SmartFeedSmartFeed          

Porsche Hangout


WELCOME - YOU ARE CURRENTLY VIEWING 419EATER AS A GUEST

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

ScamWarners.com - Internet Anti-Fraud Center - now open!


 Know what's scarey about this Royal Bank of Canada scam

View next topic
View previous topic
 
Post new topicReply to topic
Author Message
undertowz
Stooge


Joined: 13 Nov 2008
Posts: 283
Location: location location


PostPosted: Tue Jan 06, 2009 2:09 am Reply with quoteBack to top

This just landed in my catcher account and I'm not a RBC custie....BUT....any of the many grannies
and pedestrian users that are will read one line that will
scare the hair off their spaniel. The more I get into this cesspool
of online scamming human detritus the more ugly it gets.
As a baiter-with-heart I suppose I'll have to forward the email to
the fraud watchers at the RBC?????? That would be one small kick
at the cat and if I'm the real deal then I have to follow through????
n'est ce pas? ugh...
anyway...here's the pitch, complete with Royal Bank of Canada colours and logo:
Quote:

Your RBC Royal Bank eStatement is ready

Online Banking

Dear Royal Bank Member,

We'd like to inform you that your Message Center has 1 new message.
Please log in immediately and read the message. The Message Center
contains only important information about your account and online banking.

Please follow this link in order to read your message:
http://wuwuwu.rbc.com/online-services.htmlulul33ted

ME: OK HERE'S #1 WHAT'S SCAREY
Choosing to ignore this message will result in a temporary suspension of
your account within 24 hours, until you will choose to solve this unpleasant situation.

Sincerely,
Royal Bank of Canada Online Banking

Please do not reply to this e-mail. Mail sent to this address cannot be
answered.
To receive email notifications in plain text instead of HTML, update your
preferences.


#TWO What's scarey - that "RBC" link surprise surprise isn't hypertext.
You have to paste it in and it redirects to the IP address:
href="http://ip194-102-2OO9-87.adsl2.static.versatel.nl/user/.mrtg
/bin/online-services.html-l33ted The original mail was sent from
61.1OO.5.33 Korea, Republic of, Seoul. Grans reads the line saying
her account will be temporarily suspended and the
spaniel craps. She logs into the Dutch server and bangs in all her
numbers...ewwwww. She and the spaniel get clipped.

Being from Canada one gets to know how ultra conservo banks do things.
A Canuck bank would NEVVVER think of sending an email to warn a
customer that their acct will be suspended if they "ignore a [email]
message" . noooop never ever ever ---
add to this the wording is almost perfect - almost - until you hit the line
saying
Quote:
result in a temporary suspension of your account within 24 hours,
until you will choose to solve this unpleasant situation.


Not the Queen's English - "until you will solve"? nonsense...especially
from the Royal Bank. It would read "until you choose to solve" IF it was
an authentic RBC doc. Then
Quote:
this unpleasant situation

Can you imagine ANY bank referring to ANY banking matter as an "unpleasant situation"?

It could all be a groggy dream though. Ironic however, I'll run it past the
RBC security peeps using a catcher account because they'd likely think
I was in on the shite. caveat emptor

well blow my lips off

_________________

D3rrick Blar3 M7CN - 2414 boxes, 68 refreshments, 2 months
"we want to avoid the puzzle thing again because it was really hard for my assistant to do it. And also it takes a lot of time"

Lords0n K0phy
"The method of playing scrabble to generate M7CN cannot be accepted by this company"
"How can Western Union ask a custormer whether he or she has been in witch craft and voodoo"

TOM SL0C0CK:
"After receiving your ID thou it was not that visable but with the use of our ultra-veiw mechain we can see the registration number"

3 oinks Closed lad accounts + I r.i.p'd 2 httpz
View user's profileSend private messageVisit poster's website
JumpinJayJay
The One-Eyed Ogre


Joined: 25 May 2007
Posts: 1761
Location: 'Straya


PostPosted: Tue Jan 06, 2009 2:24 am Reply with quoteBack to top

repost in the fake bank forum to get the site killed Smile then granny and her spaniel don't have to worry Wink

_________________
Site Killing forum.
United States Spain Ivory Coast United Kingdom x24 Nigeria x3 Malaysia x2 Canada Closed lad accounts x30
Safari Lover Boy Joe - Accra to Cotonou
Click here to support 419Eater.com pony pony
Mortar x5 Nurse Nastys Audi TT
View user's profileSend private message
Tsnerd
Not quite a Newb


Joined: 14 Jul 2005
Posts: 41


PostPosted: Tue Jan 06, 2009 2:31 am Reply with quoteBack to top

Quote:
repost in the fake bank forum


Please don't. Very Happy

It's a phishing email. We don't do anything with those.

