Latest Fraud Threat To Gtb And Springbank

I woke up this morning to see 2 email requesting that i should update my online account with GTB and Springbank, 2 separate emails.

Funny because i don't have account with these bank, I did a little bit of poking and realised the links in the email directs unsuspecting users to a different URL

the link looks like this
http://www.Springbank.com/ibanking/signon?
http://www.gtbplc.com/ibanking/signon?LOB=CONS&screenid=Update_Acct

but the javascript behind the email will send you to this addresses respectively
http://www.springbenk.com/ibanking/
http://www.gtbple.com/ibanking/

VERY INTELLIGENT, REPLACING "a" WITH "e" AND "c" WITH "e"

i tried to feed in wrong login details as login and i was directed to the real website, its obvious that my entry has already been save to a database before redirection.

You know one bad thing here is that the email address was spoofed, so the email appears to be sent from GeNS@gtbplc.com

so if yahoo users have already added the email address to their address book, then yahoo users will see the address book icon next to the message as if it came from the right source

A little background check shows the 2 sites were hosted by the same hosting company
www.abimco.com because thats where the DNS server points to

http://www.networksolutions.com/whois/results.jsp?domain=springbenk.com
http://www.networksolutions.com/whois/results.jsp?domain=gtbple.com

      
DNS RESULT
Domain Name: springbenk.com
Registered at http://www.dynadot.com

Registrant:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India

Administrative Contact:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India
ganraj2006@gmail.com
+600 33020120058

Technical Contact:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India
ganraj2006@gmail.com
+600 33020120058

Record expires on 2008/11/11 UTC
Record created on 2007/11/11 UTC

Domain servers in listed order:
ns1.abimco.com
ns2.abimco.com


SO BEWARE AS THERE MAY BE MORE SITES OUT THERE TARGETING OTHER BANK

Those thieves must not go unpunished.

So strange that 2 of every 3 received it, I have been trying to contact the hosting company but network is so bad

Hello webdezzi
Thanks for the information, but we wonder how you traced the nameservers to abimco, our whois search result did not give the same result;
http://network-tools.com/default.asp?prog=whois&host=gtbple.com
http://network-tools.com/default.asp?prog=whois&host=springbenk.com
Regards
Abimco

Hello Abimco,
Those who followed that link in november 2007 saw it point to that domain server

This is 2008 and they might have moved to another server. I tried to reach the phone number on abimco's site then but no body picked it.

anyway, Its always hard to beat those guys.