Latest Fraud Threat To GTB And Springbank

Welcome. Please Login, Register, Or Activate! 
type your username and password to login
Date: November 22, 2009, 05:17 AM
430673 members and 297824 Topics
Latest Member: Gogou
Nairaland [Nigerian Forum] Home Help Search Who is currently online? Login Register
Nairaland Forum  |  General | Welcome  |  Money (Moderators: FOD, naijacutee)  |  Latest Fraud Threat To GTB And Springbank
Pages: (1) Go Down Send this topic Notify of replies
Author Topic: Latest Fraud Threat To GTB And Springbank  (Read 2245 views)
webdezzi (m)
Latest Fraud Threat To GTB And Springbank
« on: November 12, 2007, 10:06 AM »

I woke up this morning to see 2 email requesting that i should update my online account with GTB and Springbank, 2 separate emails.

Funny because i dont have account with these bank, I did a little bit of poking and realised the links in the email directs unsuspecting users to a different URL

the link looks like this
http://www.Springbank.com/ibanking/signon?
http://www.gtbplc.com/ibanking/signon?LOB=CONS&screenid=Update_Acct

but the javascript behind the email will send you to this addresses respectively
http://www.springbenk.com/ibanking/
http://www.gtbple.com/ibanking/

VERY INTELLIGENT, REPLACING "a" WITH "e" AND "c" WITH "e"

i tried to feed in wrong login details as login and i was directed to the real website, its obvious that my entry has already been save to a database before redirection.

You know one bad thing here is that the email address was spoofed, so the email appears to be sent from GeNS@gtbplc.com

so if yahoo users have already added the email address to their address book, then yahoo users will see the address book icon next to the message as if it came from the right source

A little background check shows the 2 sites were hosted by the same hosting company
www.abimco.com because thats where the DNS server points to

http://www.networksolutions.com/whois/results.jsp?domain=springbenk.com
http://www.networksolutions.com/whois/results.jsp?domain=gtbple.com

      
DNS RESULT

Domain Name: springbenk.com
Registered at http://www.dynadot.com

Registrant:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India

Administrative Contact:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India
ganraj2006@gmail.com
+600 33020120058

Technical Contact:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India
ganraj2006@gmail.com
+600 33020120058

Record expires on 2008/11/11 UTC
Record created on 2007/11/11 UTC

Domain servers in listed order:
ns1.abimco.com
ns2.abimco.com


SO BEWARE AS THERE MAY BE MORE SITES OUT THERE TARGETING OTHER BANK
uchetobi (f)
Re: Latest Fraud Threat To GTB And Springbank
« #1 on: November 12, 2007, 10:12 AM »

Thanx a lot
nwabumma (f)
Re: Latest Fraud Threat To GTB And Springbank
« #2 on: November 12, 2007, 10:23 AM »

Those thieves must not go unpunished.
freelance (m)
Re: Latest Fraud Threat To GTB And Springbank
« #3 on: November 12, 2007, 10:25 AM »

Received the mails as well.

Thanks all the same Wink
webdezzi (m)
Re: Latest Fraud Threat To GTB And Springbank
« #4 on: November 12, 2007, 10:35 AM »

So strange that 2 of every 3 received it, I have been trying to contact the hosting company but network is so bad
crazyT (m)
Re: Latest Fraud Threat To GTB And Springbank
« #5 on: November 12, 2007, 11:39 PM »



I have got the GTB letters like 4 times now but the Springbank own just arrived today, the funnies part of the story is that I don't operate Springbank account. 

Thanks for the info, just keep them coming!
abimco (m)
Re: Latest Fraud Threat To GTB And Springbank
« #6 on: January 26, 2008, 08:38 PM »

Hello webdezzi
Thanks for the information, but we wonder how you traced the nameservers to abimco, our whois search result did not give the same result;
http://network-tools.com/default.asp?prog=whois&host=gtbple.com
http://network-tools.com/default.asp?prog=whois&host=springbenk.com
Regards
Abimco
niyyie (m)
Re: Latest Fraud Threat To GTB And Springbank
« #7 on: January 27, 2008, 05:52 PM »


This is a relatively common scam on the Internet known as Phishing. Just beware.
webdezzi (m)
Re: Latest Fraud Threat To GTB And Springbank
« #8 on: May 09, 2008, 11:15 AM »

Hello Abimco,
Those who followed that link in november 2007 saw it point to that domain server

This is 2008 and they might have moved to another server. I tried to reach the phone number on abimco's site then but no body picked it.

anyway, Its always hard to beat those guys.
jimmyjam
Re: Latest Fraud Threat To GTB And Springbank
« #9 on: June 21, 2008, 10:41 PM »

The simplest way to beat this kind of attack is to keep all notices, notifications, and emails sent to customers  within the intranet login screen versus sending things externally to personal email addresses.

Mr lola
Re: Latest Fraud Threat To GTB And Springbank
« #10 on: May 08, 2009, 04:37 PM »

I am a staff of gtb. i got the same scam mail from them. to avoid being a victim,just ignore the scam like i did.
zilosxp (m)
Re: Latest Fraud Threat To GTB And Springbank
« #11 on: May 08, 2009, 08:34 PM »

its very absurd what people can do to make money.thanks to the poster for taking pains to unravel this.here is one in my box.it has been coming since one week and keeps saying final notice Smiley

Dear Customer,


With the introduction of our new cards,"Veri",we have update our network to PCI DSS standards ISO 27001.We are sending you this mail because you are still using the older version of our card.You are advised to CLICK HERE and register all your DEBIT CARDS, X-CHANGE CARDS, and CASH CARDS online IMMEDIATELY so as to enable your existing card to work on our new servers. Only registered cards will work with the ATM machines.

Note that in order to continue using your card for ATM transactions, you MUST register your card(s) online IMMEDIATELY BY CLICKIN G HERE .If you do not register your ATM card(s) immediately, you will not be able to use your cards with the ATM machines or for ATM transactions and your card(s) will be cancelled or terminated.

Adhere to this instruction on receiving this message and click here immediately to register your card. Our goal is to satisfy and secure all our customers.

WARNING: please ensure you look out for the pin secured symbol before filling your details


InterSwitch Nigeria Limited

Important dates to remember:


For additional information about the transition to InterSwitch Online, please visit www.interswitch.com/you/ anytime. If you’re concerned about online security, you may type the URL directly into your browser.


Sincerely,

InterSwitch Customer Service





For phone number and email information, please visit the Contact Us section of interswitchng.com.
      
Enquirer
Re: Latest Fraud Threat To GTB And Springbank
« #12 on: May 09, 2009, 03:15 PM »

I got a similar mail and when I followed the link out of curiousity, it lead to a site somewhere in Asia, probably China. Banks should simply do more about their IT security. This kind of scam is threatening the development Internet banking and electronic commerce in Nigeria.
 Easiest Way To Send Money from Nigeria to US?  Flegz: The Best Nigerian Shopping Site?  Only Four Nigerian Banks Are Strong  Page 2
Pages: (1) Go Up Send Topic to Friend by E-mail Reply 


Sections: Autos/Cars (2) Jobs/Vacancies (2) (3) Career Talk Education General(2) Politics Romance Computers Phones Travel
Sports Fashion Health Religion Celebrities TV/Movies (2) Music/Radio (2) Books Webmasters Programming

Links: Page1 Page2 Page3 Page4 Page5 Page6 Page7 Page8 Page9 Page10

Nairaland is owned by Oluwaseun Osewa. See also: Nairalist Classified Ads
Nairaland Forum | Powered by SMF 1.0.12.
© 2001-2005, Lewis Media. All Rights Reserved.