19th January 2005

Valley National Bank

vBankWorks < support@vbankworks.com >

Valley Security Alert

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://211.137.5.253:280/vbankworks.updateinfo.securly.com/

1. Email claims to be from Valley National Bank asking you to confirm your account data by clicking on the link. You will be taken to a spoof login page where your details will be captured by the phishers.

2. Valley National Bank never send users emails requesting details in this way.

3. URL of spoof website looks quite real at a glance, but is not! (Notice the numbers at the start).

4. URL disguised as text " Click here to prove your identity ".

5. Website traced to China.

6. The first scams I have seen targeting Valley National Bank. More likely to follow.