Re: Are you getting lots of phishing spam with links to hosts at webs[.]com?

[David Curry <david.curry () NEWSCHOOL EDU>]

We've gotten a couple. I reported it through their "report abuse" page on
Wednesday; they finally responded today and the page has been taken down.



--

*DAVID A. CURRY, CISSP* • DIRECTOR OF INFORMATION SECURITY

*THE NEW SCHOOL* • 55 W. 13TH STREET • NEW YORK, NY 10011

+1 212 229-5300 x4728 • david.curry () newschool edu



On Fri, May 24, 2013 at 2:29 PM, Mark Rogowski <m.rogowski () uwinnipeg ca>wrote:

>  Funny you mention webs; I just received a complaint about a phishing
> site there today.
>
> They must be getting bored with you big universities, they are now
> focusing on us small fry...
>
> Mark Rogowski  CISSP, CISM
> IT Security / Information Security Office
> University of Winnipeg
> Ph: (204) 786-9034
>
>  ------------------------------
> *From:* The EDUCAUSE Security Constituent Group Listserv [
> SECURITY () LISTSERV EDUCAUSE EDU] on behalf of Bob Bayn [bob.bayn () USU EDU]
> *Sent:* 24 May 2013 10:44 AM
> *To:* SECURITY () LISTSERV EDUCAUSE EDU
> *Subject:* [SECURITY] Are you getting lots of phishing spam with links to
> hosts at webs[.]com?
>
>   I get phish messages reported by my users.  There are generally several
> different ones a day that have links to a password collection web form at a
> host at webs[.]com.   I submit a complaint about the URL to the webs[.]com
> report page and they generally remove the page within a day.  But phishers
> probably get most of their passwords within the first day anyhow.
>
> Six months ago, we were being phished with google spreadsheet form pages,
> but since the Oxford fiasco, Google has placed "do not enter your password
> on Google Forms" right above the submit button.  We hardly see Google forms
> linked in phish messages anymore.
>
> Like Google, the Webs service is used for many non-hazardous purposes,
> too.  A brief attempt here to blacklist all of webs[.]com resulted in some
> complaints from people who actually use that service to host their
> personal/professional home page.  And I've seen other benign links to
> webs[.]com in newsletters and list messages.  Back on the bad side, I see
> lots of webs[.]com links in spammy posts to webpage comment boxes.
>
> Is anyone else interested in applying some group pressure to webs[.]com to
> make them more responsive and proactive about phishing abuses of their
> service?  Then the phishers would probably move to jimdo, coffeecup,
> atwebpages, mooform, survsoft or formbuddy.   BTW, ajayr@formbuddy[.]com
> is VERY responsive when a phish collection page is reported there.  He
> never sleeps.  ;-)
>
> By the way, do you all have an abuse () yourhost edu address?  I try to
> report to the host site about the compromised accounts that are used to
> send us phish messages.
>
> Bob Bayn    SER 301    (435)797-2396       IT Security Team
> Office of Information Technology,     Utah State University
>      three common hazardous email scams to watch out for:
>      *1) unfamiliar transaction report from familiar business
>      2) attachment with no explanation in message body
>      3) "phishing" for your email password*