http://58.254.17.20 - "US Bank"

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Jul 20, 2009 8:03 pm

Received mail linking to this site, claiming it is a bank known as "US Bank" (I'm not sure if it exists.)

Mail:

Quote:

We noticed one or more login attempts from a foreign IP address .

Log In now to resolve the problem.

The last line links to this address: http://58.254.17.20/manual/misc/usbank/USB/internetBanking/CmdId/

E-mail Header:

Quote:

Delivered-To: [email protected]
Received: by 10.86.68.9 with SMTP id q9cs188630fga;
Mon, 20 Jul 2009 03:08:15 -0700 (PDT)
Received: by 10.210.53.1 with SMTP id b1mr3401453eba.62.1248084494709;
Mon, 20 Jul 2009 03:08:14 -0700 (PDT)
Return-Path: <[email protected]>
Received: from geostroy-mos.ru ([195.135.239.227])
by mx.google.com with ESMTP id 12si9113470ewy.31.2009.07.20.03.08.11;
Mon, 20 Jul 2009 03:08:14 -0700 (PDT)
Received-SPF: neutral (google.com: 195.135.239.227 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=195.135.239.227;
Authentication-Results: mx.google.com; spf=neutral (google.com: 195.135.239.227 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Message-Id: <[email protected]>
Received: from User ([195.22.0.137])
(authenticated user [email protected])
by geostroy-mos.ru (Kerio MailServer 6.7.0 patch 1);
Mon, 20 Jul 2009 14:07:29 +0400
From: "US Bank"<[email protected]>
Subject: US Bank alert
Date: Sun, 19 Jul 2009 13:08:07 +0300
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

IP of e-mail sender resolves to:

Quote:

Moscow, Russian Federation
ISP = M9.com network
Organization: = M9.com network

Whois:

Quote:

inetnum: 58.254.17.16 - 58.254.17.23
netname: Cike-Telecom
country: CN
descr: Cike-Telecom ,HeYuan , Guangdong province
admin-c: CG272-AP
tech-c: CG272-AP
status: ASSIGNED NON-PORTABLE
changed: 20070803
mnt-by: MAINT-CNCGROUP-GD
source: APNIC

route: 58.252.0.0/14
descr: CNC Group CHINA169 Guangdong Province Network
country: CN
origin: AS17816
mnt-by: MAINT-CNCGROUP-RR
changed: 20070301
source: APNIC

role: CNCGROUP GD
nic-hdl: CG272-AP
e-mail:
address: XinShiKong Plaza,No 666 Huangpu Rd. Guangzhou 510627,China
phone: +86-20-22214226
fax-no: +86-20-22214228
admin-c: RP181-AP
tech-c: RP181-AP
country: CN
changed: 20090414
mnt-by: MAINT-CNCGROUP-GD
source: APNIC

That's all I can find for the moment. Maybe someone who knows how to do this should carry on with getting it closed.

Posted: Mon Jul 20, 2009 8:43 pm

This looks like a phishing email and site to me. We don't deal with phishing here. The best place to report phishing is to the bank itself.

https://www.usbank.com/cgi_w/cfm/about/online_security/online_fraud.cfm

Quote:

Report Fraud
If you are a U.S. Bank customer and receive a suspicious email that references U. S. Bank, forward it immediately to [email protected].

Thanks for keeping an eye out! Very Happy

Posted: Mon Jul 20, 2009 11:09 pm

Thanks for your help BB, Could someone else maybe follow through on this one? I really have no experience doing this, neither am I a customer with the bank, so I would really appreciate it if someone else would take it.

Thanks.

Posted: Tue Jul 21, 2009 6:11 pm

Just to bump this one up a little. As I said, it would be really nice if someone a little more experienced could take over the reporting and killing of this site.

Posted: Tue Jul 21, 2009 10:49 pm

Hey Arctic! Very Happy

We don't kill phishing sites here. The best thing you could do is send the email you received with the full headers to the bank's email address for fraud that I listed above. I wouldn't worry about whether you're a customer or not.

Posted: Wed Jul 22, 2009 11:54 am

Hi Artic, You can send a copy of the phishing email to: [email protected]

Quote:

US-CERT is collecting phishing email messages and web site locations so that we can help people avoid becoming victims of phishing scams.

You can report phishing to us by sending email to [email protected]

Posted: Wed Jul 22, 2009 5:26 pm

Alright HarvestMoon, will do.

Baiting Guru Joined: 03 May 2007 Posts: 18313

Moved to Misc. Scams.

http://58.254.17.20 - "US Bank"	View next topic View previous topic