Author |
Message |
ulta
Wannabe Baiter
Joined: 08 Dec 2005
Posts: 92
|
Posted:
Mon May 16, 2011 5:07 am |
|
Redirect to a fake log in page for a actual bank.
Quote: |
Delivered-To:
Received: by 10.42.173.9 with SMTP id p9cs68085icz;
Sun, 15 May 2011 16:27:04 -0700 (PDT)
Received: by 10.224.218.74 with SMTP id hp10mr2938911qab.47.1305502023678;
Sun, 15 May 2011 16:27:03 -0700 (PDT)
Return-Path: <[email protected]>
Received: from server1.3unohosting.com (server1.3unohosting.com [64.34.171.85])
by mx.google.com with ESMTPS id p13si8748673qcu.94.2011.05.15.16.27.03
(version=TLSv1/SSLv3 cipher=OTHER);
Sun, 15 May 2011 16:27:03 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 64.34.171.85 as permitted sender) client-ip=64.34.171.85;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 64.34.171.85 as permitted sender) [email protected]
Received: from nobody by server1.3unohosting.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1QLkiF-0003D9-6a
for ; Sun, 15 May 2011 18:27:03 -0500
To:
Subject: Verification Of Your Identity !!!
From: NatWest Bank <[email protected]>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Sun, 15 May 2011 18:27:03 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server1.3unohosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - server1.3unohosting.com
<img alt="NatWest logo" src="http://www.natwest.com/images/logo.gif" width="150" height="30"></a> <img alt=" " src="http://www.natwest.com/images/ico_branch.gif" width="37" height="35">
<div id="strapline"> <a rel="nofollow" target="_blank" href="http://www.natwest.com/personal02.asp?id=PERSONAL/SAVE_AND_INVEST/SAVINGS_ACCOUNTS/LONGER_TERM/1YR_FIXED_RATE_BOND&referrer=hpbFRBLHS"><img alt="Good morning and welcome to NatWest" src="https://www.nwolb.com/brands/NWB/images/strapline_hb.gif" width="176" height="77"></a></div></div>
<div id="home">
<div id="boxType2b"> </div>
<div>Dear <span class="yshortcuts" id="lw_1251882358_0">Natwest Bank Customer</span>:<br><br><span style="font-size: 10pt; font-family: Verdana;">It has come to our attention that
your account billing updates are out of order. If you could please take 5-10
minutes out of your online experience and update your billing records you will
not run into any future problems with the online service. However, failure to
update your records will result in account termination. Please update your
records as soon as possible.</span><span style="font-size: 10pt; font-family: Verdana;">If you are the rightful holder of
the account you must <b>click the link below</b> and then complete all steps
from the following page as we try to verify your identity.</span></div>
<div id="combos">
<form target="_blank" name="day2day" onsubmit="return theMainWindow.showFormWarning(this)" method="post">
<div class="combo" id="combo1">
<div>
<p><span style="font-size: 10pt; font-family: Verdana;"><a rel="nofollow" target="_blank" href="http://highpayingniches.com/STUDENTLOAN-CONSOLIDATION-RATES.INFO/wp-content/uploads/c5hmy/natwest/natwest/Login.php">www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html</a></span></p>
<p><span style="font-size: 10pt; font-family: Verdana;">If you choose to ignore
our request, you leave us no choise but to temporaly suspend your
account.</span></p>
<p>Regards<br><font size="1"><font size="3"><span class="yshortcuts" id="lw_1251882358_1">Natwest Bank</span></font></font>,</p>
<p>Updating Department.</p>
<p><font color="#ba102c">We will <strong>never</strong> contact customers via
email asking to supply any confidential information, telephone or <span class="yshortcuts" id="lw_1251882358_2">internet
banking</span> login details via email that is why we want you to verify your account
by our internet automated machine.</font></p></div></div>
|
it shows up as following in the mail, and clicking the link : www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html , redirect it to the following address: http://highpayingniches.com/STUDENTLOAN-CONSOLIDATION-RATES.INFO/wp-content/uploads/c5hmy/natwest/natwest/Login.php which is the fake log in page
Quote: |
NatWest logo
Good morning and welcome to NatWest
Dear Natwest Bank Customer:
It has come to our attention that your account billing updates are out of order. If you could please take 5-10 minutes out of your online experience and update your billing records you will not run into any future problems with the online service. However, failure to update your records will result in account termination. Please update your records as soon as possible.If you are the rightful holder of the account you must click the link below and then complete all steps from the following page as we try to verify your identity.
www.natwest.com/updating%20managementcenter/www.natwest.com=updating/0,,80120,00.html
If you choose to ignore our request, you leave us no choise but to temporaly suspend your account.
Regards
Natwest Bank,
Updating Department.
We will never contact customers via email asking to supply any confidential information, telephone or internet banking login details via email that is why we want you to verify your account by our internet automated machine.
Legal| Privacy| Security|Affiliates| Media| About us| Glossary
|
the domain hosting the fake log in page is registered to some one in Pakistan
Quote: |
WHOIS information for highpayingniches.com :
[Querying whois.verisign-grs.com]
[Redirected to whois.PublicDomainRegistry.com]
[Querying whois.PublicDomainRegistry.com]
[whois.PublicDomainRegistry.com]
Registration Service Provided By: UA COMMUNICATION
Contact: +092.2138285769
Website: http://www.uacommunication.com
Domain Name: HIGHPAYINGNICHES.COM
Registrant:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606
Creation Date: 02-Jul-2010
Expiration Date: 02-Jul-2011
Domain servers in listed order:
ns23.uacommunication.com
ns24.uacommunication.com
Administrative Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606
Technical Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606
Billing Contact:
UA Comm
feroz ([email protected])
1735/757 New Anjam Colony
Karachi
Sind(en),75760
PK
Tel. +092.3333326606
Status:LOCKED
Note: This Domain Name is currently Locked. In this status the domain
name cannot be transferred, hijacked, or modified. The Owner of this
domain name can easily change this status from their control panel.
This feature is provided as a security measure against fraudulent domain name hijacking. |
screen cap of the fake log in:
Uploaded with ImageShack.us |
_________________ "May you never rest well in your grave." mothers heritage home for kids |
|
|
|
woody999
Baiting Guru
Joined: 30 May 2009
Posts: 20608
Location: East of Humptulips
|
Posted:
Mon May 16, 2011 6:07 pm |
|
^^^^ This was a phishing page and we do not handle these here in the fake bank forum.
The natural life span of a phishing page is less than 24 hrs and this one has already been taken down.
The link now forwards to the legit site.
Setting to n/a |
_________________ "thank you for making me a fool" CC lad
"I lost my assories" Barr. Angus Bu...g
"YOU NEED SOME DOCTOR" Barrister Peter Paul
I dont know who is lieing ,either you or F3lcha1r
is annoying to watch my email for a whole day and not read from you-
>178 x 200 x2
Peru : sri lanka : USVI : Oman x 5816
x 45 x2 |
|
|
|
Ima Baeder
Baiting Guru
Joined: 03 May 2007
Posts: 18313
|
Posted:
Tue May 17, 2011 5:26 am |
|
|
|
|
Boyboy172
Not quite a Newb
Joined: 25 Nov 2012
Posts: 57
|
Posted:
Mon Dec 03, 2012 5:59 pm |
|
The link is back up
https://www.nwolb.com/
Just to know.
Edit: scratched out the question that is already answered in the post above... |
|
|
|
|
|
|
View next topic
View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|