Rather odd scam, not sure where this should go.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Feb 16, 2011 9:56 pm

Quote:

Delivered-To: [email protected]
Received: by 10.229.215.2 with SMTP id hc2cs185383qcb;
Wed, 16 Feb 2011 11:47:12 -0800 (PST)
Received: by 10.42.222.74 with SMTP id if10mr1522003icb.243.1297885631987;
Wed, 16 Feb 2011 11:47:11 -0800 (PST)
Return-Path: <[email protected]>
Received: from mail-iy0-f171.google.com (mail-iy0-f171.google.com [209.85.210.171])
by mx.google.com with ESMTPS id k1si201934icu.122.2011.02.16.11.47.10
(version=TLSv1/SSLv3 cipher=OTHER);
Wed, 16 Feb 2011 11:47:10 -0800 (PST)
Received-SPF: neutral (google.com: 209.85.210.171 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=209.85.210.171;
Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.210.171 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: by iyh42 with SMTP id 42so1716618iyh.2
for <[email protected]>; Wed, 16 Feb 2011 11:47:10 -0800 (PST)
Bcc: [email protected]
MIME-Version: 1.0
Received: by 10.231.10.141 with SMTP id p13mt1157330ibp.131.1297885625752;
Wed, 16 Feb 2011 11:47:05 -0800 (PST)
Received: by 10.231.187.5 with HTTP; Wed, 16 Feb 2011 11:47:05 -0800 (PST)
Reply-To: [email protected]
Date: Wed, 16 Feb 2011 11:47:05 -0800
Message-ID: <[email protected]>
Subject: *IMPORTANT*ensure the safety of your online banking
From: CHASE-ACCOUNT-UPDATE <[email protected]>
Content-Type: multipart/alternative; boundary=00221532c7acfa774b049c6b8b0d

--00221532c7acfa774b049c6b8b0d
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

--=20

Dear, Chase customer,

Please be advice that you are to correctly fill in your online user i.d and
password/email and password to update your account and enable proper
reflection/adequacy of our online banking policies to aviod your account
from been de-activated from our online banking services.Previous
notifications have been sent to the email address assigned to your account.

As the Primary Contact, you must renew the service(s) listed below:

SERVICE: Chase Online<http://trialsites.ieasysite.com/trialsite314555/websi=
te/>andBill
Pay<http://trialsites.ieasysite.com/trialsite314555/website/>services.

You are to log in to your account by clicking the link below for
activation,:

www.Chase.com <http://trialsites.ieasysite.com/trialsite314555/website/>
Enter your user ID and Password (that you selected during the online
enrollment process).
Enter the requested information and your Chase
Online<http://trialsites.ieasysite.com/trialsite314555/website/>and
Bill
Pay <http://trialsites.ieasysite.com/trialsite314555/website/> services wil=
l
be updated.

If you have not signed up for online access, you can enroll easily by
clicking "Enroll" at the bottom of the Login page.

Chase Online "Enrollment" contact customer care for more details.
<http://trialsites.ieasysite.com/trialsite314555/website/>

Carter Franke
Chief Marketing Officer
CardMember Services
<http://trialsites.ieasysite.com/trialsite314555/website/>

This site is directed at persons in the United States only. Persons outsid=
e
the United States may visit
<http://trialsites.ieasysite.com/trialsite314555/website/>International
Banking .

Links to third party sites are provided for your convenience by JPMorgan
Chase. JPMorgan Chase neither endorses nor guarantees any offerings of the
third party providers, nor does JPMorgan Chase make any representation or
warranty of any kind about the content, use of or inability to use, the
third party sites.

=A9 2011 JPMorgan Chase & Co

--00221532c7acfa774b049c6b8b0d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

 -- 

<table summary=3D"layout" border=3D"1" cellpadding=3D"10" cellspacing=3D"0"=
width=3D"575">
<tbody><tr>
<td>

<img src=3D"http://kanaweb.bankone.com/notifications/events/ccs_yes/ima=
ges/chase_logo_2005.gif" height=3D"27" width=3D"138">
Dear, Chase customer,
 
 
Please
be advice that you are to correctly fill in your online user i.d and=20
password/email and password to update your account and enable proper=20
reflection/adequacy of our online banking policies to aviod your account
from been de-activated from our online banking services.Previous=20
notifications have been sent to the email address assigned to your=20
account. 
 
As the Primary Contact, you must renew
the service(s) listed below:
SERVICE:
<a href=3D"http://trialsites.ieasysite.com/trialsite314555/website/">Ch=
ase
Online</a> and<a href=3D"http://trialsites.ieasysite.com/trialsite314555/we=
bsite/">
Bill Pay</a> services. 

