For the record, "NACNA" is the Electronic Payments Association, and they have already issued a phishing alert about this here: http://nacha.org/news/newsDetail.cfm/Re ... NewsID/212.
Anyway, on a Mac, if you hover your cursor over the link, it will tell you the actual website address the link goes to, not the address you see in the text. So this was inviting me to "click here" to view some kind of report related to me. The link actually went to "http://ACH-XBLOG.INFO/" and so I decided to do some investigation.
First, I deliberately went to the website, and it tried to download an executable virus to my Mac. Fortunately, Macs aren't generally susceptible to this stuff (which is why I felt comfortable with doing this). Of course I refused the download.
Next, I did a "Who Is" search at Network Solutions to see who owns the domain and where it is hosted. Here are the results of that search. (I don't mind publishing the owner's information since it is A) public access at networksolutions.com, and B) he is a criminal!):
http://www.networksolutions.com/whois-s ... XBLOG.INFO
OK, so now I know that his domain is registered and hosted at Godaddy. So I give their 800 number a call, and navigate to their tech support and I get a guy in Arizona who's almost as mad about this as I am. He confirms that the website tries to infect the viewer's computer with a virus download. He has me forward a copy of the email to "abuse@godaddy.com" with a brief explanation. He immediately contacted their hosting department to scan the site and shut it down.Domain ID:D37249388-LRMS
Domain Name:ACH-XBLOG.INFO
Created On:17-Mar-2011 10:36:00 UTC
Last Updated On:17-Mar-2011 10:36:01 UTC
Expiration Date:17-Mar-2012 10:36:00 UTC
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:CR78125735
Registrant Name:Michael rebelo
Registrant Organization:
Registrant Street1:2 academy dr
Registrant Street2:
Registrant Street3:
Registrant City:Cumberland
Registrant State/Province:Rhode Island
Registrant Postal Code:02864
Registrant Country:US
Registrant Phone:+1.4016634334
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:vorelxgwk3715@yahoo.com
Admin ID:CR78125737
Admin Name:Michael rebelo
Admin Organization:
Admin Street1:2 academy dr
Admin Street2:
Admin Street3:
Admin City:Cumberland
Admin State/Province:Rhode Island
Admin Postal Code:02864
Admin Country:US
Admin Phone:+1.4016634334
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:vorelxgwk3715@yahoo.com
Billing ID:CR78125738
Billing Name:Michael rebelo
Billing Organization:
Billing Street1:2 academy dr
Billing Street2:
Billing Street3:
Billing City:Cumberland
Billing State/Province:Rhode Island
Billing Postal Code:02864
Billing Country:US
Billing Phone:+1.4016634334
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:vorelxgwk3715@yahoo.com
Tech ID:CR78125736
Tech Name:Michael rebelo
Tech Organization:
Tech Street1:2 academy dr
Tech Street2:
Tech Street3:
Tech City:Cumberland
Tech State/Province:Rhode Island
Tech Postal Code:02864
Tech Country:US
Tech Phone:+1.4016634334
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:vorelxgwk3715@yahoo.com
Name Server:NS69.DOMAINCONTROL.COM
Name Server:NS70.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Presumably, the address information will be forwarded to the Rhode Island authorities, and Michael Rebolo will get a knock on his door a little later this morning.
...or not. You never know how these things get handled once they are out of your hands, but I do have the satisfaction of knowing that I got an Internet criminal's website shut down.
