Intelligence Note

Prepared by the Internet Crime Complaint Center (IC3)

November 22, 2005

Fraudulent FBI e-mail alert

The FBI continues to see reports of e-mail hoaxes claiming to be from the FBI.

The new e-mail hoax is similar to the warning posted on the IC3 website on 2/23/2005. The current e-mail appears to be sent from the e-mail addresses and The e-mail message contains a malicious computer program (malware) in the form of a file attachment. The malware is packed within a ZIP file to prevent detection by anti-virus software. In order to become infected the user must first open the ZIP file and execute the program inside. The attachment has been identified as a variant of the W32/sober virus.

This hoax e-mail contains the following text:

Dear Sir/Madam,

We have logged your IP address on more than 30 illegal Websites. Important: Please answer our questions! The list of questions are attached.

Yours faithfully,
Steven Allison
Federal Bureau of Investigation - FBI
935 Pennsylvania Avenue, NW, Room 3220
Washington, DC 20535
Phone: (202) 324-3000

This e-mail is a hoax. Do not download the attachment associated with this e-mail. If you receive this e-mail or an e-mail similar to this, delete the message and do not open the attachment.