5th November 2004

Halifax

Halifax bank < anti-fraud.ref.num7547079@halifax.co.uk >

Halifax Internet banking: Service Message

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://81.91.66.249:87/f/

1. Email claims to be from Halifax asking you to confirm your account. Link takes you to spoof login page. If you try to login your details will be captured and forwarded buy a script to the scammers.

2. Halifax never send users emails requesting details in this way.

3. URL traced to a server in Paris, France.

4. URL is disguised by an image in the body of the email (an technique used by scammers to hide the content of emails from spam filters). When you move your mouse over the image the URL appears to be http://www.halifax-online.co.uk but this is just a disguise.