Monday, November 30, 2009

Chase Bank phish

Today the top phishing scam that we are seeing in the UAB Spam Data Mine is attacking Chase Bank customers. Its part of the old Avalanche phishing scheme that has lately been seen primarily spreading Zbot trojans.

(Update: Scroll to bottom - Chase spam now replaced with "Ally Bank" spam)

The attack starts with an email similar to this one:



The attack began actually late on November 28th, when we saw 1,030 copies of the phishing email with these website names used:

chaseonline.chase.com.vsmidome1.co.uk
chaseonline.chase.com.vsmidome1.org.uk
chaseonline.chase.com.vsmidome2.co.uk
chaseonline.chase.com.vsmidome2.org.uk
chaseonline.chase.com.vsmidome3.co.uk
chaseonline.chase.com.vsmidome3.org.uk
chaseonline.chase.com.vsmidome.co.uk
chaseonline.chase.com.vsmidome.org.uk

The attack continued throughout the 29th (the UAB Spam Data Mine saw 11,320 copies on the 29th), adding many more website addresses:

chaseonline.chase.com.feccxz.co.uk
chaseonline.chase.com.feccxz.me.uk
chaseonline.chase.com.feccxz.org.uk
chaseonline.chase.com.ficcxz.co.uk
chaseonline.chase.com.ficcxz.me.uk
chaseonline.chase.com.ficcxz.org.uk
chaseonline.chase.com.fihlxz.co.uk
chaseonline.chase.com.fihlxz.me.uk
chaseonline.chase.com.fihlxz.org.uk
chaseonline.chase.com.fikcxz.co.uk
chaseonline.chase.com.fikcxz.me.uk
chaseonline.chase.com.fiklxz.co.uk
chaseonline.chase.com.fiklxz.me.uk
chaseonline.chase.com.fiklxz.org.uk
chaseonline.chase.com.gerchkx.co.uk
chaseonline.chase.com.gerchkx.me.uk
chaseonline.chase.com.gerchkx.org.uk
chaseonline.chase.com.gercxkx.co.uk
chaseonline.chase.com.gercxkx.me.uk
chaseonline.chase.com.gercxkx.org.uk
chaseonline.chase.com.gercxxx.co.uk
chaseonline.chase.com.gercxxx.me.uk
chaseonline.chase.com.gercxxx.org.uk
chaseonline.chase.com.gerhhkx.co.uk
chaseonline.chase.com.gerhhkx.me.uk
chaseonline.chase.com.gerhhkx.org.uk
chaseonline.chase.com.vsmidome1.co.uk
chaseonline.chase.com.vsmidome1.org.uk
chaseonline.chase.com.vsmidome2.co.uk
chaseonline.chase.com.vsmidome2.org.uk
chaseonline.chase.com.vsmidome3.co.uk
chaseonline.chase.com.vsmidome3.org.uk
chaseonline.chase.com.vsmidome.co.uk
chaseonline.chase.com.vsmidome.org.uk
chaseonline.chase.com.yurbzc.co.im
chaseonline.chase.com.yurbzc.com.im
chaseonline.chase.com.yurbzc.im
chaseonline.chase.com.yurbzc.net.im
chaseonline.chase.com.yurbzc.org.im
chaseonline.chase.com.yurtzc.im
chaseonline.chase.com.yuvtzc.co.im
chaseonline.chase.com.yuvtzc.com.im
chaseonline.chase.com.yuvtzc.im
chaseonline.chase.com.yuvtzc.net.im

(Fresh Domains added December 2, 2009:
chaseonline.chase.com.trefcc.be
chaseonline.chase.com.trefee.be
chaseonline.chase.com.treffb.be
chaseonline.chase.com.treffd.be
chaseonline.chase.com.treffe.be
chaseonline.chase.com.treffg.be
chaseonline.chase.com.treffq.be
chaseonline.chase.com.treffr.be
chaseonline.chase.com.treffs.be
chaseonline.chase.com.treffw.be
chaseonline.chase.com.treffx.be
chaseonline.chase.com.xeasdaq.be
chaseonline.chase.com.xeasded.be
chaseonline.chase.com.xeasdga.be
chaseonline.chase.com.xeasdki.be
chaseonline.chase.com.xeasdla.be
chaseonline.chase.com.xeasdmi.be
chaseonline.chase.com.xeasdoc.be
chaseonline.chase.com.xeasduj.be
chaseonline.chase.com.xeasdxk.be
chaseonline.chase.com.xeasdxl.be
chaseonline.chase.com.xeasdxt.be
chaseonline.chase.com.xeasdxx.be
chaseonline.chase.com.xeasdyh.be
)

The attack is still spamming like crazy this morning (we had 3,000+ copies as of 8 AM), but there have been no new domain names added, yet . . .

