Trend Micro’s Web Reputation Services (WRS) Operations Team recently received a phishing email claiming to be from Blogger (see Figure 1), a free blog publishing tool from Google.
 |
The spammed message instructed users to update their Blogger accounts by clicking the embedded link, which leads them to a fake login page. At first glance, the site’s URL seems legitimate enough. It began with the same domain name as the real Blogger login page. Upon closer examination, however, TrendLabs engineers found that the fake site was not really hosted on the same URL as the real one. It was, instead, hosted on a remote site, thus convincing them that this was indeed a fake login page or a phishing site (compare Figures 2 and 3).
 |
 |
Users basically use blogs as ongoing chronicles of information about anything and everything they are interested in. Some use blogs to promote their businesses or to show what their companies can do. Some use theirs as personal online diaries where they can save their thoughts and feelings in. Whatever use blogs may serve to users, however, signing in to and updating their account records on the bogus login page, will certainly allow phishers to take advantage of them. This kind of attack can lead to not only data theft but also identity theft. This is the reason why we always urge users to be wary of suspicious-looking email messages and sites. Always check the URLs of the sites you are being led to. It never hurts to be paranoid once in a while if it means not falling prey to cybercriminals’ ever-evolving social-engineering tactics.
Trend Micro™ Smart Protection Network™ protects product users from this kind of attack by preventing the spammed messages from even reaching their inboxes via the email reputation service and by blocking access to malicious sites and domains via the Web reputation service.
Non-Trend Micro product users can stay protected as well by using free tools such as eMail ID, a browser plug-in that helps identify legitimate email messages in your inboxes. It helps users avoid opening and acting on phishing messages attempting to spoof real companies.
