23rd September 2004

Suntrust

accounts@suntrust.com <accounts@suntrust.com>

Temporary Account Suspension

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://nextreviewcust822.netfirms.com/input.htm

disguised as:

https://accounts.suntrust.com/ReRoute/app_cgi2/Direct=1&RequestInfo=True

Traced to a server in North York, USA.

1. Email requests victim help upgrade their Suntrust account by visiting link and entering details. Any details entered on the spoof page are just captured and forwarded to a local script.

2. Suntrust never send users emails requesting details in this way.

3. The spoof page is loaded as a popup in front of the genuine Suntrust homepage making it appear much more authentic.

4. A lot of Suntrust phishing scams are circulating at the moment. This is just one of many!