|
I had stumbled upon a simple text file that contained all the data harvested from the fraudulent phishing site.
The data were not encrypted or password-protected. They could be downloaded and viewed by anyone, anywhere in the world. The long trans-global path from my computer to this host computer in Canada made that very clear.
What if some of the data in the file were genuine? Those data could be used by unscrupulous persons to perpetrate fraud, to perform identity theft.
Clearly, I had to take some action to try to prevent this from happening.
I couldn't delete the file. I don't have the skills or knowledge to do that, although I must admit I tried to figure out a way. My programmer friends have confirmed that the file couldn't be deleted, except by the owner of the PC or the phishers. But it could be read.
I couldn't contact the owner of the zombie host, to get them to remove the materials, because the host computer was not registered and there was no public contact info for it.
I notified Bank of America of the phishing web site, through BofA's web site and also by forwarding the original phishing email to BofA's abuse address.
But, by then, it was early Saturday morning. BofA was unlikely to take any action against the hacked web servers over the weekend.
In all probability, the phishing site would continue to exist for some time. And people would continue to enter personal data into the data file. This bothered me.
Sure enough, the site continued to harvest data through the weekend.
Finally, on Sunday January 14th, I decided to download a copy of the data file. I decided to figure out a way to use the contact information in the file, to warn people who may have entered sensitive data.
|
|
