Abbey National Security Software Upgrade Phishing Scam
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
X-Account-Key: account2
X-UIDL: x
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x via 217.146.183.107; Sun, 06 Jul 2008 15:57:06 +0000
X-YahooFilteredBulk: 82.55.173.245
X-Originating-IP: [82.55.173.245]
Authentication-Results: mta122.mail.ukl.yahoo.com from=abbey.com; domainkeys=neutral (no sig)
Received: from 82.55.173.245 (HELO host245-173-dynamic.55-82-r.retail.telecomitalia.it) (82.55.173.245)
by mta122.mail.ukl.yahoo.com with SMTP; Sun, 06 Jul 2008 15:57:06 +0000
Received: from nstld.com (unknown [12.44.203.120])
by artofit.com with SMTP id 5V0COTWUVC
for <x>; Sun, 06 Jul 2008 08:57:00 -0800
Received: from [96.128.224.86] (HELO kinki-kids.com)
by bio-miracle-asia.com with SMTP id OMGBMRSCK5
for <x>; Sun, 06 Jul 2008 11:51:00 -0500
From: "Abbey" <customerservice.id082578-5323441ob@abbey.com>
To: x
Subject: Official information from Abbey National plc customer service. <message ref: KM70146200>
X-remove: 47096
User-Agent: Pegasus Mail for Win32 (v2.53/R1)
X-Mailer: Pegasus Mail for Win32 (v2.53/R1)
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--B9o4cq7tp6fjxqbn92p24"
Body:
Dear Abbey bank customer,
Abbey Customer Serice would like to inform you that we are currently carrying out a scheduled upgrade of Abbey Security software.
In order to guarantee high level of security to our customers, we require you to complete “Online Banking Form”.
Please complete Online Banking Form using the link below:
http://myonlineaccounts2.abbeynational.co.uk/CentralFormWeb/...
Thank you for being a valued customer.
Sincerely,
Abbey Customer Serice
0x2, 0x69887169, 0x463, 0x0, 0x858, 0x2556, 0x4259, 0x436, 0x5733, 0x60, 0x3400 engine rev MWT source 0x7, 0x29, 0x7, 0x3805, 0x61594657, 0x6750, 0x71594352, 0x21, 0x32042010, 0x4969, 0x83364239, 0x3, 0x5, 0x28 95919571165913554969157 DF1M: 0x7, 0x95, 0x636, 0x7350, 0x091, 0x59, 0x29211966, 0x54, 0x20893676, 0x50 PPV: 0x6, 0x5, 0x506, 0x5, 0x660, 0x0, 0x5279, 0x988 CBUS: 0x7, 0x12398978, 0x74, 0x12, 0x90 7L5L: 0x961, 0x1647, 0x3152, 0x736, 0x74, 0x8952, 0x6, 0x381, 0x8, 0x24 HGHI: 0x6055, 0x0, 0x11, 0x702, 0x35815211, 0x37053116, 0x91737003, 0x59443007, 0x9, 0x88, 0x22443996 0x15, 0x60
0x663, 0x8208, 0x006, 0x36151590, 0x7556, 0x64, 0x35920071, 0x978, 0x3280, 0x81, 0x81512701, 0x60096832, 0x5 function: 0x1523, 0x6, 0x9864, 0x11, 0x52859772, 0x50, 0x2, 0x086, 0x24310187, 0x887, 0x2 update: 0x31, 0x08, 0x9699, 0x6, 0x33, 0x49, 0x03, 0x37024453, 0x103, 0x4621, 0x92 cvs, source, api, tmp, U56, 0TMN, UCZ, common, AWH engine: 0x34, 0x63, 0x1512, 0x6, 0x3252, 0x032, 0x0086, 0x622 96947847403 4KXO: 0x20, 0x51, 0x6, 0x7748, 0x8, 0x34632405, 0x6424, 0x7, 0x631 T3Z6 define GKIR media. 0x9, 0x86, 0x5, 0x64, 0x8, 0x11 0x0651, 0x416, 0x4855, 0x7, 0x4, 0x49 A772: 0x333, 0x9, 0x7922, 0x3, 0x94, 0x7695, 0x07, 0x937, 0x57032900, 0x9993, 0x18051185, 0x1
KOQL: 0x51, 0x0319, 0x56957163, 0x15 0x90809895, 0x4584, 0x31 media: 0x58072801, 0x876, 0x278, 0x90397951, 0x2612, 0x7, 0x22 0x51, 0x2771, 0x3853, 0x1, 0x2106, 0x27080947, 0x2947, 0x76, 0x279 OBVX, DWB1, WFOO, start, WF85, 3BY, OZ6C, WG4, 9FRG. 3SQ: 0x7047, 0x8220, 0x56, 0x28, 0x040, 0x65, 0x4805, 0x04, 0x010, 0x02057267, 0x24, 0x78 0x34, 0x878, 0x42, 0x3, 0x8280, 0x9, 0x0, 0x0524, 0x23, 0x3, 0x937 revision: 0x8, 0x173, 0x83518486, 0x4988, 0x10141130, 0x40264771, 0x2329, 0x9 engine type DQEZ media root 8US. exe: 0x41828619, 0x98, 0x26, 0x436, 0x5478, 0x739, 0x73332961, 0x89, 0x660 574752253144065067
119014241122309727093002917 0x9, 0x21, 0x94904833, 0x599, 0x942, 0x851, 0x93180051, 0x516, 0x64706077, 0x8014, 0x1141, 0x36786357, 0x53, 0x8875, 0x4910 29U3: 0x3966, 0x77603868, 0x223 rcs: 0x61606541, 0x09424005, 0x3989, 0x44697504, 0x59270986, 0x262, 0x120
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
Bank of America Phishing Scam - Verification of Your Current DetailsBarclays Bank Customer Details Confirmation Phishing Scam
Yorkshire Bank Confirm Your Online Records Phishing Scam
Banking Phishing Scam - Natwest - Reactivate your Online Access
NatWest Credit Card Services Banking Phishing Scam
Related Malware Samples:
No related malware samples found.[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
Pay close attention to the difference between the phishing link and the anchor text of the link
Phishing Link: myonlineaccounts2.abbeynational.co.uk.serverid1.co.uk/CentralFormWeb/....
Anchor Text: myonlineaccounts2.abbeynational.co.uk/CentralFormWeb/....
The only difference is serverid1.co.uk and can easily be missed by inattentive, uninformed and inexperienced users. Never focus on the anchor text of the link, but rather pay attention to the actual link destination (in other words the actual URL or address of the website that will open in your browser, once you click on the link).
The poor English in this e-mail is a clear sign of an e-mail scammer at work.