[IP] more on Citibank Security Update/spoof
From: Richard Perlman <perl@xxxxxxxxxx>
Dewayne:
If you change the text color of the email, or just paste it into a very dumb
editor (vi) you will see a lot of "text" that was in a white colored font.
Seemingly nonsense to fool SPAM filters. But, interesting none-the-less.
Also, the actual link text was:
https://web.da-us.citibank.com/signin/scripts/Iogin2/user_setup.jsp
... the URL was really:
(http://web.da-us.citibank.com%2e%75%73%65%72%73%65%74%2e%6e%65%74:34/%63/%
69%6E%64%65%78%2E%68%74%6D)
So, while the link text was a seemingly safe citibank.com host, the URL was
really (if I read my ascii table correctly):
http://web.da-us.citibank.com.userset.net:34/cindex.htm
Richard
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/