cancel
Showing results for 
Search instead for 
Did you mean: 
jameskb
Level 7

Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

I just received an email that appears to be from McAfee (I have my doubts) with the subject of: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected.  It says something about the FBI shutting down servers.. etc.....  The message contains a link to a zip file named: http://67.97.80.71/images/dnschanger-stinger.zip and instructs one to open the zip and run the application it contains. This sounds a bit strange to me.  Is this really from McAfee?? 

mcafee01.png

mcafee02.png

Thanks for your time.

--

JamesKB

0 Kudos
7 Replies
exbrit
Level 21

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

It would appear so.  I assume you belong to some mailing list or your product includes newsletters perhaps?

See this blog for more information:  http://blogs.mcafee.com/consumer/consumer-threat-alerts/internet-users-take-these-actions

0 Kudos
Hayton
Level 18

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

I haven't seen this email, and I'm signed up for most of what's going. It looks authentic but that doesn't mean a thing.

As a general rule, don't follow any link that includes in it a hard-coded IP address. If you're curious, use one of the available IP-checkers to get information on the site associated with the address.

Using one of those tools gives the following results for 67.97.80.71 :

Location for IP 67.97.80.71.png

Check for yourself at http://ip2geolocation.com/?ip=67.97.80.71&lang=en

Clicking on the URL starts the download process immediately, with the address bar showing the source as "strongmail.mcafee.com". I rate this then as 95% safe. I don't like the indirection and lack of clarity. Why not just put it on the website and give a link to that?

Why on earth McAfee are giving out a link to a download with a URL that only has an IP address to identify it is beyond me. It may be safe, but it doesn't look safe.

For information on the DNSChanger cutoff and background to the story see the thread at https://community.mcafee.com/message/246405#246405, which refers back to earlier threads about the story.

Message was edited by: Hayton - fix typos -  on 07/07/12 16:21:09 IST

Message was edited by: Hayton - modify thread link -  on 08/07/12 18:20:22 IST
0 Kudos
exbrit
Level 21

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

There is such a version of Stinger however...took me a while to find it though as it isn't listed in the usual place.   It's mentioned in that blog I posted.

0 Kudos
Hayton
Level 18

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

Agreed. The email is a mailshot of the blog, but it would have been better if the email had provided a link to that page on the McAfee website and let anyone who wanted to download the tool do it from there. And on the subject of Consumer blogs, there really should be a link to that section in the Useful Links dropdown menu.

0 Kudos
exbrit
Level 21

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

I agree with you totally.   Suggestion for the call perhaps?

0 Kudos
Peacekeeper
Level 20

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

Yes please do that would freak some users out. james you were correct to be cautious I to do not like having an Ip in the address

Message was edited by: Peacekeeper on 8/07/12 2:21:17 PM
0 Kudos
exbrit
Level 21

Re: Consumer Threat Alerts: Take These Actions Before July 9 To Ensure You’ll Stay Connected???

JamesKB I've made this a topic for our conference call with McAfee staff on Monday afternoon.    Hopefully it'll make them think twice before including doubtful-looking links in emails, blogs and bulletins in future.

Thanks for pointing it out.

.

Message was edited by: Ex_Brit on 07/07/12 5:42:28 EDT PM
0 Kudos