Citizen Bank = Grand Rapids, MI, US

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Oct 21, 2011 12:15 pm

Citizens Bank Security UpdateFriday, October 21, 2011 4:36 AMFrom Citizens Bank Fri Oct 21 02:36:17 2011
X-Apparently-To: via 67.195.15.102; Fri, 21 Oct 2011 02:36:54 -0700
Return-Path: <[email protected]>
Received-SPF: fail (domain of citizensbankonline.com does not designate 206.114.51.46 as permitted sender) IHNldmVyYWwgIGZhaWxlZCBhdHRlbXB0cyB0byBhY2Nlc3MgeW91ciBDaXRp emVucyBCYW5rIApBY2NvdW50LCBXZSB0ZW1wb3JhcnkgZGVhY3RpdmF0ZWQg eW91ciBhY2NvdW50IGZvciB5b3VyIApwcm90ZWN0aW9uLiBZb3UgaGF2ZSB0 byByZWFjdGl2YXRlIHlvdXIgQ2l0aXplbnMgQmFuayBBY2NvdW50IAp3aXRo aW4gdGhlIG5leHQgMjQgSG91cnMgaW4gb3JkZXIgdG8gY29udGludWUBMAEB AQE-
X-YMailISG: FSXbP5UWLDsnqMCuFE.tTNcoZhTehA_ihattf_NP676cWF5n IVgFtvnmBLnf6Wmbo85IVZGrVApdZOhVOHA1sckbxiCqjPORgceTEyvIHANw 5iSjXusKy8RD_EEc9EGdcqemHN.fDdEc_gQ6mfdnMR6E8He3M14gbRxIrBL0 2LbHCJzCCyU05Cnv4mfKCjiCWWgSOjHyP3RFHKwXplblp1TbRXmRSl00rFUI bBE5VSK.9lGvyjC._eMZsVBUjPxqggef..ymYxIME9DKnBRQ5u9WCPFDpcvv NddwVXrDpmJOktu8lDJ5AQNSfRDDJdWd44jAe_kBCBOj1Jx.VyDf85.MS21T d2P4re5w6cOuynDXGpEAJo5zThKcutdyuQyoRQJESL9tRy7LEQrTSw9Wp78m X7D1rKDWgCI4.FmQfwnR3Iy.V5oPS.KYTbJh0cqzEOR8g2.OPvxeR8YxihSs NbQIm.Im0wSyyL3CkSZi07_2GW6De3wWbpsJL3ayVRQ9UtzgNMal87AIuzG. 8hkJEPRKlttT6P5QjwwKumPfnaQkaZEKA9CILaBMwvqcJ992uwkaEXV0cZmw AsrZrw0rh0cojqsXkf61SlPG2LVWmbLSw7hCDcK3QCmAoLX_LOu3gZlgEq62 mlhm_oWMh92i_G_27TV7oEYTXg5wIfdxcDAvCu.mSX9hk3zl7q_qZNsN2JQl .TdYtj8c9UaJDjqyy_.spO8AXSN67RBjwykszgfR5wdcH2IWI.Seac62dIQM P5mUPO_3UFTUDAM96oJ9.y.hL.UpGmpcZ37LBhvO9DVaUvNaQsXCffG0FB5g cS0iZtxBp7pfqjWzbcTCKRjnmOXJ4R9AMRd_aGYKUZl264EHsxvIm7csF67a HxKErnxNn_nnS8VTjudlUBxF_9z44B5FrQLlaNZnIwjE0yu4greD777AunG1 6KH387884DZUgkxOHy1V8yxYnWPzkSXx5wbg0MkGmOw.X3bwxf52EvZfxg7m aca73O3qJrKYGZcqWEAvQhTMGdigmYyimGor_rmXOiQ_jKUdHqL3
X-Originating-IP: [206.114.51.46]
Authentication-Results: mta1007.sbc.mail.mud.yahoo.com from=citizensbankonline.com; domainkeys=neutral (no sig); from=citizensbankonline.com; dkim=neutral (no sig)
Received: from 12.102.252.82 (EHLO alnwmxc02.att.net) (12.102.252.82) by mta1007.sbc.mail.mud.yahoo.com with SMTP; Fri, 21 Oct 2011 02:36:54 -0700
Received: from vmail9.iserv.net ([206.114.51.46]) by att.net (alnwmxc02) with SMTP id <20111021093654a0200mp2qpe>; Fri, 21 Oct 2011 09:36:54 +0000
X-Originating-IP: [206.114.51.46]
Received: (qmail 23362 invoked from network); 21 Oct 2011 09:36:21 -0000
Received: from Unknown (HELO User) (69.246.111.60) (smtp-auth username [email protected], mechanism login) by vmail9.mail.egl.net (qpsmtpd/0.32) with ESMTP; Fri, 21 Oct 2011 05:36:21 -0400
From: "Citizens Bank"<[email protected]> Add sender to Contacts
Subject: Citizens Bank Security Update
Date: Fri, 21 Oct 2011 05:36:17 -0400
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 1985

Compact Headers

Dear Citizens Bank Customer:
Due to several failed attempts to access your Citizens Bank Account, We temporary deactivated your account for your protection. You have to reactivate your Citizens Bank Account within the next 24 Hours in order to continue using it .
Please Click here to Reactive your account .
http://www.bergfrisch.com/Bilder/index.php

Sincerely,
Citizens Bank Customer Service
Code #CTB905242
©2011 Citizens Bank Limited.

Posted: Fri Oct 21, 2011 1:45 pm

Hi moonster. This looks to be phishing and not a fake bank. And we don't deal with phishing emails/sites typically.

To report this, send the email and header to the legitimate bank/company. They can deal with it much better (and usually faster) than we can. To find the email addy to send to, google the name of the bank/company and phish.

http://www.citizensbank.com/security/fraud.aspx

[email protected]

All that being said, the registrar of this phishing domain is Directi and we have a nice relationship with them. So I sent them a note to make them aware of this phish and I am sure it will be taken care of promptly.

This can be moved to Misc. Scams. Marking NA. Very Happy

Posted: Fri Oct 21, 2011 2:07 pm

And it has been killed. Very Happy

Quote:

Domain Name:INVERBRASS.IN
Created On:22-Aug-2011 06:49:50 UTC
Last Updated On:21-Oct-2011 13:48:06 UTC
Expiration Date:22-Aug-2012 06:49:50 UTC
Sponsoring Registrar:Directi Internet Solutions Pvt. Ltd. dba PublicDomainRegistry.com (R5-AFIN)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT HOLD
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED

Posted: Fri Oct 21, 2011 2:56 pm

In under an hour, I'm impressed bow_down

Posted: Fri Oct 21, 2011 3:09 pm

I ♥ Directi.

Citizen Bank = Grand Rapids, MI, US	View next topic View previous topic