16th September 2004

Suntrust

Suntrust Bank <supprefnum13884709691275@suntrust.com>

UPDATE YOUR ACCOUNT RECORDS

HTML

Spoof email links to a spoof webpage where victim is prompted to enter details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://195.239.79.170:87/st/

disguised as:

an image containing the text of the email.

Traced to a server in central Russia.

1. Email requests victim update their Suntrust bank records via the supllied link. Link actually leads to spoof page where details are captured and forwarded to a local script.

2. Suntrust never send users emails requesting details in this way.

3. Genuine Suntrust page is loaded behind popup page containing spoof page.

4. URL is disguised as an image containing the text of the email. This is a technique used by scammers to disguise the text from email spam filters.