Weekend brings e-Gold phishing attacks
Numerous attempts received

As most online currency accountholders know, phishing emails are a major part of this arena. Basically if you can't take them, you might as well get out of the arena.

Phishing emails are here to stay and there is little you as an online accountholder can do about it, except educate yourself. It is also known that most email addresses used by players in online programs, will eventually end up in the hands of Hackers and Spammers.

On July 16, 2005 an attempt was received that offered the following email message.

- e-gold Account User Agreement:
Ever used a currency with a contract at all, let alone one that clearly outlined the Issuer's obligations to you? Well, you are now! Truly a "must read" for any e-gold User:
http://www.e-gold.com/unsecure/e-g-agree.htm
---------------------------------------------
Thank you for using e-gold!
---------------------------------------------

The link that was supplied in the email actually took those who clicked on the link to a web site located at surfthatpays.com. The link actually takes you to a page that attempts to load a Trojan worm.

The actual link provided may have been placed into the images sub directory by a Hacker who has managed to hack the surfthatpays.com server. If no hacking has taken place then, who is this guy running the web site? This is the actually link you are taken to. DO NOT click the following link. http://www.surfthatpays.com/images/newex.html.

The email was received through IP Address [85.92.66.39]. This IP: is owned by brunel.mywebserver.net and traces to a suburb of London England.

In a second attempt received on July 17, 2005 will no longer effect users. The site was closed down at some time over the last twenty-four hours. Here is the body of this attempt.

Dear e-gold member,
Because recently dispatching of the harmful programs to e-gold users became more frequent and quantity of complaints for unapproved withdrawal of money from users' accounts has grown vastly it is our earnest request to install the following encryption update to your computer:

e-gold encryption update:

Given update blocks all known in the present situation trojans, which allow to withdraw money from your account without your knowledge.

In case of disappearance of the funds from your account e-gold is not responsible for that if present e-gold encryption update wasn't installed on your computer! To install encryption update please follow installation instructions on our web site:
https://www.e-gold.com/acct/update.html
---------------------------------------------
Thank you for using e-gold!
---------------------------------------------

The actual link you would have been taken to, if you clicked the link is now dead, but it was an active attempt to steal your passphrase information. The actually link was http://e-gold-payment-server.com/acct/update.html.

The email was received from IP Address [216.196.206.42], which is located in Cincinnati Ohio.

A third email claiming to be from e-Gold.com was also received on July 17, 2005. This one came with the following body.

** e-gold Account Information Notice **
Time of update: 07/17/2005 02:16:30 PM GMT
This automatic email notice lets you know that modifications have been made to the Account Information settings for your e-gold account.

The current settings for your account can be viewed and modified at the e-gold website:
https://www.e-gold.com/acct/login.html
Enter your account information and approve or deny the modifications made. If your account information remains unconfirmed for 72 hours, your account will be suspended.

User Agreement, Section 9: we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable to verify or authenticate any information you provide to us.

After the suspension of your account, please be advised that you will be prohibited from using E-gold in any way. This includes the registration of any new account.

Please do not reply to this automatically generated email message.

This one offered a link to http://213.232.95.84/acct/login.html No attempt was made to view this site, but it expected to be either a fake login page or an attempt to install a Trojan on the visitors computer.

The IP Address used in this attack 208.53.170.157. All three attacks are likely Zombie computers owned by people just like you. The only difference is that your computer is secure, right? Or is it? To find out, click here.