The website is a series of progressively more complicated questions which the phisher uses not just to steal your money, but to gain deep insight into your identity. Here are the series of questions:









For some reason today the phisher has decided that if he uses thousands of unique subject lines we're not going to realize its all the same phish.

We've counted 666 possible subject lines so far (coincidence?) with a large number of possible variants to these. For each of the below, there are also variants of the subject line which have:

message id: RND
message ref: RND

where the RND is a random number. The message ID or message ref can be enclosed in square brackets [], angle brackets <>, or paranthesis ().

There is also a variant of each followed by "- Ref No. RND", as well as a version ending in a period and a version ending in an exclamation point.

Here are the 374 base subject lines we're seeing today:

account confirmation
account management
account notification
account notification: security alert
account secure confirmation
account security measures
alert
alert - online client form released
alert - online form released
automatic account reminder
automatic notification
automatic reminder
banking alert - action required
banking alert: action required
banking mail from Chase Bank
Chase Bank customer service informs you
Chase Bank customer service team informs you
Chase Bank customer service: account confirmation
Chase Bank customer service: account management
Chase Bank customer service: account notification
Chase Bank customer service: account secure confirmation
Chase Bank customer service: account security measures
Chase Bank customer service: alert
Chase Bank customer service: alert - online client form released
Chase Bank customer service: alert - online form released
Chase Bank customer service: automatic account reminder
Chase Bank customer service: automatic notification
Chase Bank customer service: automatic reminder
Chase Bank customer service: client details confirmation
Chase Bank customer service: confirm your account details
Chase Bank customer service: confirm your account records
Chase Bank customer service: confirm your data
Chase Bank customer service: confirm your details
Chase Bank customer service: confirm your identity
Chase Bank customer service: confirm your information
Chase Bank customer service: confirm your online account details
Chase Bank customer service: confirm your online banking records
Chase Bank customer service: confirmation required
Chase Bank customer service: customer alert
Chase Bank customer service: customer details confirmation
Chase Bank customer service: data confirmation
Chase Bank customer service: details confirmation
Chase Bank customer service: enhanced online security measures
Chase Bank customer service: important account notice
Chase Bank customer service: important account notification
Chase Bank customer service: important announce
Chase Bank customer service: important banking mail
Chase Bank customer service: important information
Chase Bank customer service: important message
Chase Bank customer service: important note on security
Chase Bank customer service: important notice
Chase Bank customer service: important notification
Chase Bank customer service: important security notice
Chase Bank customer service: important security update
Chase Bank customer service: instructions for client
Chase Bank customer service: instructions for customer
Chase Bank customer service: message from customer service
Chase Bank customer service: message regarding your account
Chase Bank customer service: necessary to be read
Chase Bank customer service: new enhanced online security measures
Chase Bank customer service: new online security measures
Chase Bank customer service: new security measures
Chase Bank customer service: new security notification
Chase Bank customer service: notice to all customers
Chase Bank customer service: notification
Chase Bank customer service: official information
Chase Bank customer service: official update
Chase Bank customer service: online banking account confirmation
Chase Bank customer service: online banking alert
Chase Bank customer service: online banking form
Chase Bank customer service: online banking notice
Chase Bank customer service: online banking notification
Chase Bank customer service: online client form released
Chase Bank customer service: online form released
Chase Bank customer service: our enhanced online security measures
Chase Bank customer service: our new security measures
Chase Bank customer service: periodic account notification
Chase Bank customer service: please confirm your banking details
Chase Bank customer service: please confirm your data
Chase Bank customer service: please confirm your details
Chase Bank customer service: please confirm your information
Chase Bank customer service: please confirm your online banking account data
Chase Bank customer service: please confirm your online banking records
Chase Bank customer service: please read this message
Chase Bank customer service: please update your data
Chase Bank customer service: please update your details
Chase Bank customer service: safeguarding customer information
Chase Bank customer service: scheduled security maintenance
Chase Bank customer service: secure confirmation
Chase Bank customer service: secure details confirmation
Chase Bank customer service: securing customer data
Chase Bank customer service: security alert
Chase Bank customer service: security issues
Chase Bank customer service: security maintenance
Chase Bank customer service: security measures
Chase Bank customer service: security warning
Chase Bank customer service: service message
Chase Bank customer service: software updating
Chase Bank customer service: urgent message
Chase Bank customer service: urgent notification
Chase Bank customer service: urgent security alerts
Chase Bank customer service: urgent security notice
Chase Bank customer service: urgent security notification
Chase Bank customer service: urgent security notification for all clients
Chase Bank customer service: urgent security notification for client
Chase Bank customer service: urgent security notification for clients
Chase Bank customer service: urgent security warning
Chase Bank customer service: we need to update your information
Chase Bank customer service: you have 1 new security message alert
Chase Bank customer service: your account
Chase Bank customer service: your account with us
Chase Bank customer service: your online account
Chase Bank notification
Chase Bank online form
Chase Bank reminder: client details confirmation
Chase Bank reminder: client details form
Chase Bank reminder: confirm your account details
Chase Bank reminder: confirm your Chase Bank client details
Chase Bank reminder: confirm your details
Chase Bank reminder: notification
Chase Bank reminder: online form
Chase Bank reminder: please complete online form
Chase Bank reminder: please update your account data
Chase Bank reminder: please update your account details
Chase Bank reminder: please update your account records
Chase Bank reminder: please update your banking data
Chase Bank reminder: please update your banking details
Chase Bank reminder: please update your banking records
Chase Bank reminder: please update your data
Chase Bank reminder: please update your details
Chase Bank security upgrade
Chase Bank: account confirmation
Chase Bank: account management
Chase Bank: account notification
Chase Bank: account secure confirmation
Chase Bank: account security measures
Chase Bank: alert
Chase Bank: alert - online client form released
Chase Bank: alert - online form released
Chase Bank: automatic account reminder
Chase Bank: automatic notification
Chase Bank: automatic reminder
