SmartFeedSmartFeed          

Porsche Hangout


WELCOME - YOU ARE CURRENTLY VIEWING 419EATER AS A GUEST

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

ScamWarners.com - Internet Anti-Fraud Center - now open!


 natwest.com

View next topic
View previous topic
 
Post new topicReply to topic
Author Message
ulta
Wannabe Baiter


Joined: 08 Dec 2005
Posts: 92


PostPosted: Mon May 16, 2011 5:07 am Reply with quoteBack to top

Redirect to a fake log in page for a actual bank.

Quote:
Delivered-To:
Received: by 10.42.173.9 with SMTP id p9cs68085icz;
Sun, 15 May 2011 16:27:04 -0700 (PDT)
Received: by 10.224.218.74 with SMTP id hp10mr2938911qab.47.1305502023678;
Sun, 15 May 2011 16:27:03 -0700 (PDT)
Return-Path: <[email protected]>
Received: from server1.3unohosting.com (server1.3unohosting.com [64.34.171.85])
by mx.google.com with ESMTPS id p13si8748673qcu.94.2011.05.15.16.27.03
(version=TLSv1/SSLv3 cipher=OTHER);
Sun, 15 May 2011 16:27:03 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 64.34.171.85 as permitted sender) client-ip=64.34.171.85;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 64.34.171.85 as permitted sender) [email protected]
Received: from nobody by server1.3unohosting.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1QLkiF-0003D9-6a
for ; Sun, 15 May 2011 18:27:03 -0500
To:
Subject: Verification Of Your Identity !!!
From: NatWest Bank <[email protected]>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Sun, 15 May 2011 18:27:03 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.3unohosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - server1.3unohosting.com

<img alt="NatWest logo" src="http://www.natwest.com/images/logo.gif" width="150" height="30"></a> <img alt=" " src="http://www.natwest.com/images/ico_branch.gif" width="37" height="35">
<div id="strapline"> <a rel="nofollow" target="_blank" href="http://www.natwest.com/personal02.asp?id=PERSONAL/SAVE_AND_INVEST/SAVINGS_ACCOUNTS/LONGER_TERM/1YR_FIXED_RATE_BOND&referrer=hpbFRBLHS"><img alt="Good morning and welcome to NatWest" src="https://www.nwolb.com/brands/NWB/images/strapline_hb.gif" width="176" height="77"></a></div></div>
<div id="home">
<div id="boxType2b"> </div>
<div>Dear <span class="yshortcuts" id="lw_1251882358_0">Natwest Bank Customer</span>:<br><br><span style="font-size: 10pt; font-family: Verdana;">It has come to our attention that
your account billing updates are out of order. If you could please take 5-10
minutes out of your online experience and update your billing records you will
not run into any future problems with the online service. However, failure to
update your records will result in account termination. Please update your
records as soon as possible.</span><span style="font-size: 10pt; font-family: Verdana;">If you are the rightful holder of
the account you must <b>click the link below</b> and then complete all steps
from the following page as we try to verify your identity.</span></div>

<div id="combos">
<form target="_blank" name="day2day" onsubmit="return theMainWindow.showFormWarning(this)" method="post">
<div class="combo" id="combo1">
<div>
<p><span style="font-size: 10pt; font-family: Verdana;"><a rel="nofollow" target="_blank" href="http://highpayingniches.com/STUDENTLOAN-CONSOLIDATION-RATES.INFO/wp-content/uploads/c5hmy/natwest/natwest/Login.php">www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html</a></span></p>
<p><span style="font-size: 10pt; font-family: Verdana;">If you choose to ignore
our request, you leave us no choise but to temporaly suspend your
account.</span></p>
<p>Regards<br><font size="1"><font size="3"><span class="yshortcuts" id="lw_1251882358_1">Natwest Bank</span></font></font>,</p>
<p>Updating Department.</p>
<p><font color="#ba102c">We will <strong>never</strong> contact customers via
email asking to supply any confidential information, telephone or <span class="yshortcuts" id="lw_1251882358_2">internet
banking</span> login details via email that is why we want you to verify your account
by our internet automated machine.</font></p></div></div>


it shows up as following in the mail, and clicking the link : www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html , redirect it to the following address: http://highpayingniches.com/STUDENTLOAN-CONSOLIDATION-RATES.INFO/wp-content/uploads/c5hmy/natwest/natwest/Login.php which is the fake log in page

Quote:

NatWest logo
Good morning and welcome to NatWest
Dear Natwest Bank Customer:

It has come to our attention that your account billing updates are out of order. If you could please take 5-10 minutes out of your online experience and update your billing records you will not run into any future problems with the online service. However, failure to update your records will result in account termination. Please update your records as soon as possible.If you are the rightful holder of the account you must click the link below and then complete all steps from the following page as we try to verify your identity.

www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html

If you choose to ignore our request, you leave us no choise but to temporaly suspend your account.

