16th November 2004

Branch Banking & Trust Company

BB&T <support_refnum_3001339@bbandt.com>

BRANCH BANKING & TRUST COMPANY EMAIL VERIFICATION

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://218.158.230.101:87/b/

1. Email claims to be from BB&T asking you to confirm your account. You will be taken to a spoof login page where your details will be captured by the phishers.

2. BB&T never send users emails requesting details in this way.

3. URL traced to a server in Seoul, South Korea.

4. Apparently a variation on the 4903 phishing scams that use this methid to target well known banks and financial institutions.

5. All of the email text and its link are embedded in a single image - a technique used by spammers/phishers to get the email through spam filters.

6. Spoof website not online at time of report, but variations are likely to be active, and there has been a marked increase in the number of recent phish attacks against BB&T.