Fake Facebook “Facebook Password Reset Confirmation” Phishing Messages on the Rise, Bearing Viruses  
by Anne P. Mitchell, Esq. (friend Anne on Facebook! facebook-f-blue ) - 3 Comments, Last updated 05/21/2013 - 16,182 views

Summary: If you get an email supposedly from Facebook (top addresses have been change@facebook.com and support@facebook.com) , asking for a "Facebook Password Reset Confirmation", don't panic thinking that someone has reset your Facebook password (that's exactly what the bad guys want you to do), and whatever you do don't download or open the attachment that is in the email! The attachment, named either facebook_password_139.zip or facebook_password_239.zip, is actually a Windows malware file, facebook_password_139.exe or facebook_password_239.exe.

Most Recent Searches that Led to This Page: Resent confirmation SMS, zshare - fake facebook zip, facebook password reset code text message, Facebook Password Reset Code Text, universal facebook password reset code, Insert the confirmation code from the SMS instead, fake facebook password reset text message, facebook password reset text, reset confirmation sms, ?Resent confirmation SMS, ?Resent confirmation SMS ?, text message facebook password reset code, universal facebook confirmation code, Fake facebook password reset code, fake confirmation code


Previous Article « Chatroulette Exposed – Russian Roulette Video Chat Site with Pervs Instead of Bullets in the Chamber
Read Next Article » Facebook Linked to Venereal Disease (Yes, Really)

If you get an email supposedly from Facebook (top addresses have been change at facebook dot com and support at facebook dot com) , asking for a “Facebook Password Reset Confirmation”, don’t panic thinking that someone has reset your Facebook password (that’s exactly what the bad guys want you to do), and whatever you do don’t download or open the attachment that is in the email! The attachment, named either facebook_password_139.zip or facebook_password_239.zip, is actually a Windows malware file, facebook_password_139.exe or facebook_password_239.exe.

Here’s how the email looks in the typical email program:

From: “Facebook Security” (change@facebook .com)
To: (test@example .com)
Subject: Facebook Password Reset Confirmation! Important Message
Attachments: Facebook_password_139.zip

Dear user of facebook,

Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.

Thanks,
Your Facebook.

But check out what the headers of this email reveal:

Date: Tue, 23 Mar 2010 08:13:04 -0600
From: “Facebook Security”
MIME-Version: 1.0
Message-ID: <000d01caca8a$923f4cc0$6400a8c0@myopicsv>
Received: from 173.213.163.99; Tue, 23 Mar 2010 08:13:04 -0600
To:
X-Mailer: Microsoft Outlook Express 5.50.4927.1200
X-Mimeole: Produced By Microsoft MimeOLE V5.50.4927.1200
X-Msmail-Priority: Normal
Date: Tue, 23 Mar 2010 08:13:04 -0600
From: “Facebook Security” (change@facebook .com)
To: test@example .com
Subject: Facebook Password Reset Confirmation! Important Message
Attachments: Facebook_password_139.zip

—

Do you see that “Received: from 173.213.163.99″? That’s actually a DSL line with iowatelecom.net (the complete address associated with this IP address is “mnpl-01-0867.dsl.iowatelecom.net”). Obviously Facebook isn’t sending email from a regional ISP in Iowa. And do you see that “X-Mailer: Microsoft Outlook Express 5.50.4927.1200″? Facebook doesn’t use Outlook Express to send email to their subscribers, either. (In fact, Facebook sends out their email from a cluster of IP addresses serviced by their own in-house domain, tfbnw.net, and they use the Ecelerity mailing software.)

So, almost certainly, one of two things is going on here. Either there is an evil malware spammer sitting somewhere in Iowa Telecom’s service area, sending out malware using Outlook Express; or some poor schmuck’s PC has been co-opted as part of a botnet, which is now spewing malware while being controlled by some botnet herder overseas. It’s most likely the latter, but what’s important for you is to know how to recognize this email for what it is, and to not open it.

 


Previous Article « Chatroulette Exposed – Russian Roulette Video Chat Site with Pervs Instead of Bullets in the Chamber
Read Next Article » Facebook Linked to Venereal Disease (Yes, Really)

You May Also Like:

The “Facebook Password Reset Confirmation” Scam

Twitter Password Reset Email Not Necessarily Phishing But Decidedly Clueless

Use Facebook and Gmail? Your Gmail Password May be at Risk!

Microsoft Offers Outlook Bundled with Paid Email Service

Windows Media and Outlook Express Both at High Risk

For additional similar stories check out our archives on Facebook, Phishing, Virus & AntiVirus

 

3 Comments - Newest First »

  1. my code is still not been accepted which is apain as i am unable to access facebook and i need to get look in my spam folder

    Comment by sarah — 11/24/2010 @ 3:54 pm

  2. how do i get a conformation number I forgot my pass word

    Comment by jessutcliffe — 7/29/2010 @ 6:22 am

  3. That’s interesting, given the fact that when my wife went to go on FaceBook this morning, she was stopped and asked for her password, which the “website” would not accept.
    This was not an email, but one of her multi-tabs which open when she activates FireFox. She called me over and I attempted to watch, then insert her password, but “OK” would not do anything until it went “dormant”.
    She finally shut down FF and re-started it, … FaceBook came up regularly.
    Wonder what that was. I’m running IOBit on it to see if it’s OK by their standards.
    Thanks!
    Ted

    Comment by Ted — 3/26/2010 @ 11:23 am

Leave a comment

Line and paragraph breaks are automatic, your email address is never displayed.

(required)

(required)


You will only have to do this the first time you post:
Enable this image please
 I see:
- +
- +
- +
Ironclad CAPTCHA (Security Stronghold)

 

NOTE: We never, ever, ever will recommend any product or service on this site that we have not regularly used ourselves and do not wholeheartedly believe in. In some cases, after being very pleased with a product or service, we may enter into a relationship with the provider of that product or service such that if someone purchases that product or service based on our recommendation, we may get a small payment. Such payments go towards the upkeep of the Internet Patrol. All that said, ads by Google are not our recommendations, and are selected and served by Google, and we do not control what those ads display.