Regards
Natwest Bank,

Updating Department.

We will never contact customers via email asking to supply any confidential information, telephone or internet banking login details via email that is why we want you to verify your account by our internet automated machine.
Legal| Privacy| Security|Affiliates| Media| About us| Glossary


the domain hosting the fake log in page is registered to some one in Pakistan

Quote:
WHOIS information for highpayingniches.com :

[Querying whois.verisign-grs.com]
[Redirected to whois.PublicDomainRegistry.com]
[Querying whois.PublicDomainRegistry.com]
[whois.PublicDomainRegistry.com]
Registration Service Provided By: UA COMMUNICATION
Contact: +092.2138285769
Website: http://www.uacommunication.com

Domain Name: HIGHPAYINGNICHES.COM

Registrant:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Creation Date: 02-Jul-2010
Expiration Date: 02-Jul-2011

Domain servers in listed order:
ns23.uacommunication.com
ns24.uacommunication.com


Administrative Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Technical Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Billing Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606

Status:LOCKED
Note: This Domain Name is currently Locked. In this status the domain
name cannot be transferred, hijacked, or modified. The Owner of this
domain name can easily change this status from their control panel.
This feature is provided as a security measure against fraudulent domain name hijacking.


screen cap of the fake log in:
Image

Uploaded with ImageShack.us

_________________
"May you never rest well in your grave." mothers heritage home for kids
View user's profileSend private message
woody999
Dormain Reshuffler


Joined: 30 May 2009
Posts: 19016
Location: East of Humptulips


PostPosted: Mon May 16, 2011 6:07 pm Reply with quoteBack to top

^^^^ This was a phishing page and we do not handle these here in the fake bank forum.
The natural life span of a phishing page is less than 24 hrs and this one has already been taken down.

The link now forwards to the legit site.


Setting to n/a

_________________
"thank you for making me a fool" CC lad
"I lost my assories" Barr. Angus Bu...g

"YOU NEED SOME DOCTOR" Barrister Peter Paul

I dont know who is lieing ,either you or F3lcha1r

is annoying to watch my email for a whole day and not read from you-
>174 Closed lad accounts x 190 Goat Easter Egg Purple Flower x2
United StatesNigeriaSpainUnited KingdomChinaGhanaUnited NationsThailandFilipino flagCambodia FlagcameroonGermanyMalaysiaSouth AfricaCanadaBeninRussiaFranceCayman IslandsLuxembourg
Ivory CoastBurkina FasoPortugalUnited Arab EmiratesTogoMexican FlagNetherlandsAustraliaIndonesiaSwitzerlandItalySenegalTurkeyJapanGibraltar
Peru : sri lanka : USVI : Oman x 5807
Cellphone x 45 Nurse Nastys Audi TT x2
View user's profileSend private messageSend e-mail
Ima Baeder
419Eater Admin


Joined: 03 May 2007
Posts: 18314


PostPosted: Tue May 17, 2011 5:26 am Reply with quoteBack to top

Moved here from the fake sites forum.

This one is already dead but just FYI, the best way to deal with phishing pages is to report them to the real business being impersonated and here: http://www.antiphishing.org/

For info on the difference between fake sites used for fraud and phishing, please see this info: http://forum.419eater.com/forum/viewtopic.php?p=720553#720553

_________________
348 Fake Sites killed United StatesUnited KingdomUnited NationsMaltaNigeriaGhanaBeninGermanySouth AfricaRussiaTogoMalaysiaEuropean UnionJapanIvory CoastSpainFranceSwitzerlandChinaCanadaItalyThailand

Star Mugu Reseller Mortar Closed lad accounts x 100 Sand Timer 2 Years Pretty Rose Mc Fry Mc Fry Nurse Nastys Audi TT Goat Flying Monkey Easter Egg 2011
View user's profileSend private message
Boyboy172
Not quite a Newb


Joined: 25 Nov 2012
Posts: 57


PostPosted: Mon Dec 03, 2012 5:59 pm Reply with quoteBack to top

The link is back up

https://www.nwolb.com/

Just to know.

Edit: scratched out the question that is already answered in the post above...
View user's profileSend private message
Display posts from previous:      
Post new topicReply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



** Find out information about your IP address **


All Content © 2003 - 419Eater.com
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT