20th December 2004

Smith Barney

Smith Barney <identifdep_id533673791836634@smithbarney.com>

Private message from Smith Barney

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://195.239.144.10:87/sb/login.htm

1. Email claims to be from Smith Barney asking you to confirm your account data by clicking on the link. You will be taken to a spoof login page where your details will be captured by the phishers.

2. Smith Barney never send users emails requesting details in this way.

3. Website traced to Amsterdam, Netherlands.

4. URL and text embedded in image - a technique used to get past spam filters.

5. Spoof webpage loads a fake URL bar over the real one, to disguise the URL as www.smithbarney.com