse over the hyperlink (in the original not my copy/paste) the underlying link is as follows:

xxhttp://referback.com.nerrasssw.co.uk/owa/service_directory/settings.php?email=hclnzb@referback.com&from=referback.com&fromname=hclnzb