I woke up this morning to see 2 email requesting that i should update my online account with GTB and Springbank, 2 separate emails.

Funny because i dont have account with these bank, I did a little bit of poking and realised the links in the email directs unsuspecting users to a different URL

the link looks like this
http://www.Springbank.com/ibanking/signon?
http://www.gtbplc.com/ibanking/signon?LOB=CONS&screenid=Update_Acct

but the javascript behind the email will send you to this addresses respectively
http://www.springbenk.com/ibanking/
http://www.gtbple.com/ibanking/

VERY INTELLIGENT, REPLACING "a" WITH "e" AND "c" WITH "e"

i tried to feed in wrong login details as login and i was directed to the real website, its obvious that my entry has already been save to a database before redirection.

You know one bad thing here is that the email address was spoofed, so the email appears to be sent from GeNS@gtbplc.com

so if yahoo users have already added the email address to their address book, then yahoo users will see the address book icon next to the message as if it came from the right source

A little background check shows the 2 sites were hosted by the same hosting company
www.abimco.com because thats where the DNS server points to

http://www.networksolutions.com/whois/results.jsp?domain=springbenk.com
http://www.networksolutions.com/whois/results.jsp?domain=gtbple.com


DNS RESULT
Domain Name: springbenk.com
Registered at http://www.dynadot.com

Registrant:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India

Administrative Contact:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India
ganraj2006@gmail.com
+600 33020120058

Technical Contact:
GANESAN
Dhandapani
Bangkapi, Essex 454574
India
ganraj2006@gmail.com
+600 33020120058

Record expires on 2008/11/11 UTC
Record created on 2007/11/11 UTC

Domain servers in listed order:
ns1.abimco.com
ns2.abimco.com


SO BEWARE AS THERE MAY BE MORE SITES OUT THERE TARGETING OTHER BANK

Thanx a lot

Those thieves must not go unpunished.

Received the mails as well.

Thanks all the same

So strange that 2 of every 3 received it, I have been trying to contact the hosting company but network is so bad

I have got the GTB letters like 4 times now but the Springbank own just arrived today, the funnies part of the story is that I don't operate Springbank account.

Thanks for the info, just keep them coming!

Hello webdezzi
Thanks for the information, but we wonder how you traced the nameservers to abimco, our whois search result did not give the same result;
http://network-tools.com/default.asp?prog=whois&host=gtbple.com
http://network-tools.com/default.asp?prog=whois&host=springbenk.com
Regards
Abimco

This is a relatively common scam on the Internet known as Phishing. Just beware.

Hello Abimco,
Those who followed that link in november 2007 saw it point to that domain server

This is 2008 and they might have moved to another server. I tried to reach the phone number on abimco's site then but no body picked it.

anyway, Its always hard to beat those guys.

The simplest way to beat this kind of attack is to keep all notices, notifications, and emails sent to customers within the intranet login screen versus sending things externally to personal email addresses.

I am a staff of gtb. i got the same scam mail from them. to avoid being a victim,just ignore the scam like i did.

its very absurd what people can do to make money.thanks to the poster for taking pains to unravel this.here is one in my box.it has been coming since one week and keeps saying final notice

Dear Customer,


With the introduction of our new cards,"Veri",we have update our network to PCI DSS standards ISO 27001.We are sending you this mail because you are still using the older version of our card.You are advised to CLICK HERE and register all your DEBIT CARDS, X-CHANGE CARDS, and CASH CARDS online IMMEDIATELY so as to enable your existing card to work on our new servers. Only registered cards will work with the ATM machines.

Note that in order to continue using your card for ATM transactions, you MUST register your card(s) online IMMEDIATELY BY CLICKIN G HERE .If you do not register your ATM card(s) immediately, you will not be able to use your cards with the ATM machines or for ATM transactions and your card(s) will be cancelled or terminated.

Adhere to this instruction on receiving this message and click here immediately to register your card. Our goal is to satisfy and secure all our customers.

WARNING: please ensure you look out for the pin secured symbol before filling your details


InterSwitch Nigeria Limited

Important dates to remember:


For additional information about the transition to InterSwitch Online, please visit www.interswitch.com/you/ anytime. If you’re concerned about online security, you may type the URL directly into your browser.


Sincerely,

InterSwitch Customer Service





For phone number and email information, please visit the Contact Us section of interswitchng.com.

I got a similar mail and when I followed the link out of curiousity, it lead to a site somewhere in Asia, probably China. Banks should simply do more about their IT security. This kind of scam is threatening the development Internet banking and electronic commerce in Nigeria.