• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

YAES (email scam) T - Citibank scam

S

shekondar

Golden Member
Looks like there's another Citibank scam email going around...just got this in my inbox. At least this one LOOKS convincing...unlike some of the ones I've seen.

X-Apparently-To: xxxxxxx@xxxxxx.xxx via web80209.mail.yahoo.com; Sun, 11 Jan 2004 21:07:05 -0800
Return-Path: <orelia_stephane@aol.com>
Received: from vmd-ext.prodigy.net (207.115.63.89) by mta825.mail.sc5.yahoo.com with SMTP; Sun, 11 Jan 2004 21:07:04 -0800
X-Originating-IP: [140.98.193.23]
Received: from engine.ieee.org (listserv.ieee.org [140.98.193.23]) by vmd-ext.prodigy.net (8.12.10/8.12.10) with ESMTP id i0C5743C574708 for <xxxxxxx@xxxxxx.xxx>; Mon, 12 Jan 2004 00:07:04 -0500
Received: from hormel3.ieee.org (gemini4.ieee.org [140.98.193.189]) by engine.ieee.org (Switch-3.1.2/Switch-3.1.2) with ESMTP id i0C53NVk022884 for <xxxxxxx@xxxxxx.xxx>; Mon, 12 Jan 2004 00:03:23 -0500 (EST)
Received: from comcast.net (pcp04280205pcs.union01.nj.comcast.net [68.39.104.5]) by hormel3.ieee.org (Switch-3.1.2/Switch-3.1.0) with SMTP id i0C56lTR005456 for <xxxxxxx@xxxxxx.xxx>; Mon, 12 Jan 2004 00:07:01 -0500 (EST)
Received: from pcp04280205pcs.union01.nj.comcast.net (pcp04280205pcs.union01.nj.comcast.net [68.39.104.5]) by comcast.net (8.12.8p1/8.12.8) with ESMTP id czsge32792 for <xxxxxxx@xxxxxx.xxx>; Mon, 12 Jan 2004 05:12:55 -0400 (EST)
Date: Mon, 12 Jan 2004 05:12:53 -0400 (EST)
From: "Citibank" <citibank115369@aol.com>
X-Mailer: The Bat! (v1.61) Personal
Reply-to: Orelia_Stephane@aol.com
X-Priority: 3 (Normal)
Message-ID: <415784074.0424767471684@aol.com>
To: xxxxxxx@xxxxxx.xxx
Subject: Important Fraud Alert from Citibank
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------98581943621"
X-CanItPRO-Stream: xxxxxx redirected to 90_OPT_OUT
X-Scanned-By: IEEE UCE Filtering Service
Content-Length: 2493


Dear Citibank Account Holder,


On January 10th 2004 Citibank had to block some accounts in our system connected with money laundering, credit card fraud, terrorism and check fraud activity. The information in regards to those accounts has been passed to our correspondent banks, local, federal and international authorities.

Due to our extensive database operations some accounts may have been changed. We are asking our customers to check their checking and savings accounts if they are active or if their current balance is correct.

Citibank notifies all it's customers in cases of high fraud or criminal activity and asks you to check your account's balances. If you suspect or have found any fraud activity on your account please let us know by logging in at the link below.


https://citibank.com/signin/citifi/scripts/login2/login.htm
Click to expand...

The link (last line) goes to http://www.citibank.com@211.239.150.170/login/login.htm.

And no, I don't have any Citibank accounts.



 
I'm surprised they're not using the new IE exploit to hide the address better. Apparently the scammers aren't THAT smart. Looks like they relayed this through the IEEE.org server too. You think they'd have a secure mailserver at least.
 
Originally posted by: MrBond
I'm surprised they're not using the new IE exploit to hide the address better. Apparently the scammers aren't THAT smart. Looks like they relayed this through the IEEE.org server too. You think they'd have a secure mailserver at least.
Click to expand...
Actually, it's supposed to go through IEEE.org (I use their relay service)

 
Got another one today !!!

http://www.ssl-secure128.com/citibank-verify-account-57435-5645-3765/dirDllSSl856-4756-JkkLCiti-547864/newUse485-5754-575Hq35-56-SSL/cgi-bin/UserDllcity435-669996054-44/citibank-user-854394/Verify.htm


Domain name: SSL-SECURE128.COM
Created on: 2004-01-11
Updated on: 2004-01-11
Expires on: 2005-01-11
Registrant Name: DENNIS H THOMPSON
Contact: Dennis H Thompson
Registrant Address: 130 W Main Street
Registrant City: Woodville
Registrant Postal Code: 43469
Registrant Country: US
Administrative Contact Organization: Dennis H Thompson
Administrative Contact Name: Dennis H Thompson
Administrative Contact Address: 130 W Main Street
Administrative Contact City: Woodville
Administrative Contact Postal Code: 43469
Administrative Contact Country: US
Administrative Contact Email: wu@wutang.us
Administrative Contact Tel: +1 419 8492857
Administrative Contact Fax: +1 419 8492857
Technical Contact Organization: Technical Support
Technical Contact Name: Technical Support
Technical Contact Address: Via A Ponti, 6
Technical Contact City: Bergamo
Technical Contact Postal Code: 24126
Technical Contact Country: IT
Technical Contact Email: support@register.it
Technical Contact Phone: +39 035 3230400
Technical Contact Fax: +39 035 3230312
Primary Name Server Hostname: NS1.REGISTER.IT
Secondary Name Server Hostname: NS2.REGISTER.IT

Idiot left http://www.ssl-secure128.com unmod !
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top