US Bank Scam

Please read this fully and help me to send this on to some folks if this is a new scam!!!

New trick or old?

The scam itself is old.....

But check out this new trick...

When you click on the link in this email....

http://usbank.updatebillingonline.com/usbank/">https://www4.usbank.com/internetBanking/RequestRouter?requestCmdId=DisplayLoginPage

In the email it was being hidden by a title link trick.

That is no big deal.

But look at the url that shows in the broswer with out an @ or any tricks....

Also the email and site has security that I can't foward the link with this bogus link showing up.

If your foward the email the bogus site info disappears.

And if you type in the site directly with out being linked from the email....

http://usbank.updatebillingonline.com/usbank/

It's blank.

And if you go to

http://usbank.updatebillingonline.com

It bumps you to ebay!!!

To see this for your self.

Take the source and put it in a html editor. Or see the html I have included.

Then follow the link in preview.
Note copy to notepad and then your edtior...

I think they are doing this with a meta refresh and some java I think....

But this is so bad!!!!

If you can't trust what your browser?

If you guys want to pass this around or know people that we can forward this too that would pay attention to it please do.....

Michael Willis

Header and message source

Html version of email below!

X-F: Wed Aug 11 22:30:07 2004
Received: from outpost [69.xx.xx.71] by cyberzero.com
(SMTPD32-6.06) id A2B7F403CA; Wed, 11 Aug 2004 10:52:42 -0400
Message-Id:
Date: Wed, 11 Aug 2004 15:52:01 +0100
X-Priority: 3
From: US Bank
To: ebay@xxxxxxxxxx.com
Reply-To: "Ebay-auto"
X-Tracker: AnswerTrack by HumankindSystems.com, BUILD 2.3.0.1
X-ATID: [AT-040811.1333]:946
X-RegisteredUser:
MIME-Version: 1.0
Subject: [AT-040811.1333] SPAM: Verify And Update Your Accounts By 11/08/2004
Content-Type: multipart/alternative; boundary="--_AnswerTrack_Bound_ohysgbqtlctb"
X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@usbank.com
X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10.
X-Declude-Sender: services@usbank.com [69.xx.xx.71]
X-Declude-Spoolname: D32b73ca.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
X-Note: This E-mail was sent from ns5.cyberzero.com ([69.xx.xx.71]).
X-Note: TESTSFAILED NOPOSTMASTER, NOPOSTMASTER2, NOPOSTMASTER3, HELOBOGUS, NOLEGITCONTENT, BCC, WEIGHT10, WEIGHT102, WEIGHT103, WEIGHT104
X-Note: REMOVEIPADDRESS 69.xx.xx.71
X-Note: TIME_EMAIL_WAS_PROCESSED 10:52:46
X-Note: VERSION_OF_DECLUDE 1.75
X-Note: Total spam weight of this E-mail is 18.
X-RCPT-TO:
X-UIDL: 390187466
Status: U
X-F: Wed Aug 11 22:30:07 2004
Received: from outpost [69.xxxx.xxxx.71] by cyberzero.com
(SMTPD32-6.06) id A2B7F403CA; Wed, 11 Aug 2004 10:52:42 -0400
Message-Id:
Date: Wed, 11 Aug 2004 15:52:01 +0100
X-Priority: 3
From: US Bank
To: ebay@XXXXXXXXXXXXXXXX.com
Reply-To: "Ebay-auto"
X-Tracker: AnswerTrack by HumankindSystems.com, BUILD 2.3.0.1
X-ATID: [AT-040811.1333]:946
X-RegisteredUser:
MIME-Version: 1.0
Subject: [AT-040811.1333] SPAM: Verify And Update Your Accounts By 11/08/2004
Content-Type: multipart/alternative; boundary="--_AnswerTrack_Bound_ohysgbqtlctb"
X-RBL-Warning: NOPOSTMASTER: Not supporting postmaster@usbank.com
X-RBL-Warning: WEIGHT10: Weight of 18 reaches or exceeds the limit of 10.
X-Declude-Sender: services@usbank.com [69.xx.xx.71]
X-Declude-Spoolname: D32b73ca.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.
X-Note: This E-mail was sent from ns5.cyberzero.com ([69.xx.xx.71]).
X-Note: TESTSFAILED NOPOSTMASTER, NOPOSTMASTER2, NOPOSTMASTER3, HELOBOGUS, NOLEGITCONTENT, BCC, WEIGHT10, WEIGHT102, WEIGHT103, WEIGHT104
X-Note: REMOVEIPADDRESS 69.xx.xx.71
X-Note: TIME_EMAIL_WAS_PROCESSED 10:52:46
X-Note: VERSION_OF_DECLUDE 1.75
X-Note: Total spam weight of this E-mail is 18.
X-RCPT-TO:
X-UIDL: 390187466
Status: U

This is a multi-part message in MIME format.

Start Source **********************************************************************************

U.S. Bank Internet Banking

Dear U.S Bank customer, We recently reviewed your account, and suspect that your U.S Bank account may have been accessed by an unauthorized third party.Protecting the security of your account and of the U.S Bank network is out primary concern. Therefore, as a preventive measure, we have temporary limited access to sensitive U.S Bank account features. Click the link below in order to regain access to your account: https://www4.usbank.com/internetBanking/RequestRouter?requestCmdId=DisplayLoginPage For more information about how to protect your account, please visit U.S Bank Security Center. We apologize for any inconvenience this may cause, and apriciate your assistance in helping us maintain the integrity of the entire U.S Bank system. Thank you for your prompt attention to this matter. Sincerely, The U.S BANK Security Department Team. Please do not reply to this mail.Mail sent to this address cannot be answered. For assistance, log in to your U.S Bank account and chose the "Help" link in the header of any page. Privacy Pledge | Security Standards © 2004 U.S. Bancorp USB Column:COL 1 End Source **********************************************************************************

Now this is quite cool -- two phishing attempts on different days. One for Citi Bank and one for US Bank. Both use the same technique -- a bitmap image with an embedded hot link. Also both have hidden text that only shows up in the source or when you view via "Select All". Has anybody else come across hidden text similar to below in any phishing attempts?

Citi Bank Hidden Text:
I'm with you Texas Saturday Webs in 1944 Beatles Prom Dresses Witchcraft Lingerie Domains in 1959 ICQ in 1960 in 1892 Be so kind I'm against it will do It Christina Aguilera Houses in 1917 Same for me It's O.K. New York Mets It's O.K. in 1938 What would you like?

US Bank Hidden Text:
Sure The X-Men some advice about in 1972 Mortage Rates Search Engines Webs The Death Penalty I have got rammstein get off try to understand No thanks come on

Take out the distractors (essentially words on the most searched for list):
I?m with you in 1914
in 1959
in 1960
in 1892
I?m against it will do it in 1917
Same for me It?s O.K. It?s O.K. in 1938
What would you like?

some advice about in 1972
I have got to try to understand