India Income Tax Phishing Mail

Then I enabled the images to check whether he had embedded any government emblems. But to my surprise it was written ‘Australian Government’ . May be this was not targeted to Indians first. After understanding that this is a fraud mail, I wanted to read the entire mail and find out the URL under interest.

The attacker had obfuscated the URL to http://trim.li/nk/qFW,  since this ensures that the receivers email client, like in my case gmail, wont move any mails containing these types of links to Spam folder. I checked the site which the trimmed URL is redirected to and it was http://intaxdepartamenet.com/

India Income Tax Phished Website (http://intaxdepartamenet.com/)

Most of the URLs in the Phished site are linked to the genuine site (http://www.incometaxindia.gov.in/) except one, ‘Tax Refund Online Form’. The attacker has spent enough time to recreate this site.

Check the original India IT site screenshot below

India Income Tax Genuine Site (http://www.incometaxindia.gov.in/)

Once clicked on the ‘Tax Refund Online Form’ link, we reach the last part of our journey, the credit card entry page.

Enter Credit Card and PII details

He needs the ATM pin as well

When I checked the whois details for this phished site, I can understand that this has been hosted with Yahoo.

Registrar:     MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Status:        clientTransferProhibited
Dates:         Created 18-oct-2009   Updated 18-oct-2009  Expires 18-oct-2010
DNS Servers:   YNS1.YAHOO.COM  YNS2.YAHOO.CO

One interesting thing to note is the domain name, intaxdepartamenet.com, I assume that the attacker might have found it difficult to host website which has a domain name containing the prohibited string ‘department’ ( intaxdepartment.com site is available but he still chose a different one)

I’ve reported this site but hope that no one falls in this trap before necessary actions are taken. So people beware of Phishing mails and dont click on any links before deeply observing the domain name.

Take a test now and check your IQ in Phishing : http://www.sonicwall.com/phishing/

This is a free portable tool and can run on almost any Windows operating systems (Pro commercial version with enhanced is also available)

Here I’ve documented few of the main features of the free version of this tool; download and experiment with 3D traceroute to get the complete picture of it.

Note: This article is targeted for the readers who have basic understanding or experience with using various networking tools.

Main Window:

To trace the route to the sever, we just have to enter the target’s URL and click on the Trace Button. The 3D Trace View is continuosly refreshed and is displayed on the main window. We have options to zoom, rotate and move around the display as per our requirement.

3D TraceRoute Main Window

Whois Details Window :

We can view the query options in the ‘Query’ navigation present in the left handside bar. Just click on the query to obtain the whois details of the server.

Whois Details Window

HTTP Spy :

One cool feature in this app is HTTP Spy which allows us to quickly obtain the details like name and version of the Server in which this target application is hosted. This is obtained by analysing the Response headers of the Request message sent by the server.

HTTP Spy Window

Email Header Analysis :

To trace down the source or details of the email message we have received we should see the raw email message and manually go through it. For example in Gmail we have an Option ‘show original’ to view the raw message. 3D TraceRoute has a email header analyzer which process the raw data and displays the IP address of the sender and whether it has been listed as Spam before.

Email Headers Analysis

Video Demo :

Features

• 3d traceroute display: multiple graphics modification options
• Statistics window: min, max, average, standard deviation and history window with destination ping time
• AS list: the usual data view with lots of features
• Long period Ping and HTTP monitor
• Whois query: everything with only one click
• Record and playback: record any trace and playback step by step
• Built-in Browser: and the browser is already built in.
• ASN inspector
• NSLookup: with UDP and TCP. And zone transfer capability.
• Day and Night trace: Admins beloved toy
• Command-line execution mode: full replacement for good old buddy tracert.
• Passive OS fingerprinting
• Portscanner (knows 3,612 well known ports)
• eMail headers Analyzer: against RBLs
• Connection viewer: TCP, IP, UDP etc. statistics
• HTTP Spy: query HTTP-headers and webpages
• Atomic Clock Sync
• Built-in TELNET client
• And lot more….

Download 3D TraceRoute :

ClockingIt Screenshot

ClockingIt is a web based app which allows users to manage their project online. It has all the features needed for getting things done and to smoothly run the project. Apart from the ‘must have’ features like issue tracking and charts, this app features email notification, forums, chat etc which helps the users to communicate and share the info at a centralized location.

Video

ClockingIt Walkthrough

Tracking

Issue tracking is very easy with ClockingIt and can be done with few steps.

1. Add new Client
2. Create a New Project to the Client added (Step1)
3. Add users to the project
4. Click on New Task from the Menu
   

   NewTask Page (Screenshot from my previous site)

5. Submit the task details, priority, type and attach files, if any
6. Create Milestones from ‘Target section in newtask option
7. Assign the new task (Step 5) to appropriate milestone (step 6).

