Now here's a good social engineering phish

Just got this in my e-mail:

INTRODUCING UPGRADED ADOBE ACROBAT 2011

Dear Customers,

Adobe is pleased to announce new version upgrades for Adobe Acrobat 2011. http://www.2011-adobe-pdf-reader.org

Advanced features include:

- Collaborate across borders
- Create rich, polished PDF files from any application that prints
- Ensure visual fidelity
- Encrypt and share PDF files more securely
- Use the standard for document archival and exchange

To upgrade and enhance your work productivity today, go to:http://www.2011-adobe-pdf-reader.org

To leave comments, please contact us at: comments@2011-adobe-pdf-reader.org

Best regards,

Tom Norman
 
Adobe Acrobat Reader
Copy rights © Adobe Acrobat 2011 - All Rights Reserved
Website: http://www.2011-adobe-pdf-reader.org

Looks good, doesn't it?

Now, let's think a little critically.

I would expect contact from Adobe to come from adobe.com, not 2011-adobe-pdf-reader.org.  And how did they get my direct e-mail when to my knowledge to you never have to register to use Acrobat Reader?

A DNS lookup on 2011-adobe-pdf-reader.org shows:

Domain ID:D160899709-LROR
Domain Name:2011-ADOBE-PDF-READER.ORG
Created On:11-Dec-2010 08:34:29 UTC
Last Updated On:11-Dec-2010 08:34:39 UTC
Expiration Date:11-Dec-2011 08:34:29 UTC
Sponsoring Registrar:Regional Network Information Center, JSC dba RU-CENTER (R148-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Status:ADDPERIOD
Registrant ID:JQ3S5X0-RU
Registrant Name:Zeus Marketing Service
Registrant Organization:Zeus Marketing Service
Registrant Street1:MTC Media Unit GF 6B,Brown Street
Registrant Street2:
Registrant Street3:
Registrant City:Dundee
Registrant State/Province:
Registrant Postal Code:DD1 5EG
Registrant Country:GB
Registrant Phone:+44.1382206023
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:domain@adobe.com

 

Hmm, Zeus Marketing Service?  In Dundee, Great Britain?  Smells very fishy.  Interesting registrant e-mail, but you can enter anything there.

Let's go to the website and have a look.  You can do this safely.

http://www.2011-adobe-pdf-reader.org

Not bad, although the graphics are not quite Adobe corporate.  What's that you say?  Yes, the domain has changed - 2011-adobe-pdf-reader.org has redirected to new-2011-pdf-download.com !  Gee, all reference to both Adobe and Acrobat gone.  Let's have a little DNS lookup, shall we?

Domain name:             NEW-2011-PDF-DOWNLOAD.COM
Name Server:             ns10.dnsmadeeasy.com
Name Server:             ns11.dnsmadeeasy.com
Creation Date:           2010.11.23
Expiration Date:         2011.11.23

Status:                  DELEGATED

Registrant ID:           G2GSV3U-RU
Registrant Name:         Consesores De Importadores De Machina Independente
Registrant Organization: Consesores De Importadores De Machina Independente
Registrant Street1:      suite 310
Registrant City:         Panama City
Registrant Postal Code:  n/a
Registrant Country:      PA

Administrative, Technical Contact
Contact ID:              G2GSV3U-RU
Contact Name:            Consesores De Importadores De Machina Independente
Contact Organization:    Consesores De Importadores De Machina Independente
Contact Street1:         suite 310
Contact City:            Panama City
Contact Postal Code:     n/a
Contact Country:         PA
Contact Phone:           +1 507 5523371
Contact E-mail:          markpetersemail@gmail.com

Ah, now that's more like what we expected to find.  International wog-language registrant out of Panama with a fly-by-night $20 a year domain host and a throwaway gmail address.

Anybody wanna download it and see what it does?  I'll be patient waiting for the reply, you may need to reformat afterwards.  ;-)