Just delete it or report it to the RBC.

For helpful info as to which sites are for the FB, please read, starting here:
http://forum.419eater.com/forum/viewtopic.php?p=598185#598185

_________________

Fakers: many, many, lots; an SSL and a couple of Resellers.
Mortar x 6
AH, AH, AH! Two little !
View user's profileSend private message
JumpinJayJay
The One-Eyed Ogre


Joined: 25 May 2007
Posts: 1761
Location: 'Straya


PostPosted: Tue Jan 06, 2009 3:13 am Reply with quoteBack to top

heh I stand corrected, thanks TS Smile

_________________
Site Killing forum.
United States Spain Ivory Coast United Kingdom x24 Nigeria x3 Malaysia x2 Canada Closed lad accounts x30
Safari Lover Boy Joe - Accra to Cotonou
Click here to support 419Eater.com pony pony
Mortar x5 Nurse Nastys Audi TT
View user's profileSend private message
undertowz
Stooge


Joined: 13 Nov 2008
Posts: 283
Location: location location


PostPosted: Tue Jan 06, 2009 4:10 am Reply with quoteBack to top

ts wrote
Quote:
report it to the RBC.


holy sheeot, not news I guess I'll google potential crap b4
I post must be 4 jillion for RBC alone

fwd'd it to their security thingie
live n learn

_________________

D3rrick Blar3 M7CN - 2414 boxes, 68 refreshments, 2 months
"we want to avoid the puzzle thing again because it was really hard for my assistant to do it. And also it takes a lot of time"

Lords0n K0phy
"The method of playing scrabble to generate M7CN cannot be accepted by this company"
"How can Western Union ask a custormer whether he or she has been in witch craft and voodoo"

TOM SL0C0CK:
"After receiving your ID thou it was not that visable but with the use of our ultra-veiw mechain we can see the registration number"

3 oinks Closed lad accounts + I r.i.p'd 2 httpz
View user's profileSend private messageVisit poster's website
dh_mac
419Eater is my life


Joined: 21 Nov 2007
Posts: 289
Location: Vancouver.. or AM I?!?


PostPosted: Tue Jan 06, 2009 4:12 am Reply with quoteBack to top

If anything.. its good that the phish is so amateur (cutting & pasting/ no hyper linkie..)

Email RBC and if you really want to do a good deed.. report them to the Consumer Information of Canada and they have a link on the left to file a complaint. Then there is the [email protected] & [email protected]

Don't hold your breath for any big arrests. But you do get the warm fuzzy feeling of trying to do something right..

_________________
"what do you want from me.. i can kill you if you don't stop writing me.. i can perform african wonders that will drop you death." Dr-Y-Qasi3y

"..SCAN ME THE BANK RECEIPT AGAIN AND MAKE SURE YOU SCAN IT PROPERLY SO THAT IT CAN BE SEEINGABLE." Mr_Berkley

"...WHAT DO YOU WANT ME TO DO UNH, TO KILL MY SELF BECAUSE OF A PARCKAGE.." Androse V1ncent-another satisfied customer of ParcelDirect

"..I AM TOTALY DISAPONTED THE WAY YOU ARE TAKING THIS TRANSACTION ...IF I HAVE KNEW YOU ARE GOING TO TAKE THIS TRANSACTRION THIS WAY ..I WIL NOT CONTACT YOU FOR THE FIRST TIME"-DR_Usman

Russia United States
View user's profileSend private messageSkype Name
grooble
Master Baiter


