untangling_the_web

DID: 4046925
UNCLASSIFIEO....FOR OFFIGIAL I:JSE m4LY
webpage and paste it into the query box, hit return, and the hidden address will be
revealed.
Sites to De-obfuscate URLs
URL Decrypter
Un-Obfuscating URLs
http://www.cyber-junkie.com/tools/urldecrypter.shtml
http://www.wilsonmar.com/1tcpaddr.htm
You must be very careful to avoid becoming "phish food" because the scams are
increasingly sophisticated and hard to detect. Banks, lending institutions, insurance
companies, and legitimate account holders of any kind (eBay, PayPal, Amazon,
etc.) never send requests for account information via email. If you are in doubt
about any request for information via email, do not click on the link in the email.
Instead, open your browser, type the uri of the company's home page into the
browser's address bar and go to the site that way. Then you can log into your
account and see if there is really a need for you to do anything. You can also use an
online tool to de-obfuscate uris to determine the real address of any urI. Phishing is
a form of the con game discussed later.
Another potentially dangerous type of phishing scam involves fraudulent e­
commerce websites that lure searchers to their sites, which present malware
disguised as legitimate-looking images of a product supposedly for sale. The
"image" is in fact a self-extracting zip (compressed) file that installs a Trojan horse
on the user's computer, usually in order to steal personal and financial data. Be wary
of any site that asks you to "click here to download images." This is an especially
difficult scam to detect because many legitimate sites offer users the option to
download image files (though usually not zipped files). The phishing sites
purportedly are offering very inexpensive products, so if an offer looks too good to
be true or if it looks in any way "phishy," it's best to avoid it.
A new type of attack gained prominence in 2006: "voice phishing" or vishing.
Vishing is a type of phishing scam that uses VolP (voice over Internet Protocol)
phone numbers to trick users into providing their private information. Unlike
traditional telephone numbers, it is relatively easy to get a VolP number
anonymously. "That makes it easier for scammers to carry out these vishing scams.
In some ways, vishing may be even more dangerous than phishing scams, because
consumers are used to entering private information into automated phone
systems."193
Vishing indicates that as consumers wise up to scams such as phishing, bad people
come up with creative new ways to separate you from your money (and sometimes
your identity). One reason it's so easy to use a vishing scam is that some
193 Issue #189, Scambusters.org, 26 July 2006, (12
December 2006).
554 UNCLASSIFIEOhTOR OFFIGIAL I:JSE ONLY