You are to log in to your account by clicking the l=
ink below for activation,:
 
<a href=3D"http://trialsites.ieasysite.com/trialsite314555/website/">ww=
w.Chase.com</a>
 
Enter your user ID and Password=20
(that you selected during the online enrollment process).
 
Enter the requested information and

your
<a href=3D"http://trialsites.ieasysite.com/trialsite314555/website/">Ch=
ase
Online</a> and
<a href=3D"http://trialsites.ieasysite.com/trialsite314555/website/">Bi=
ll
Pay</a> services will be updated.
=A0 
 
If you have not signed up for online access, you can enroll easily by=
=20
clicking "Enroll" at the bottom of the Login page. 
 

 
 
<a href=3D"http://trialsites.ieasysite.com/trialsite314555/website/">Chase
Online "Enrollment"
contact customer care for more details.

</a><a href=3D"http://trialsites.ieasysite.com/trialsite314555/webs=
ite/">
 
 
<img src=3D"http://kanaweb.bankone.com/notifications/events/ccs_yes/ima=
ges/signature.gif" height=3D"31" width=3D"157"> 
=A0
Carter=20
Franke 
Chief Marketing Officer 
CardMember Services 
</a><a href=3D"http://trialsites.ieasysite.com/t=
rialsite314555/website/"> 
This site is directed at persons in the=20
United States only. Persons outside the United States may visit=20
</a><a>International Banking </=
a>.
 
 

Links to third party
sites are provided for your convenience by JPMorgan Chase. JPMorgan Chase n=
either endorses
nor guarantees any offerings of the third party providers, nor does JPMorga=
n Chase make any
representation or warranty of any kind about the content, use of or inabili=
ty to use, the
third party sites. 

=A9 2011 JPMorgan Chase &
Co
</td>
</tr>
</tbody></table>

 

--00221532c7acfa774b049c6b8b0d--

Sorry if i shouldnt of quoted show much, thats just all that shows when i show original.

I got this on my catcher email, where i have only posted on guestbooks, havent signed up for anything.
WOT on my firefox marked this site as untrustworthy and unreliability (vendor reliability) so i'm wondering if this could be a fake bank, but before posting anything in the fake banking/site forums i'd like to see what everybody thinks

Thanks!

insults and more · Posted: Wed Feb 16, 2011 10:07 pm

trialsites.ieasysite.com isn't listed in aa419's db.

The page is an unsecured attempt to harvest db's, pretending to be Chase.

Post this up in the Fake Banks forum with headers, and ask someone there to help you kill it. I think it may be 419 enough to be actionable, as normal phishing sites are not dealt with in the FB forum.

Posted: Wed Feb 16, 2011 10:13 pm

Quote:

trialsites.ieasysite.com isn't listed in aa419's db.

The page is an unsecured attempt to harvest db's, pretending to be Chase.

Post this up in the Fake Banks forum with headers, and ask someone there to help you kill it. I think it may be 419 enough to be actionable, as normal phishing sites are not dealt with in the FB forum.

I was wondering the same thing about it being a phishing.
So the Header is the whole thing i posted there right?, or the bit until the email starts?

insults and more · Posted: Wed Feb 16, 2011 10:25 pm

The header is everything until the

Quote:

Content-Type: multipart/alternative; boundary=00221532c7acfa774b049c6b8b0d

line.

I suggest posting for the sitekilling tutorial in the forum, then having one of the experts walk you through making a report.

Posted: Wed Feb 16, 2011 10:44 pm

^^^ Thanks for your help Smile

Posted: Thu Feb 17, 2011 1:38 am

leonsumbitches wrote:

The page is an unsecured attempt to harvest db's, pretending to be Chase.

Post this up in the Fake Banks forum with headers, and ask someone there to help you kill it. I think it may be 419 enough to be actionable, as normal phishing sites are not dealt with in the FB forum.

^^^ You are right leon, it is a phishing site -- but there is nothing 419 AFF about it. So nothing to take care of in the Fake Bank forum. We don't do phishing there.

Olly, please don't post this up in the FB forum. No phishing is dealt with there as the banks can deal with this much better and usually faster than we can. Just send the email with headers to their phishing department. To find that, google nameofbank+phishing and usually you will find who to send it to.

For Chase, it is [email protected]. Hope this helps. Very Happy

Posted: Thu Feb 17, 2011 4:21 pm

Thank you Both for all your help Smile

Rather odd scam, not sure where this should go.	View next topic View previous topic