24th September 2004

Citibank

Citi <identdep_op66436370112026@citibank.com>

Citibank - Security Update, Please Read

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://212.68.199.178:87/cit/

disguised as an image in the body of the email.

Traced to a server in Brussels, Belgium.

1. Email requests victim help upgrade their Citibank account by visiting link and entering details. Any details entered on the spoof page are just captured and forwarded to a local script.

2. Citibank never send users emails requesting details in this way.

3. The spoof page is loaded as a popup in front of the genuine Citibank homepage making it appear much more authentic.

4. Another giveaway is that the email is just an image with the text in it. This is a technique used by scammers to hide the text of the email from spam filters.