<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Re: Good Bank of America Phish in Spam, Scam and Phishbusters</title>
<link>http://www.dslreports.com/forum/r22635255</link>
<description></description>
<language>en</language>
<pubDate>Wed, 10 Feb 2010 08:48:17 EDT</pubDate>
<lastBuildDate>Wed, 10 Feb 2010 08:48:17 EDT</lastBuildDate>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22638181</link>
<description><![CDATA[<A HREF="/useremail/u/666842"><b>MGD</b></A> : <div class="bquote"><small>said by  nirvansk815 <A HREF="/useremail/u/413587"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> :</small><br><br> Hopefully what you need is inside this header. If not, let me know where to look.<br><br> </div>Excellent, thank you. Originated in France then relayed via a server in New Zealand.<br><br>MGD]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22638181</guid>
<pubDate>Wed, 01 Jul 2009 04:57:16 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22638154</link>
<description><![CDATA[<A HREF="/useremail/u/413587"><b>nirvansk815</b></A> : <div class="bquote"><small>said by  MGD <A HREF="/useremail/u/666842"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> :</small><br><br><div class="bquote"><small>said by  nirvansk815 <A HREF="/useremail/u/413587"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>   :</small><br><br>Just wanted to post some pictures of what seems to be a very good phish attempt.<br> </div>You don't by chance have the originating IP of that phishmail.? <br><br>MGD<br> </div>Hopefully what you need is inside this header. If not, let me know where to look.<br><br><textarea name="code" class="text" cols=50 rows=10>X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==&#012;X-Message-Status: s3:0&#012;X-SID-PRA: billpay-alert@bankofamerica &lt;e-alert-update@bankofamerica.com&gt;&#012;X-SID-Result: SoftFail&#012;X-Message-Info: dpeAAki3kMS5MfdIIv4qnXWmWRVCOXEotpHEqZVh/uQdqaxlz5hlwhPg/dc4fC5y0BJ0b5W34GTaFeUlTy1DdMCt8mAw/+AT&#012;Received: from mxi1.callplus.net.nz (&#91;202.180.66.203&#93;) by col0-mc3-f30.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);&#012; Tue, 30 Jun 2009 07:32:07 -0700&#012;Message-Id: &lt;7mumo6$7kdksd@ismtp01.callplus.net.nz&gt;&#012;Received: from 8.159.86-79.rev.gaoland.net (HELO User) (&#91;79.86.159.8&#93;)&#012;  by ismtp01.callplus.net.nz with ESMTP; 01 Jul 2009 02:31:24 +1200&#012;From: "billpay-alert@bankofamerica"&lt;e-alert-update@bankofamerica.com&gt;&#012;Subject: Bank Of America Alert : Important Customer Service Message&#012;Date: Tue, 30 Jun 2009 07:32:02 -0700&#012;MIME-Version: 1.0&#012;Content-Type: text/html;&#012;charset="Windows-1251"&#012;Content-Transfer-Encoding: 7bit&#012;X-Priority: 1&#012;X-MSMail-Priority: High&#012;X-Mailer: Microsoft Outlook Express 6.00.2600.0000&#012;X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000&#012;Bcc:&#012;Return-Path: e-alert-update@bankofamerica.com&#012;X-OriginalArrivalTime: 30 Jun 2009 14:32:07.0490 (UTC) FILETIME=&#91;8B9F9220:01C9F98F&#93;&#012;</textarea><!--end code block--><br><small>--<br>There's so much to be thankful for...How can anyone be sad?</small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22638154</guid>
<pubDate>Wed, 01 Jul 2009 04:29:20 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22637906</link>
<description><![CDATA[<A HREF="/useremail/u/666842"><b>MGD</b></A> : <div class="bquote"><small>said by  nirvansk815 <A HREF="/useremail/u/413587"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>  :</small><br><br>Just wanted to post some pictures of what seems to be a very good phish attempt.<br> </div>You don't by chance have the originating IP of that phishmail.? <br><br>MGD]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22637906</guid>
<pubDate>Wed, 01 Jul 2009 01:44:30 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22637898</link>
<description><![CDATA[<A HREF="/useremail/u/666842"><b>MGD</b></A> : Yes, it has errors that belies its Eastern European non native English origin. However, the presentation is rather unique, so is the the drop down javascripted box format, that will request both online bank log in, and card data. Plus site key answers and victim's Drivers License, DOB, SSN, & MMN.<br><br>Even though the files are dated from May of 2008, <br><br><div class="borderless siteshot"><small>Snapped 2009-07-01 01:42:18 <A HREF="/faq/7513" TITLE="Snap-shot of URL"><IMG  align=absmiddle TITLE="" SRC="http://i.dslr.net/silk/information.png" border=0 width=16 height=16></A><br><A TITLE="Zoom" HREF="http://i.dslr.net/urls/20/92120.png"><IMG BORDER=0 SRC="http://i.dslr.net/urls/20/92120.gif"></A><br>&raquo;<A HREF="http://culturalclassics.com/media/xfile/txt/boa/index.cfm_files/" >culturalclassics.com/media/xfile&middot;&middot;&middot;m_files/</A></small></div><br><br>I don't recall seeing the exact phish format before. Maybe  nwrickert <A HREF="/useremail/u/1070900"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> has. <br><br>MGD]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22637898</guid>
<pubDate>Wed, 01 Jul 2009 01:42:52 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22637834</link>
<description><![CDATA[<A HREF="/useremail/u/553533"><b>madylarian</b></A> : Rather, it's a not-very-good phish.  Dead giveaways:<br><br>1.  Bank Of American Bill Pay<b>s</b> Notification Services<br><br>2.  Dear Customer instead of Dear *Your Name*<br><br>mady<br><small>--<br>Honi soit qui mal y pense</small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22637834</guid>
<pubDate>Wed, 01 Jul 2009 01:08:08 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22637326</link>
<description><![CDATA[<A HREF="/useremail/u/1003137"><b>garys_2k</b></A> : <div class="bquote"><small>said by  Doctor Four <A HREF="/useremail/u/197199"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> :</small><br><br>Has anyone reporting this phish to Google so that it shows up as a reported web forgery for Firefox users?<br> </div>Yes, I did as soon as I saw it. It still shows without the warning so I did it again, just now. Hopefully it will get their attention.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22637326</guid>
<pubDate>Tue, 30 Jun 2009 22:30:56 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22635539</link>
<description><![CDATA[<A HREF="/useremail/u/666842"><b>MGD</b></A> : I am not sure about that, however, SURBL picks up phishtrack submits in real time, and others may as well. MSIE currently flags the culturalclassics.com domain as a phishing site. Tinyurl has disabled the tinyurl.com initial redirect.<br><br>MGD]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22635539</guid>
<pubDate>Tue, 30 Jun 2009 16:05:06 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22635466</link>
<description><![CDATA[<A HREF="/useremail/u/197199"><b>Doctor Four</b></A> : Has anyone reporting this phish to Google so that it shows up as a reported web forgery for Firefox users?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22635466</guid>
<pubDate>Tue, 30 Jun 2009 15:48:00 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22635381</link>
<description><![CDATA[<A HREF="/useremail/u/1070900"><b>nwrickert</b></A> : No it wasn't.  But you can see for yourself at<br>&raquo;<A HREF="/phishtrack?pid=37948&urls=1">/phishtrack?pi&middot;&middot;&middot;8&urls=1</A><br><small>--<br>AT&T dsl; Speedstream 5100b modem; openSuSE 11.0; firefox 3.0.11</small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22635381</guid>
<pubDate>Tue, 30 Jun 2009 15:31:38 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22635255</link>
<description><![CDATA[<A HREF="/useremail/u/1021645"><b>antiphishing</b></A> : <div class="bquote"><small>said by  nwrickert <A HREF="/useremail/u/1070900"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> :</small><br><br>This seems to be the phish you submitted to &raquo;<A HREF="/phishtrack">/phishtrack</A> and appears as phish #37948.  Thanks for submitting.<br> </div>Was the phishing site:<br><b>httx://70.90.182.---/Onlineid/Onlineid.bankofamerica/bankofamerica.com/Online_Banking/security.update/update.bankofamerica.com/</b><br><br>I am trying to get that site terminated off the internet.  :o<br><small>--<br><b><br>Specializing in "takes downs" of phishing and advance fee scams<br>Send your Phishing/Advance fee scams to: <A HREF="mailto:phish@antihotmail.com">phish@antihotmail.com</a> <br>&raquo;<A HREF="http://www.phishtank.com" >www.phishtank.com</A><br>&raquo;<A HREF="http://www.fraudwatchers.org" >www.fraudwatchers.org</A><br>&raquo;<A HREF="http://mozilla.com" >mozilla.com</A><br></b></small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22635255</guid>
<pubDate>Tue, 30 Jun 2009 15:08:54 EDT</pubDate>
</item>