Dashboard

Click on overview button (acts like a dashboard)

• Drag the widgets to organize and arrange as needed
• Create new widget by specifying the type of it
• We can easily mark the tasks complete directly and the graphs will be updated instanly

Charting & Reporting

Click on GANTT chart from Schedule Menu. This chart extracts the data from the ‘Time Estimate’ option present in the ‘New Tasks’ page. Any change in the time duration for the particular task is immediately reflected on the GANTT chart.

Click on the report tab to run reports of various type like Pivot, Workload, Timesheet and Audit.

Features

• Task filters
• Milestones
• Timeline & Time tracking
• Calendar
• Graphs & GANTT charts (Ajax based)
• Drag & Drop organizing
• Notes & Comments
• Reports
• CSV Export
• Group chat / transcripts
• Instant messaging
• Email alerts
• RSS & iCal feeds
• File storage (for screenshots)
• Private Forum & Wiki for collaboration

Go to

Quick look at dapper

Video 1 :

Video 2 :

You can set variable inputs to customize your feeds as shown below.

Alerts can also be set so that a specified action (like notification by email) is performed when the value in the variable input matches the value specified by us.

Dapperfox – Firefox Extension

DapperFox is a Firefox extension that sits next to the RSS icon in your browser.
Whenever you visit a website DapperFox will show you RSS feeds that other people have created, as well as allow you to create a new feed to share with the community. This is perfect when a site does not have its own RSS feed, or when the default feed settings are not convincing enough.

Advantages

1. Access info from two sites simultaneously
2. Light version of the site in the sidebar loads quicker
3. Updates from our favorite sites are never missed

The below mentioned sites can be added to the firefox sidebar by

1. Right click the bookmark link
2. Select ‘Bookmark This Link’
3. Goto Bookmarks Menu
4. Right Click the Bookmark
5. Select bookmark ‘Properties’
6. Check ‘Load this bookmark in sidebar’.

Firefox Sidebar Sites

Remember The Milk – (Add/Edit/View tasks from RTM)

Google Reader – (Access latest feeds added in google reader)

Google Notebook – (Access the jotted information easily, also add notes quickly)

Google Calendar – (Browse through your appoinments and events)

Gmail – (Keep you gmail open always )

Gtalk – (Communicate while you browse)

Zoho Office – (Access your Zoho repository quickly)

Dictionary – (Get definitions for any word from the sidebar)

Wikipedia – (Encyclopedia in the firefox sidebar!)

Delicious – (Access and search your bookmarks and tags, Change the ‘username’ param in the URL)

Digg – (Keep an eye on what world is doing)

Facebook – (Stay connected with your network)

Twitter – (Send tweets quickly)

Ping.fm – (Send pings to multiple social network)

Meebo – (Ultimate messeger)

Youtube – (Search videos from your sidebar. Note: clicking the links will open the sites in your current open tab)

Google Mobilizer – (Browse any website in the sidebar)

Note: Some of the sidebar (mobile version) of the site mentioned above will not provide you the full functionality when compared to the actual one. Clicking the links might open the page in your current open tab rather than in the sidebar.

Note2: Use backspace key to go back in case if you dont find the back button in the sidebar site.

A script is added to our outlook client which automatically pops up the alert as shown below.

The following script can be embedded in Outlook so that we get an alert whenever we miss the subject or the attachments

Code

Private Sub Application_ItemSend(ByVal Item As Object, cancel As Boolean)
 
Dim strSubject As String
strSubject = Item.Subject
If Len(Trim(strSubject)) = 0 Then
    Prompt$ = "Subject is Empty. Are you sure you want to send the Mail?"
    If MsgBox(Prompt$, vbYesNo + vbQuestion + vbMsgBoxSetForeground, "Subject is Empty") = vbNo Then
            cancel = True
    End If
End If
 
Dim lngres As Long
If (InStr(1, UCase(Item.Body), "ATTACH") <> 0 Or InStr(1, UCase(Item.Body), "PFA") <> 0) Then
    If Item.Attachments.Count = 0 Then
        lngres = MsgBox("Attachment reference detected, but no files attached. Send anyway?", _
        vbYesNo + vbDefaultButton2 + vbQuestion, "No files Attached")
 
        If lngres = vbNo Then cancel = True
    End If
End If
 
End Sub

Installation

1. Open Outlook and Alt-F11 to open Visual Basic Editor
2. Copy this code to ThisOutlookSession

Send the ‘URL’ of the requested page in the subject and mail to ‘browse@webmail.com’. This service sends the requested webpage offline through email,not just that, it can even send us the google search results page for the search queried for. It also sends you the results of the google image searches as well. Just change the subject of the mail from ‘url’ to ‘google:query’, ‘googleimg:query’ & ‘rediff:query’ and send it to ‘browse@webinmail.com’

This is a simpler version of the previous mentioned service. Send a mail to ‘www@web2mail.com’ with subject as requested url.

Cheat Sheet

Subject- <URL>
To- www@web2mail.com

Subject- <URL>
To- browse@webinmail.com

Subject- google:query
To- browse@webinmail.com

Subject- googleimg:query
To- browse@webinmail.com

Subject- rediff:query
To- browse@webinmail.com