uk bank phish

[browolf]

i've noticed all (the ones i'm getting atm) are the work of the same dude (group). they can be identified because they all run from a folder called "rock". often there are multiple scams runing from the same compromised host in the same way a group that used port 4901 used to do a year ago.

they're all running on presumably a preconfigured Apache/2.0.46 (CentOS) Server. why it mentions centOS i dont know cos the hosts are, the ones i've checked, all windows boxes.

the mails tend to be grouped ie in nov it was all barclays, then halifax and lloyds tsb, and now they're all natwest. why i need to receive like 5 a day for the same bank for days I don't know. it's not like they're much different, possibly trying to avoid spam filters but anyone that gets more than a few a day is bound to get suspicious one would think.

examples:- for each bank the email is always identical.









example subject lines, as you can also see there's hidden spam junk on each of the messages

[J4NK]

In my experience they work in teams with exploited or preconfigured servers.
Well 5 a day, not bad but at least you didn't win the MICROSOFT MEGA JACKPOT 18 times today

MANAGER,INTERNATIONAL PROMOTIONS/PRIZE
AWARD DEPARTMENT MICROSOFT MEGA JACKPOT
LOTTERY, UNITED KINGDOM.
89 New Fetter Lane London,EC4A 1AG U.K
MR. TINZO PAOLO
PHONE #:+44 7031915205, +44 7031844897
FAX#: +44 7005980586


REF NO: MSW/56B-672GH/L
BATCH: 4583JL/WIN

MICROSOFT MEGA JACKPOT LOTTERY PROMOTIONS,EMAIL AWARD PROMO: UNITED KINGDOM

Finally today, we announce the winners of the MICROSOFT MEGA JACKPOT LOTTO WINNINGS PROGRAMS held on 31st of October, 2005. Your company or your personal e-mail address, attached to winning number 23-76-06-54-42-100, With serial number 647489, consequently won in the Tenth lottery category.

You are therefore been approved for lump sums pay out of GBP 5,500,000.00 POUNDS ($10,464,000 USD) in cash Credited to file REF NO: MSW/56B-672GH/L and winning number 23-76-06-54-42-100, this is from total prize money of GBP 27,500,000.00 POUNDS, shared among the Twenty five (25)international winners in this category.

All participants were selected through our Microsoft computer ballot system drawn form 42,000 Names, 6,000 names from each continent, as part of International "E-MAIL" Promotions Program, for our prominent MS WORD user all over the world, and for the Continues use of E-mail. Your fund (certified Cashiers cheque) has been insured with your REF NO: MSW/56B-672GH/L and winning number 23-76-06-54-42-100. To claim your winning prize, you must first contact the claims department by email for Processing and remittance of your prize money to you.

The claims processor is:

Name : Robert Spencer
e mail: ukbobspencer2@yahoo.co.uk

Phone: +44- 703- 1913- 969
+44- 703- 1945- 906

Do email the above email addresses, all at once. In order to avoid unnecessary delays and complications, please remember to quote your reference and winning numbers in all correspondences with your claims officer.

PLEASE NOTE THAT YOU ARE TO SEND THE BELOW INFORMATIONS REQUIRED TO CLAIM YOUR WINNING PRIZE:

1. FULL NAMES: _______________________________________________________

2.NATIONALITY: _______________________________________________________

3. DATE OF BIRTH ________________________________________

4. SEX: _________________________

5. MARITAL STATUS: _____________________________________

6. CONTACT ADDRESS: _____________________________________________

7. TELEPHONE NUMBER: ___________________

8. OCCUPATION: _________________________________

9. WINNING E-MAIL ADDRESS:________________________________

10.REF/ BATCH NUMBERS:_________________________________________

11.TOTAL AMOUNT WON:_________________________________________

Upon reciept of the duly requested data,i`ll send you the contact information of the payment office so you can proceed with effecting the release of your claim in anyway you deem fit, summit back immediately

Sincerely,
Secretary
Mrs. Maurrine Diane H.

NOTE: Do not reply this mail. You are to contact your claims officer immediately by email. Or call the promotion director MR. TINZO PAOLO on PHONE #:+44 7031915205, +44 7031844897 to confirm your winnings.

SPONSORS: MS-WORD WORLD WIDE, GLOBAL EXPRESS COURIER, YAHOO.COM, UK2.NET, HSBC BANK.

The name Roberts Spencer belongs to a very well know anti-jihadie. It is not his real name but rather a pen name.

[foxyloxley]

any chance of a C+P of the offending item Browolf ??

[I HATE one liner replies]

[browolf]

cut and paste? not really cos the email bodies are images which are included, encoded inside the email. have uploaded pictures of the original emails and linked them on post above.