27472). ybonline.co.uk - HTML.Phishing.Bank-1152

This email targets customers of ybonline.co.uk.

Message Details

Malware Name:	HTML.Phishing.Bank-1152
Origin:	Australia
Date first seen:	09/05/2007 13:00:04
Number seen:	33
Date last seen:	11/05/2007 14:31:21
From:	"Yorkshire Bank"<customerservice@ybonline.co.uk>
Subject:	Statement delivery error.

Attacker's URLs

The following table shows the details of the URLs used by the attacker. These could either be the fake website of the attack, or a site which redirects to the attackers fake site. Sometimes the attacker will use an additional site for hosting resources such as images.

The table shows the current status of the site: if it is still reachable (), or if it has been shut down (). If the site has not been confirmed as a phishing site it is shown with the symbol . The time when the site was first observed is shown, together with the time that the site was shut down, if applicable. Do not visit the attackers site as it may contain malware. You can get more details on the site by clicking on the symbol.

Status	First observed	Shut Down	Internet Address	URL
	15/05/2007 03:54:06	15/05/2007 03:54:06	217.148.172.66	http://www.one.ogilvy.nl/~helpdesk/home.ybonline.co.uk/cgi-bin/AUTH/get_detail.html
	15/05/2007 04:31:09	15/05/2007 04:31:09	210.0.200.181	http://210.0.200.181/~geog/ybonline.html

Message Text

The text below shows the message content, rendered in a safe way. It does not show images or HTML formatting, but the text is the same as that contained in the phishing email. Each clickable link is shown as a reference. You can see the way the URL is presented in the main body of the text, while the actual URL activated by the link is shown below the main body.

How the message body looks in an email client.

   Dear Yorkshire Bank Online customer,

   We are very sorry but we cannot send your online statement.

   This might be due to either of the following reasons:

   - A recent change in your personal information (i.e. change of address).
   - Submitting invalid information during the initial sign up process.
   - You choose to stop your statement for this account online only or by post
   and online.

   Consequently, we placed a temporary restriction on your account. We did this
   to protect your account from any fraudulent activity.

   Please access your online account and solve this issue:

   [1]https://www.ybonline.co.uk

   Thank you,

   If I want to get future statements online only can I still request a paper
   copy if I need one? Yes, simply call us on 08457 404 404 (Textphone 08457
   125 563) or pop into your local branch and we'll be happy to arrange one for
   you. Lines are open from 8am to 10pm every day (except Christmas Day, Boxing
   Day and New Year's Day). Calls may be monitored or recorded for quality
   purposes.

   We regret any inconvenience this may cause you

   Yorkshire Bank Internet Banking Customer Service

References

   1. http://210.0.200.181/~geog/ybonline.html

Additional Examples