<item>
<title>Re: Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22635197</link>
<description><![CDATA[<A HREF="/useremail/u/1070900"><b>nwrickert</b></A> : This seems to be the phish you submitted to &raquo;<A HREF="/phishtrack">/phishtrack</A> and appears as phish #37948.  Thanks for submitting.<br><small>--<br>AT&T dsl; Speedstream 5100b modem; openSuSE 11.0; firefox 3.0.11</small>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22635197</guid>
<pubDate>Tue, 30 Jun 2009 15:00:32 EDT</pubDate>
</item>

<item>
<title>Good Bank of America Phish</title>
<link>http://www.dslreports.com/forum/remark,22633759</link>
<description><![CDATA[<A HREF="/useremail/u/413587"><b>nirvansk815</b></A> : Just wanted to post some pictures of what seems to be a very good phish attempt.<br><small>--<br>There's so much to be thankful for...How can anyone be sad?</small><div class="borderless"><TABLE WIDTH=95% align=center border=0 CELLPADDING=4"><TR><TD ALIGN=CENTER VALIGN=CENTER BGCOLOR=#FFFFFF nwrap COLSPAN=3 WIDTH=100%><A HREF="/speak/slideshow/22633759?c=1444434&ret=L2ZvcnVtL3IyMjYzNTI1NS54bWw%3D"><IMG class="apic" BORDER=0 TITLE="106618 bytes" WIDTH=600 HEIGHT=626 SRC="/r0/download/1444434.thumb600~a618c529cd3bdaafb8164e0e9b4224ee/phish email.PNG/thumb.jpg" ALT="Click for full size"></A><br>Looks real</TD></TR><TR><TD ALIGN=CENTER VALIGN=CENTER BGCOLOR=#FFFFFF nwrap COLSPAN=3 WIDTH=100%><A HREF="/speak/slideshow/22633759?c=1444435&ret=L2ZvcnVtL3IyMjYzNTI1NS54bWw%3D"><IMG class="apic" BORDER=0 TITLE="50909 bytes" WIDTH=600 HEIGHT=523 SRC="/r0/download/1444435.thumb600~adef64b0cd5ff6436b399b60922d1304/whereitgoes.PNG/thumb.jpg" ALT="Click for full size"></A><br>notice the address bar</TD></TABLE></div>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,22633759</guid>
<pubDate>Tue, 30 Jun 2009 11:24:04 EDT</pubDate>
</item>

</channel>
</rss>
