Wahlau .NET

Malaysian Beware!

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

Please know this and I think this is a very smart trick trying to do phishing on others. Kindly notify others about this. Thank you.

First you will receive this email:

from: Malayan Banking Berhad <update@comebankonlinesolutions.com>
subject: Alert: New Account Protection (June 2008)

Dear Maybank Berhad Customer,

Maybank Berhad is committed to making your online transactions safe and secure. We take every precaution to protect our users’ information by utilizing the latest technology and international industry standard practices.

We have upgraded our new GGT-5 server to serve our customers for a better and secure online service, against fraudulent activities and recent Spam Attack on Maybank customers.

Due to this recent security process, you are requested to register your Maybank Internet banking with the New Maybank June 2008 Security Process.

After completing the first process, please wait 10 Min’s as TAC Code will be sent to your mobile phone. You will have to fill in the code on page two.

http://www.somephishingsite.com/Maybank2u-Security.htm

[I am not giving a link to this phishing people, link is edited]

Regards

Security Maintenance,
Maybank Berhad

 Then after around few hours, the second email comes in

from: MayBank Group. VerificationProcessing@maybank2u.com.my
subject: Recent Verification Process

Dear Maybank member :

We recently sent this message to some of our online banking customers
and we dicovered that some customer’s could not complete the verification process do to the following reasons

1, Network Network failure

2, Phone off when expecting requested infomation

3, Site Busy

Our comprehensive fraud-prevention program is one of the key reasons
Maybank is a safe way to pay online. We believe that innovation and
careful analysis is the way to beat fraud. That’s why Maybank has developed
industry-leading models to review every transaction. and help detect
suspicious activity.

In order to continue to operate the Maybank service and to reduce the
risk of fraud, Maybank . (”Maybank” or “we”) must ask you to provide us
information about yourself and your every requested information on our
secure page;.

To do so please follow the link below.

http://www.thissitesuck.com/aegabi06/cache/May2u-Service/Maybank2u_com.html

[Edited the link so that the phishing link is not shown]

We believe that innovation and careful analysis is the way to beat fraud. That’s why Maybank has developed industry-leading models to review every transaction. and help detect suspicious activity. Our Fraud Investigation Team is dedicated to creating a safe Maybank community. If we suspect fraud in your account, we’ll contact you immediately. .

This is well planned as they used a non Maybank2U email to send the initial then after that the spoof Maybank2u email. Their email is coming from:-

Return-Path: <wwwrun@volleyball.reinickendorfer-fuechse.de>
Received: from unknown (HELO dd1524.kasserver.com) (85.13.128.111)
  by mail.nozonenet.com with ESMTP; 4 Jun 2008 04:00:49 -0000
X-Originating-IP: 85.13.128.111
Received-SPF: none ([mymailserver.com]: domain at volleyball.reinickendorfer-fuechse.de does not designate permitted sender hosts)
identity=mailfrom; client-ip=85.13.128.111;
envelope-from=<wwwrun@volleyball.reinickendorfer-fuechse.de>;
Received: by dd1524.kasserver.com (Postfix, from userid 30)
id ED70425ACE7; Wed,  4 Jun 2008 05:35:23 +0200 (CEST)

This is a phishing email to have your account information and password. Because all the website domain used is only registered recently. How could a bank register this domain and launch it so quickly, bank are pretty slow.

http://whois.domaintools.com/comebankonlinesolutions.com - Registered on 31, May 2008.

Phishing site on the first email is registered on June 4th, 2008 and belong to someone from US.

Phishing site on the second email is registered much earlier, but registered to someone from Germany.

 

Posted in: Wahlau

This entry was posted on Wednesday, June 4th, 2008 at 12:38 pm and is filed under Wahlau. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.