Joined: 01 Dec 2008
Posts: 127
Location: drifting in the cloud


PostPosted: Tue Jan 06, 2009 11:17 am Reply with quoteBack to top

You might want to report it here too:

http://www.phishtank.com/

_________________
Time on my hands, lets have fun...

"Please i very angry with you John.You disrespect me very bad.I no happy." - [email protected]@ng Dec 2008
"WE WISH TO CONFIRM IF YOUR SERIOUS OR NOT BECAUSE YOUR MAILS SOUNDS AS SOME ONE WHO DOESN’T KNOW AND UNDERSTAND WHAT HE IS DOING" - Fr3d D4n13ls Jan 2009
At me from it already the head to break up - N4t0li4n4 gives her testimonial to M7CN S3cur3. 649 clicks and counting
you’re a great liar and sounds like a criminal too - Fr3d D4n13ls - Feb 2009
Not to worry as soon as we get it rolling everything go according to plan - [email protected]@ng Feb 2009 (that's what you think m8 )
View user's profileSend private message
pablo
419Eater is my life


Joined: 10 Jul 2008
Posts: 366


PostPosted: Tue Jan 06, 2009 2:39 pm Reply with quoteBack to top

Phishing emails looking for bank access information are among the most dangereous to the innocent victims. My RL email address has been valid for many years. I post to news groups using my RL email address. I get phishing emails several times a week.

From a baiting perspective they are no fun. Their success depends on them harvesting as many bank acoounts as possible until they are shut down. I often get phishing emails friday evenings and this year 4 on Christmas eve, times when victims are likely to be on line and security may be at home.

The scripts and fake web pages are on hacked web sites. The general phishing script points to a fake web page and often to a second web page.

Recently I have started to see a new form of phishing that sends out a second visually identical phishing email after the first one the only difference is the links. The scammers are hopping it will be ignored after the first sites are shut down. The first I saw like this was about October, nine minutes after I got the first email the first site was dead, I don't know why I even looked at the duplicate email that had just arrived in detail but six minutes later it too was dead. I now check them all.

The hacked websites are innocent victims often limited access club websites for hobbists. Normal access to these websites usually doesn't change, just the addition of an extra web page accessable by a URL.

Banks have email addresses to forward a phishing email to. (Sometimes hard to find on their websites.) Time is of the essence. The website owners and ISP providers are very co-operative in killing the hacked pages.

p.
View user's profileSend private message
undertowz
Stooge


Joined: 13 Nov 2008
Posts: 283
Location: location location


PostPosted: Tue Jan 06, 2009 5:47 pm Reply with quoteBack to top

Thanks all for replies and advice. I did forward the scam and link to the
bank's security link. As I said it appears the RBC has been a target for years
and the sheer volume of reports from a google search seems overwhelming.
It's all news to me since I just started down the road to baiting ruin so
I'll soon streamline where I want to go with it all.

Worst part of the entire baiter exercise for me? I'm finding the amount
of time I'm burning up to make reports, baiting phuqs, follow threads etc etc.
is huge.

I'll have to narrow it all down and concentrate on one or two.
or..quit work and leave my brain to science.
Confused

_________________

D3rrick Blar3 M7CN - 2414 boxes, 68 refreshments, 2 months
"we want to avoid the puzzle thing again because it was really hard for my assistant to do it. And also it takes a lot of time"

Lords0n K0phy
"The method of playing scrabble to generate M7CN cannot be accepted by this company"
"How can Western Union ask a custormer whether he or she has been in witch craft and voodoo"

TOM SL0C0CK:
"After receiving your ID thou it was not that visable but with the use of our ultra-veiw mechain we can see the registration number"

3 oinks Closed lad accounts + I r.i.p'd 2 httpz
View user's profileSend private messageVisit poster's website
undertowz
Stooge


Joined: 13 Nov 2008
Posts: 283
Location: location location


PostPosted: Wed Jan 07, 2009 6:37 am Reply with quoteBack to top

Bada Bing!!!
That didn't take too long. A visit to the hacked site link in the original
RBC email I posted reveals the following message tonight.
Worth a look - nice scarey coloured warning page...
http://ip194-102-209-87.adsl2.static.versatel.nl/user/.mrtg/bin/online-services.html
Quote:

Reported Web Forgery!


This web site at ip194-102-209-87.adsl2.static.versatel.nl has been
reported as a web forgery and has been blocked based on your security
preferences.

Web forgeries are designed to trick you into revealing personal or
financial information by imitating sources you may trust.

