natwest.com

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Wannabe Baiter Joined: 08 Dec 2005 Posts: 92

Redirect to a fake log in page for a actual bank.

Quote:

Delivered-To:
Received: by 10.42.173.9 with SMTP id p9cs68085icz;
Sun, 15 May 2011 16:27:04 -0700 (PDT)
Received: by 10.224.218.74 with SMTP id hp10mr2938911qab.47.1305502023678;
Sun, 15 May 2011 16:27:03 -0700 (PDT)
Return-Path: <[email protected]>
Received: from server1.3unohosting.com (server1.3unohosting.com [64.34.171.85])
by mx.google.com with ESMTPS id p13si8748673qcu.94.2011.05.15.16.27.03
(version=TLSv1/SSLv3 cipher=OTHER);
Sun, 15 May 2011 16:27:03 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 64.34.171.85 as permitted sender) client-ip=64.34.171.85;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 64.34.171.85 as permitted sender) [email protected]
Received: from nobody by server1.3unohosting.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1QLkiF-0003D9-6a
for ; Sun, 15 May 2011 18:27:03 -0500
To:
Subject: Verification Of Your Identity !!!
From: NatWest Bank <[email protected]>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Sun, 15 May 2011 18:27:03 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.3unohosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - server1.3unohosting.com

<img alt="NatWest logo" src="http://www.natwest.com/images/logo.gif" width="150" height="30"></a> <img alt=" " src="http://www.natwest.com/images/ico_branch.gif" width="37" height="35">
<div id="strapline"> <a rel="nofollow" target="_blank" href="http://www.natwest.com/personal02.asp?id=PERSONAL/SAVE_AND_INVEST/SAVINGS_ACCOUNTS/LONGER_TERM/1YR_FIXED_RATE_BOND&referrer=hpbFRBLHS"><img alt="Good morning and welcome to NatWest" src="https://www.nwolb.com/brands/NWB/images/strapline_hb.gif" width="176" height="77"></a></div></div>
<div id="home">
<div id="boxType2b"> </div>
<div>Dear <span class="yshortcuts" id="lw_1251882358_0">Natwest Bank Customer</span>:<br><br><span style="font-size: 10pt; font-family: Verdana;">It has come to our attention that
your account billing updates are out of order. If you could please take 5-10
minutes out of your online experience and update your billing records you will
not run into any future problems with the online service. However, failure to
update your records will result in account termination. Please update your
records as soon as possible.</span><span style="font-size: 10pt; font-family: Verdana;">If you are the rightful holder of
the account you must <b>click the link below</b> and then complete all steps
from the following page as we try to verify your identity.</span></div>

<div id="combos">
<form target="_blank" name="day2day" onsubmit="return theMainWindow.showFormWarning(this)" method="post">
<div class="combo" id="combo1">
<div>
<p><span style="font-size: 10pt; font-family: Verdana;"><a rel="nofollow" target="_blank" href="http://highpayingniches.com/STUDENTLOAN-CONSOLIDATION-RATES.INFO/wp-content/uploads/c5hmy/natwest/natwest/Login.php">www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html</a></span></p>
<p><span style="font-size: 10pt; font-family: Verdana;">If you choose to ignore
our request, you leave us no choise but to temporaly suspend your
account.</span></p>
<p>Regards<br><font size="1"><font size="3"><span class="yshortcuts" id="lw_1251882358_1">Natwest Bank</span></font></font>,</p>
<p>Updating Department.</p>
<p><font color="#ba102c">We will <strong>never</strong> contact customers via
email asking to supply any confidential information, telephone or <span class="yshortcuts" id="lw_1251882358_2">internet
banking</span> login details via email that is why we want you to verify your account
by our internet automated machine.</font></p></div></div>

it shows up as following in the mail, and clicking the link : www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html , redirect it to the following address: http://highpayingniches.com/STUDENTLOAN-CONSOLIDATION-RATES.INFO/wp-content/uploads/c5hmy/natwest/natwest/Login.php which is the fake log in page

Quote:

NatWest logo
Good morning and welcome to NatWest
Dear Natwest Bank Customer:

It has come to our attention that your account billing updates are out of order. If you could please take 5-10 minutes out of your online experience and update your billing records you will not run into any future problems with the online service. However, failure to update your records will result in account termination. Please update your records as soon as possible.If you are the rightful holder of the account you must click the link below and then complete all steps from the following page as we try to verify your identity.

www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html

If you choose to ignore our request, you leave us no choise but to temporaly suspend your account.

Regards
Natwest Bank,

Updating Department.

We will never contact customers via email asking to supply any confidential information, telephone or internet banking login details via email that is why we want you to verify your account by our internet automated machine.
Legal| Privacy| Security|Affiliates| Media| About us| Glossary

the domain hosting the fake log in page is registered to some one in Pakistan

Quote:

WHOIS information for highpayingniches.com :

[Querying whois.verisign-grs.com]
[Redirected to whois.PublicDomainRegistry.com]
[Querying whois.PublicDomainRegistry.com]
[whois.PublicDomainRegistry.com]
Registration Service Provided By: UA COMMUNICATION
Contact: +092.2138285769
Website: http://www.uacommunication.com

Domain Name: HIGHPAYINGNICHES.COM

Registrant:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Creation Date: 02-Jul-2010
Expiration Date: 02-Jul-2011

Domain servers in listed order:
ns23.uacommunication.com
ns24.uacommunication.com

Administrative Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Technical Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Billing Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Status:LOCKED
Note: This Domain Name is currently Locked. In this status the domain
name cannot be transferred, hijacked, or modified. The Owner of this
domain name can easily change this status from their control panel.
This feature is provided as a security measure against fraudulent domain name hijacking.

screen cap of the fake log in:

Uploaded with ImageShack.us

Posted: Mon May 16, 2011 6:07 pm

^^^^ This was a phishing page and we do not handle these here in the fake bank forum.
The natural life span of a phishing page is less than 24 hrs and this one has already been taken down.

The link now forwards to the legit site.

Setting to n/a

Baiting Guru Joined: 03 May 2007 Posts: 18313

Moved here from the fake sites forum.

This one is already dead but just FYI, the best way to deal with phishing pages is to report them to the real business being impersonated and here: http://www.antiphishing.org/

For info on the difference between fake sites used for fraud and phishing, please see this info: http://forum.419eater.com/forum/viewtopic.php?p=720553#720553

Not quite a Newb Joined: 25 Nov 2012 Posts: 57

The link is back up

https://www.nwolb.com/

Just to know.

Edit: scratched out the question that is already answered in the post above...