Phishing Mail Circulated to Scam CitiBank Online Banking Users - Part 2
TOKYO (MacHouse) - As we reported about an hour ago, a cyber criminal group has circulated a spam message to scam online banking users of CitiBank in South Dakota. The subject line of the spam message is Security Alert ID: 62216216183. (Screenshot 01.)
 Screenshot 01 - Source: MacHouse |
 Screenshot 02 - Source: kalim.ba |
 Screenshot 03 - Source: Liquid Web |
Again, clicking on the hyperlink in the phishing message, one will be directed to a phishing website hosted at the domain of kalim.ba. Accessing the domain still displays a 500 internal server error. (Screenshot 02.) But the phishing website still exists and is currently hosted in Lansing, Michigan. The IP address of the web server hosting the phishing website is 72.52.252.25. It belongs to Liquid Web of Lansing, Michigan, USA. (Screenshot 03 shows the index page of Liquid Web’s website.)
 Screenshot 04 - Source: MacHouse |
 Screenshot 05 - Source: TTNET |
 Screenshot 06 - Source: Team 108 |
Next, let’s find out how the phishing message was circulated. Screenshot 04 shows its HTML source code. The IP address of 85.106.93.110 belongs to a Turkish network company (TTNET). (Screenshot 05 shows the index page of TTNET’s website.) It appears that a user with this IP address attempted to make it look like the phishing message originated from a mail server of team108.com (mail.team108.com). The domain of team108.com belongs to a company called Team 108 in Singapore. (Screenshot 06 shows Team 108’s contact page.)
Click on the button to watch a short documentation video. 
Click on the button to watch more documentation videos.
Related stories:
Phishing Mail Circulated to Scam CitiBank Online Banking Users - Part 1
********** ********** ********** ********** ********** ********** ********** **********
MacHouse is not funded by tax payers' money. We have limited resources. We also need time to sleep and eat just as others. So we will not act as the International police to contact all victims of website abuse. All you have to do is to subscribe to spam messages and spam posts. If we can, why don't you?
Leave a Reply
You are prohibited from posting comments merely to advertise your website. Please read Rules and About This Blog at the top menu bar for more information.
Because of spam-comment criminals, we are forced to manually moderate every comment that you may post. Your comment will appear only after we review and then approve it. It will take us several hours at most to review it.
Please note that all one-sentence comments will be automatically rejected as an anti-spam measure.