Anti-Phishing Working Group: Washington Mutual Bank- 'Re-Submit: wamu.com Urgent requirementvu'

LATEST NEWS IN THE FIGHT AGAINST PHISHING:

Washington Mutual Bank- 'Re-Submit: wamu.com Urgent requirementvu'
21-Jan-2005

Summary

Email title:	'Re-Submit: wamu.com Urgent requirementvu', the last 2 letters are randomized
Scam target:	Washington Mutual Bank customers
Sender:	wamu-Notification-Urgelqht@wamu.com
Sender spoofed/hidden?	Spoofed
Phish 'punch line' :	'Please verify your account parity to given email'
Scam goal:	Getting victim's credit card information
Phish link method	URL link
Link 'masked'?	Yes
Visible link:	https://login.personal.wamu.com/verification.asp?d=1
Actual link to	http://200.101.59.26/webmail/w/index.html
Phish website IP:	200.101.59.26

E-mail

This phish uses some spam tactics to try to slip by filters, but this makes it more suspicious. Nevertheless, having a better chance in getting to the end-user, it remains dangerous.

And here is where these spam signs are:

The message subject's last 2 letters don't make sense, they are randomized in different instances of the same message;
The same applies to the message sender's last 4 letters;
There is some random text symbols at the end of the message:

The 'Encryption SSL Protection ID' is also a tricky way of adding random characters into the email.

Web Site

Visible link:	https://login.personal.wamu.com/verification.asp?d=1
Actual link to:	http://200.101.59.26/webmail/w/index.html
Phish website IP:	200.101.59.26

The phish site uses an address bar 'overwrite' forgery - but it is not too good, as you can see. Other suspicious moments are the lack of a login screen
and the missing lock icon in the lower right section of the status bar. The true URL of the site can be seen on the File/Properties page:

The site will only check if all fields have something in them - no further verification will be attempted. Next, a logout screen is displayed:

Everything on this last page is put to make things look normal, but, strangely, the address bar overwrite is removed so the true URL can be seen.

The scam is hosted on a server in Brazil:

WHOIS information (for IP 200.101.59.26):

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

ReferralServer: whois://whois.lacnic.net

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details, or check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2004-03-18

TechHandle: LACNIC-ARIN
TechName: LACNIC Hostmaster
TechPhone: (+55) 11 5509-3522
TechEmail: abuse@lacnic.net

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Hostmaster
OrgTechPhone: (+55) 11 5509-3522
OrgTechEmail: abuse@lacnic.net