HVB-Phishing
Gerade erhalten:
Dear HVB Group Bank customer,
We recently reviewed your account, and suspect that your HVB Group Bank Internet Banking account may have been accessed by an unauthorized third party.
Protecting the security of your account and of the HVB Group Bank network is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features.
To restore your account access , please take the following step to ensure that your account has not been compromised:
1. Review your recent account history for any unauthorized withdrawals or deposits, and check your account profile to make sure no changes have been made. If any unauthorized activity has taken place on your account, report to HVB Group Bank staff immediately.
To get started, please click the link below:
https://......com/secure/logon.asp?dd=1
We apologize for any inconvenience this may cause, and appreciate your assistance in helping us maintain the integrity of the entire HVB Group Bank system. Thank your for your prompt attention to this matter.
Sincerely,
The HVB Group Bank Team.
Please do not reply to this email. Mails sent to this address cannot be answered. For assistance, log in to your HVB Group Bank account and choose the "Help" link in the header of any page.
Die Links führen tatsächlich zu:
http://www.briannabh.com/~emily/hvb.com/secure/logon/logon.asp/
Der Header:
Return-Path: <
[email protected]>
X-Flags: 0000
Delivered-To: GMX delivery to
(ich)@gmx.de
Received: (qmail invoked by alias); 09 Jan 2005 13:26:35 -0000
Received: from server.yfps.tpc.edu.tw (EHLO server.yfps.tpc.edu.tw) (163.20.100.1)
by mx0.gmx.net (mx059) with SMTP; 09 Jan 2005 14:26:35 +0100
Received: from localhost (localhost [127.0.0.1])
by server.yfps.tpc.edu.tw (Postfix) with ESMTP id 8387DC7294
for <
(ich)@gmx.de>; Sun, 9 Jan 2005 21:26:24 +0800 (CST)
Received: from server.yfps.tpc.edu.tw ([127.0.0.1])
by localhost (server.yfps.tpc.edu.tw [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 78513-10 for <
(ich)@gmx.de>;
Sun, 9 Jan 2005 21:26:24 +0800 (CST)
Received: by server.yfps.tpc.edu.tw (Postfix, from userid 80)
id 256E0C73E4; Sun, 9 Jan 2005 21:23:28 +0800 (CST)
To:
(ich)@gmx.de
Subject: Unauthorized Access To Your HVB Group Internet Banking account
From: HVB Group Bank <
[email protected]>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <
[email protected]>
Date: Sun, 9 Jan 2005 21:23:28 +0800 (CST)
X-Virus-Scanned: by virus and spam scan at yfps.tpc.edu.tw
X-Amavis-Alert: BAD HEADER Improper use of control character (char 0D hex) in message header 'MIME-Version'
MIME-Version: 1.0\r\n ^
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 0 (Mail was not recognized as spam)
Mit einem entsprechenden Link, der aber nicht etwa zu einer gefakten Seite der City-Bank führte, sondern zunächst mal zu Google. Google wiederum informiert darüber, dass keine Info zur URL xxx da wäre, falls diese gültig sei, oder so ähnlich. Oder Webseiten suchen, die den Begriff, sprich die URL enthalten. Das habe ich dann gemacht. Nun landet man auf einer Seite, die sich dem Kampf gegen Pishing verschrieben hat. Die Seite ist in "Down under" beheimatet. 
