full-disclosure - Huge amounts of Citipank phishing spam seen this weekend.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: dhill+fulldisc at cricalix.net (Duncan Hill)
Subject: Huge amounts of Citipank phishing spam seen this weekend.

On Monday 05 July 2004 12:15, Feher Tamas might have typed:

> <b>Dear Citibank Customer</b>,
> <p> We recently noticed one or more attempts to log in to
> your Citibank<br=

> <p><i>The login attempt was made from:<br>
>   IP address: 173.97.087.24<br>
>   ISP Host: cache-89.proxyserver.cis.com</i></p>
> <p> By now, we used many techniques to verify the accuracy

>   whom you are dealing with. The system is called CitiSafe
> and it's<br>
>   the most secure Citibank wallet so far.</p>

That's a pretty nice bit of dumb-user engineering.  Couple of spelling 
mistakes in the actual phishing pages (wget + less = wonderful), but 
otherwise quite well crafted.  I'd swear I even see a browser URL overlay or 
similar to give the impression of a different site to the real one.