Attention all Citibank users - Email Scam
21st January 2004

Have databse operations mean that you have to check your Citibank account? ...

This spoof email appears to be a text email (see image below), but the text area is actually an image. The image text asks that you log on to check that your account is still working and not lost due to 'database operations', but clicking any where on that image will open a forged Citibank web page.

This really constitutes a disguised link, since the link text (contained within the image) is completely different to the page that will be opened. The URL of the forged page (see image below) is http://61.33.83.170:3901/cit/ which resolves to a Korean ISP.

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

Take a good look at the following images, because this email scam may be coming to an inbox near you!

The Email ...

The forged web page...