Chase Bank: client details confirmation
Chase Bank: confirm your account details
Chase Bank: confirm your account records
Chase Bank: confirm your data
Chase Bank: confirm your details
Chase Bank: confirm your identity
Chase Bank: confirm your information
Chase Bank: confirm your online account access
Chase Bank: confirm your online account details
Chase Bank: confirm your online banking records
Chase Bank: confirmation required
Chase Bank: customer alert
Chase Bank: customer details confirmation
Chase Bank: data confirmation
Chase Bank: details confirmation
Chase Bank: enhanced online security measures
Chase Bank: important account notice
Chase Bank: important account notification
Chase Bank: important announce
Chase Bank: important banking mail
Chase Bank: important information
Chase Bank: important message
Chase Bank: important note on security
Chase Bank: important notice
Chase Bank: important notification
Chase Bank: important security notice
Chase Bank: important security update
Chase Bank: instructions for client
Chase Bank: instructions for customer
Chase Bank: message from customer service
Chase Bank: message regarding your account
Chase Bank: necessary to be read
Chase Bank: new enhanced online security measures
Chase Bank: new online security measures
Chase Bank: new security measures
Chase Bank: new security notification
Chase Bank: notice to all customers
Chase Bank: notification
Chase Bank: official information
Chase Bank: official update
Chase Bank: online banking account confirmation
Chase Bank: online banking alert
Chase Bank: online banking form
Chase Bank: online banking notice
Chase Bank: online banking notification
Chase Bank: online client form released
Chase Bank: online form released
Chase Bank: our enhanced online security measures
Chase Bank: our new security measures
Chase Bank: periodic account notification
Chase Bank: please confirm your banking details
Chase Bank: please confirm your data
Chase Bank: please confirm your details
Chase Bank: please confirm your information
Chase Bank: please confirm your online banking account data
Chase Bank: please confirm your online banking records
Chase Bank: please read this message
Chase Bank: please update your data
Chase Bank: please update your details
Chase Bank: safeguarding customer information
Chase Bank: scheduled security maintenance
Chase Bank: secure confirmation
Chase Bank: secure details confirmation
Chase Bank: securing customer data
Chase Bank: security alert
Chase Bank: security issues
Chase Bank: security maintenance
Chase Bank: security measures
Chase Bank: security warning
Chase Bank: service message
Chase Bank: software updating
Chase Bank: urgent message
Chase Bank: urgent notice from customer service
Chase Bank: urgent notification
Chase Bank: urgent notification from customer service
Chase Bank: urgent security alerts
Chase Bank: urgent security notice
Chase Bank: urgent security notification
Chase Bank: urgent security notification for all clients
Chase Bank: urgent security notification for client
Chase Bank: urgent security notification for clients
Chase Bank: urgent security warning
Chase Bank: we need to update your information
Chase Bank: you have 1 new security message alert
Chase Bank: your account
Chase Bank: your account with us
Chase Bank: your online account
client details confirmation
cofirm your details with Chase Bank
confirm your account details
confirm your account records
confirm your data
confirm your details
confirm your identity
confirm your information
confirm your online account access
confirm your online account details
confirm your online banking records
confirmation required
customer alert
customer details confirmation
customer notice: data confirmation
customer notice: details confirmation
customer notice: your Chase Bank account
customer notice: your Chase Bank banking account
customer notice: your Chase Bank business account
customer notification: data confirmation
customer notification: details confirmation
customer service: your Chase Bank account
customer service: your Chase Bank banking account
customer service: your Chase Bank business account
data confirmation
dear Chase Bank client
dear Chase Bank customer
details confirmation
enhanced online security measures
Essential System Maintenance
important account notice
important account notice from Chase Bank
important account notification
important alert
important announce
important banking mail
important banking mail from Chase Bank
important banking mail: new online security measures
important Chase Bank mail
important information
important information for Chase Bank client
important information for Chase Bank clients
important information from Chase Bank customer service
important information from customer service
important information from customer service team
Important instructions
important instructions from customer service
important instructions from customer service team
important message
important message for Chase Bank client
important message from Chase Bank
important note on security
important notice
important notice from Chase Bank
important notification
important notification from Chase Bank
Important Scheduled Maintenance
important security notice
important security update
information from Chase Bank customer service
information from Chase Bank customer service team
instructions for client
instructions for customer
instructions for our customers
instructions from customer service
instructions from customer service team
message from customer service
message from customer service team
message regarding your account
necessary to be read
new enhanced online security measures
new online security measures
new security measures
new security notification
notice to all customers
notice: confirm your online banking records
notice: confirm your online records
notification
notification from Chase Bank
official information
official information for all Chase Bank clients
official information for Chase Bank client
official information for client of Chase Bank
official information from Chase Bank customer service
official update
online banking account confirmation
online banking alert
online banking form
online banking notice
online banking notification
online client form released
online form released
our enhanced online security measures
our new security measures
periodic account notification
please confirm your banking details
please confirm your data
please confirm your details
please confirm your information
please confirm your online banking account data
please confirm your online banking records
please read this message
please update your data
please update your details
please update your online banking records
safeguarding customer information
Scheduled Maintenance program
scheduled security maintenance
secure confirmation
secure details confirmation
securing customer data
security alert
security issues
security maintenance
security measures
security warning
service message
service message from Chase Bank
service notification from Chase Bank
software updating
update your details with Chase Bank
urgent message
urgent message for Chase Bank client
urgent message from Chase Bank
urgent notice from customer service
urgent notification
urgent notification from customer service
urgent security alerts
urgent security notice
urgent security notification
urgent security notification for all clients
urgent security notification for client
urgent security notification for client of the Chase Bank
urgent security notification for clients
urgent security warning
we need to update your information
you have 1 new security message alert
your account with Chase Bank
your account with us
your banking account with Chase Bank
your Chase Bank account
your online account
your online account with Chase Bank
your online banking account with Chase Bank