Entering any information on this web page may result in identity theft or other fraud.


my first kill Twisted Evil

_________________

D3rrick Blar3 M7CN - 2414 boxes, 68 refreshments, 2 months
"we want to avoid the puzzle thing again because it was really hard for my assistant to do it. And also it takes a lot of time"

Lords0n K0phy
"The method of playing scrabble to generate M7CN cannot be accepted by this company"
"How can Western Union ask a custormer whether he or she has been in witch craft and voodoo"

TOM SL0C0CK:
"After receiving your ID thou it was not that visable but with the use of our ultra-veiw mechain we can see the registration number"

3 oinks Closed lad accounts + I r.i.p'd 2 httpz
View user's profileSend private messageVisit poster's website
grooble
Master Baiter


Joined: 01 Dec 2008
Posts: 127
Location: drifting in the cloud


PostPosted: Wed Jan 07, 2009 9:55 am Reply with quoteBack to top

Sorry to say undertowz - it is still there (09:50 GMT 07Jan2009) but you have got to step 1.

The message you are getting is from your browser that is now detecting it as a Phishing site. (I'm guessing firefox?) The poor fools who are using MSIE will still go straight there without a warning...try it.

Somewhere on that message you might find and 'ignore' button that will still open the page...

Have you reported to abuse[at]versatel.nl?

_________________
Time on my hands, lets have fun...

"Please i very angry with you John.You disrespect me very bad.I no happy." - [email protected]@ng Dec 2008
"WE WISH TO CONFIRM IF YOUR SERIOUS OR NOT BECAUSE YOUR MAILS SOUNDS AS SOME ONE WHO DOESN’T KNOW AND UNDERSTAND WHAT HE IS DOING" - Fr3d D4n13ls Jan 2009
At me from it already the head to break up - N4t0li4n4 gives her testimonial to M7CN S3cur3. 649 clicks and counting
you’re a great liar and sounds like a criminal too - Fr3d D4n13ls - Feb 2009
Not to worry as soon as we get it rolling everything go according to plan - [email protected]@ng Feb 2009 (that's what you think m8 )
View user's profileSend private message
Dutch
Goat hoarder


Joined: 22 Nov 2007
Posts: 4204
Location: Dislocated


PostPosted: Wed Jan 07, 2009 10:39 am Reply with quoteBack to top

^ should be abuse<at>versatel.net. I've just sent them an abuse report.

_________________
SpainNigeriaNetherlandsCanadaSouth AfricaUnited KingdomAustraliaIvory CoastGhanaTogoUkraineIrelandHong KongFranceSenegalGermanyBeninTurks and CaicosIndonesiaPortugalBurkina FasoMalaysiacameroonJapanGambiaSierra LeoneKenya deadified fake websites) x 374
Mortar x11 Closed lad accountsx a couple Cellphone pony Easter Egg Nurse Nastys Audi TT Goat Golden Goat
Yes we can! (with a bit of help)
View user's profileSend private message
pablo
419Eater is my life


Joined: 10 Jul 2008
Posts: 366


PostPosted: Wed Jan 07, 2009 12:29 pm Reply with quoteBack to top

This site is still live. I sent email to the RBC security and to the hosting ISP.

EDIT: I have had a generic response from RBC not from the ISP It is still up.

p.
View user's profileSend private message
undertowz
Stooge


Joined: 13 Nov 2008
Posts: 283
Location: location location


PostPosted: Wed Jan 07, 2009 5:33 pm Reply with quoteBack to top

Quote:
Sorry to say undertowz - it is still there



argh right you are didn't realise it was a Fox notice

sent report to RBC yesterday and got same generic reply as pablo
also sent to versatel.net and versatel.nl

noticed versatel listed in dns records to many suspect sites
and wonder if they're not an indifferent ISP to begin with

oh well...we've led the horse to water

thanks for followupz

_________________

D3rrick Blar3 M7CN - 2414 boxes, 68 refreshments, 2 months
"we want to avoid the puzzle thing again because it was really hard for my assistant to do it. And also it takes a lot of time"

Lords0n K0phy
"The method of playing scrabble to generate M7CN cannot be accepted by this company"
"How can Western Union ask a custormer whether he or she has been in witch craft and voodoo"

TOM SL0C0CK:
"After receiving your ID thou it was not that visable but with the use of our ultra-veiw mechain we can see the registration number"

3 oinks Closed lad accounts + I r.i.p'd 2 httpz
View user's profileSend private messageVisit poster's website
Display posts from previous:      
Post new topicReply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



** Find out information about your IP address **


All Content © 2003 - 419Eater.com
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT