Permanent TSB email phishing

who_me

Just received this today. I receive scams like this all the time, but this is the first I've received for an Irish bank. The 'Review your account' link points to an Italian domain (www.distribuzione-informatica.it). You'd think they'd at least make some effort to at least use an Irish domain! :rolleyes:

ACCOUNT REVIEW NOTIFICATION

YOUR ACCOUNT HAS BEEN FLAGGED AS ONE OF THE
NUMEROUS ACCOUNTS THAT NEEDS TO BE REVIEWED.
The main reason for this action are

* Billing / Payment Issues
* Abuse & Terms of Use Issues

WE STRONGLY SUGGEST, THAT YOU TRY TO DO THE FOLLOWING:


* Review your account

Once you've done this your account will be removed from the flagged account automatically.

Customer Advisory

Permanent TSB

2WiReD

currently one in circulation with the following:

From: email-alert@permanenttsb.ie [mailto:email-alert@permanenttsb.ie]
Sent: 17 September 2012 *****
To: ************
Subject: Open24 new Online security procedures


Dear Open24 Customer,
To ensure the highest level of security of information passing between our customers and our Open24 website, in line to the new online banking security and regulatory Requirements, Open24 requires that you verify your identity online to enable us activate the new online security procedures on your account.

While our top priority is to ensure that any transactions you carry out while visiting our Internet Banking site are protected, Please be inform that we shall not be liable for any loss or damage arising from your failure, delay or negligence to comply to this our new security policy message.
To activate our new online security facilities, please click on 'Open24' below:

Open24. Once completed and your information match the same we have on records for you, This new security service will start to function on your your Open24 account.
Please take note that if you receive this online security message more than once on your email, it is because of your delay or failure to activate this service on your account before the expiration of the activation page or due to provision of incomplete or inaccurate information.
Kind regards

Open24 <

---

[malicious link: http://www.asdfasdfasdf.com/admin1/permanent-tsb/permanent-tsb/permanentsb.html]

This email is personal & confidential and is intended for the
recipient only. If you are not the intended recipient, you are hereby notified
that any dissemination, distribution or copying of this communication
is strictly prohibited. If you have received this communication in
error, please immediately notify us and destroy any
copies, electronic, paper or otherwise, which you may have of this
communication. Thank you for your cooperation.

syklops

The 'Review your account' link points to an Italian domain (www.distribuzione-informatica.it). You'd think they'd at least make some effort to at least use an Irish domain!

.ie domains are notoriously difficult to get. Trust me I used to be a hostmaster. They maybe thought a .it was close enough and would fool some people, which it probably did. I remember I had a maths teacher in secondary school who was supposed to be computer savvy once explain that "if it has .ie at the end then it means its an email". :rolleyes:

biko

Got one today

OPEN24 Internet Banking Security Message!
Resolution Center: Your account has been locked! Click to Resolve
Thank you for using Permanent TSB.

from OPEN24 <reception@services.com>

Link leads to
http://www.asdfasdfasdf.ca/imgs/https/open24/encrypted-session/online/session=%7BKR3SI5953036pbc-TLSv1SSLv3-6FKI06485%7D

rapet

Got one today

Last Warning - Update your permanent tsb account information:
http://www.topen24.com/online/login

My 3 year old sun would make more believable site

Judgement Day

biko wrote: »

Got one today

OPEN24 Internet Banking Security Message!
Resolution Center: Your account has been locked! Click to Resolve
Thank you for using Permanent TSB.

from OPEN24 <reception@services.com>

Link leads to
http://www.yourequity.casdfasdfasdf/https/open24/encrypted-session/online/session=%7BKR3SI5953036pbc-TLSv1SSLv3-6FKI06485%7D

I frequently get this one but it never gets opened so I've never found out where it links to. That's what the delete button's for.

syklops

Judgement Day wrote: »

I frequently get this one but it never gets opened so I've never found out where it links to. That's what the delete button's for.

No, thats what a sandboxed VM is for.

Khannie

syklops wrote: »

a sandboxed VM

Otherwise known as a "fun machine".

rapet

Khannie wrote: »

Otherwise known as a "fun machine".

I used to open this site : vm + Hide My Ass! Free Proxy

industrialhorse

rapet wrote: »

I used to open this site : vm + Hide My Ass! Free Proxy

Hide My Ass may not be such a good idea afterall:(

http://invisibler.com/lulzsec-and-hidemyass/

rapet

industrialhorse wrote: »

Hide My Ass may not be such a good idea afterall:(

http://invisibler.com/lulzsec-and-hidemyass/

Yes.. but I didn't hack any website, I was just hiding my IP address, so I'm fine.. thanks.

If I was a hacker, I would use Tor but unfortunately I'm not