Ally Bank Phish



It looks like this spam campaign is migrating to Ally Bank now. Here are the websites:

secure.ally.com.hreesf.com.im
secure.ally.com.hreesv.org.im
secure.ally.com.hreesf.co.im
secure.ally.com.hreesv.co.im
secure.ally.com.hreesf.im
secure.ally.com.hrees.org.im
secure.ally.com.hreesv.com.im
secure.ally.com.hreesv.net.im
secure.ally.com.hreesf.net.im
secure.ally.com.gerfasu.be
secure.ally.com.hrees.com.im
secure.ally.com.gerfase.be
secure.ally.com.gerfast.be
secure.ally.com.gerfasx.be
secure.ally.com.hrees.im
secure.ally.com.gerfasq.be
secure.ally.com.gerfasr.be
secure.ally.com.gerfaso.be
secure.ally.com.gerfasw.be
secure.ally.com.gerfasy.be
secure.ally.com.hrees.co.im
secure.ally.com.hrees.net.im
secure.ally.com.hreesv.im
secure.ally.com.gerfasi.be
secure.ally.com.hreesf.org.im
secure.ally.com.iuuhet.co.uk
secure.ally.com.iuoket.co.uk
secure.ally.com.iuuhet.me.uk
secure.ally.com.iuohet.me.uk
secure.ally.com.iuohet.co.uk
secure.ally.com.iuuhet.org.uk
secure.ally.com.iuoket.me.uk
secure.ally.com.iuohet.org.uk
secure.ally.com.iuoket.org.uk

and here are some of the spam subjects:

Ally Bank (former GMAC Bank) customer form
For attention of Ally Bank (former GMAC Bank) customer
GMAC Bank is now Ally Bank
Instructions for Ally Bank (former GMAC Bank) customer
New version of Ally Bank (former GMAC bank) customer form has been released

An email sample:




Followed by the webpage series:





No comments:

Post a Comment

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.