A well formed e-mail:
No obvious spelling errors, reasonably good grammar, etc. One red flag is the URL to the Comcast logo, but I wouldn’t bet on users catching that. The embedded link is another red flag:
http://login.comcast.net.billings.bulkemail4sale.com/update/l0gin.htm
[s/0/o/]
But one that would fool many. Users will not see that URL unless their e-mail client has the ability to ‘hover’ a link destination.
The ‘login page’ is well formed & indistinguishable from Comcast’s Xfinity login page:
All the links in the bogus login page (except the form submit) go to real Comcast URL’s, the images are real, the page layout is nearly identical. The only hint is that the form submit doesn’t post to Comcast, but rather to[snip].bulkemail4sale.com/Zola.php:
Zola.php? Hmmm…
Filling out the bogus login page with a random user and password leads to a “Comcast Billing Verification” form requesting last, middle & first names, billing address, credit card details including PIN number, card issuing bank, bank routing number, SSN, date of birth, mothers maiden name, drivers license number, etc…
The “Comcast Billing Verification” form is very well constructed, generally indistinguishable from normal Comcast/Xfinity web pages. The submit action for the “Comcast Billing Verification” form is:
Hacker.php? This is not going to end well.
This is a very well constructed phishing attempt. Impressive, ‘eh?
It took me a bit of detective work to determine the non-validity of this phish. Ordinary users don’t have a chance.
Where is anonymous when you need them?
