Message-ID: <C6AF3ECACA6E9A46A2CB2FABCDCB35C404DE1CAF@swilnts810.wil.fusa.com>
Date: Wed Jun 14 20:42:15 2006
From: Glenn.Everhart at chase.com (Glenn.Everhart@...se.com)
Subject: Phishing and Spammers

A query based on IP has the same problems everyone else has with IP address;
it would immediately remove everyone using the same proxy, or who happened
to get the same IP from a point of presence, or from a load balancer...

It might just be that a merchant trying to advertise this way and getting a
large number of fake charges would start to look like a fraudster and start getting
queried by some folks worried about money laundering or fraud. (Why so many 
orders from <favorite locale that is heavy into illegal drugs>?)

Best not to flood the phisher with extra replies lest he be able to recognize
that, but if everyone did their best to create plausible orders with phony
and suspicious-sounding sources it might make that form of advertising about as
popular with merchants as the proverbial cake with lye frosting.



-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk]On Behalf Of Cardoso
Sent: Wednesday, June 14, 2006 3:31 PM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Phishing and Spammers


A simple SQL query can delete all records from the same IP/machine, if
the counter is above 2. 

Presto, database cleaned. Also the phiser will now that at that address
there's someone who knows better. Remove the address from the database
and add a newbie clueless address instead. 

Best-case scenario? Solve our problem and let others deal with it. 




On Wed, 14 Jun 2006 15:23:05 -0400
"Geo." <geoincidents@....net> wrote:

G> I would appreciate hearing a little feedback on this idea.
G> 
G> It strikes me that phishers and spammers have a vulnerability that we have
G> not yet exploited. They collect information, granted the returns are small
G> but since email is cheap they send out tons and those tons net them a
G> profitable return.
G> 
G> Why not encourage everyone to reply to phishers and spammers with fake
G> information? Get a spam, order it using a fake name and credit information.
G> Get a phishing mail, go login to change your ebay/paypal password with

G> credentials.
G> 
G> GIGO, you know? I mean if they are getting a 1% or 2% return then if the
G> same ratio were to respond with bad information it would make a lot of work
G> for the folks profitting from these activities.
G> 
G> Geo.
G> 
G> _______________________________________________
G> Full-Disclosure - We believe in it.
G> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
G> Hosted and sponsored by Secunia - http://secunia.com/
G> 

Allgemeinen Anschulterlaubnis
Cardoso <cardoso@...ox.com> - SkypeIn: (11) 3711-2466 / (41) 3941-5299
vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


**********************************************************************
This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you
**********************************************************************

Powered by blists - more mailing lists