Phishing: Online Banking Verification!

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Phishing: Online Banking Verification! Nov 29, 2012 12:44:52 GMT -5

Quote

Post by kas on Nov 29, 2012 12:44:52 GMT -5

Phishing email looking to gain access to bank accounts:

Subject: Online Banking Verification!
From: "TD Canada Trust" <account-verify@tdcanada.com>
Return-Path: <cabanyal.com@lilith.nodo50.org>
X-Originating-IP: [91.226.176.137]

Dear Customer

We undergo our periodic security maintenance and we noticed some of our customers did not enter
their accurate Challenge Questions and Answers during their Online Banking Enrolment.

Our system shows your account Challenge Questions and Answers were not completely enrolled. Due to this,
you are require to verify your Challenge questions and Answers to complete this security authentication section.

Click this CONTINUE button to Start this verification process.

WARNING: All information in this verification exercise are mandatory and failure to enter accurate information
will lead to online banking permanent deactivation.

Security Department.
TD Canada Trust

Link actually goes to hxxp://fasad.map43.ru/groceries/redir.php

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Phishing: Online Banking Verification! Dec 20, 2012 11:06:56 GMT -5

Quote

Post by kas on Dec 20, 2012 11:06:56 GMT -5

Another using the same template:

Security Alert
Saturday, December 8, 2012 2:32 PM
From: "TD Canada EasyWeb" <servicea@td.com>
X-Originating-IP: [62.61.152.81]

http://1.1.1.2/bmi/www.tdcanadatrust.com/includes/styles/fg-tdct-logo.gif

Dear Customer

Your EasyWeb access has been temporarily suspended, due to 3 unsuccessful login attempt on your account.

To Re-Activate, Follow the EasyWeb Logon Below and verify your account details.

Logon to EasyWeb

WARNING: All information in this verification exercise are mandatory and failure to enter accurate information
will lead to online banking permanent deactivation.

Security Department.
TD Canada Trust

** link goes to http://fasad.map43.ru/wp-includes/js/redir.php

*** Reported to the email listed on their site: www.td.com/privacy-and-security/privacy-and-security/report-online-fraud/reportfraud.jsp

Last Edit: Dec 20, 2012 11:14:59 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Phishing: Online Banking Verification! Dec 20, 2012 11:10:51 GMT -5

Quote

Post by kas on Dec 20, 2012 11:10:51 GMT -5

One for another bank:

Important Security Alert
Saturday, December 8, 2012 11:57 PM
From: "BMO Financial Group" <aelerts.service@bmo.com>
X-Originating-IP: [206.53.56.187]

https://www4.bmo.com/vgn/images/portal/SYSTEM%20%28Site%29_81/BMO%20FG%20%28Site%29_35330/PCCG%20%28Site%29_35383/1981413logo_eng.gif

Dear Customer

Your online banking has been temporarily suspended, due to three(3) unsuccessful login attempts on your account.
To uplift this suspension, Please click the option Below and enter your personal information correctly.

Click here to continue with Account RE-Activation

Failure to adhere to this notice within 24hrs, might lead to permanent deactivation of your online banking.

Security Advisor
BMO Online Banking

** Link goes to http://fasad.map43.ru/wp-admin/includes/redir.php

*** Forwarded to the email address listed on this page: www.bmo.com/home/popups/about/report-fraud

online.fraud@bmo.com

Last Edit: Dec 20, 2012 11:12:03 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Phishing: Online Banking Verification! Dec 20, 2012 11:21:05 GMT -5

Quote

Post by kas on Dec 20, 2012 11:21:05 GMT -5

Your online account needs resolution
Tuesday, December 18, 2012 9:03 AM
From: "TD Canada Trust" <accounts@tdcanadatrust.com>

Dear TD Canada Trust Online Banking,

You have 1 unread Security Message!

Click here to resolve the problem

Sincerely,
TD Canada Trust Online Banking Security Department Team.

TD Group Financial Services Site - Copyright © TD

** Link goes to http://www.vectorcvazi.ru/images/double/tdcanadatrust.com/tdcanadatrust.com/tdcanadatrust.com/tdcanadatrust.com/index.html

(nice address.. nothing like attempting to make it look legit if someone looks quickly)

Reported to phishing@td.com

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.

kas
Administrator

I no longer do indepth security inspections. Now this is more of a hobby I do in my spare time.

Posts: 783
Are you a spam fighter?: YES

Phishing: Online Banking Verification! Jun 10, 2013 10:54:33 GMT -5

Quote

Post by kas on Jun 10, 2013 10:54:33 GMT -5

Royal Bank Statement - Fraud email either infects your computer to get log in information or makes your computer a zombie computer:

Return-Path: <STATEMENT@rbcanada.com>
X-Originating-IP: [205.214.221.141]
Received: from [196.46.246.48] (account piratespavilion@tciway.tc HELO User) by cgpfe1.candwall.com

Dear Customer,

This is your Account Statement for MAY, 2013.

Click here to DOWNLOAD Your Statement.

Royal Bank of Canada.

The download link goes to an .exe file

NEVER CLICK ON EXE FILES IN ANY EMAILS!!!
(file name not to click on: hxxp://www.futiliti.com/wp-includes/rbcstatement.exe)

Sent to www.virustotal.com for a malware report and these 33 anit-virus programs reported it as malware:

BitDefender
Dr.Web
Websense ThreatSeeker

What each reported:
Dr.Web URL category
Known infection source

Websense ThreatSeeker URL category
Malicious Web Sites.

BitDefender domain information
The URL domain/host was seen to host badware at some point in time

Network location to IP address resolution
94.73.150.30 (Turkey)

Current status according to quttera.com/detailed_report/www.futiliti.com is that there is currently no malware. Additionally that url (the full one) results in a 404 not found error. It seems someone reported it before me and it got shut down so no need for me to report it again.

Attachments:

Last Edit: Jun 10, 2013 11:03:34 GMT -5 by kas

The only way to protect yourself is to arm yourself with knowledge. When you relax and expect others to protect you, they usually drop the ball. So this is why I do what I do.
.