more on Citibank Security Update/spoof

[Dave Farber <dave () farber net>]

From: Richard Perlman <perl () lucent com>

Dewayne:

If you change the text color of the email, or just paste it into a very dumb
editor (vi) you will see a lot of "text" that was in a white colored font.
Seemingly nonsense to fool SPAM filters.  But, interesting none-the-less.

Also, the actual link text was:
 https://web.da-us.citibank.com/signin/scripts/Iogin2/user_setup.jsp

... the URL was really:
 (http://web.da-us.citibank.com%2e%75%73%65%72%73%65%74%2e%6e%65%74:34/%63/%
69%6E%64%65%78%2E%68%74%6D)

So, while the link text was a seemingly safe citibank.com host, the URL was
really (if I read my ascii table correctly):
 http://web.da-us.citibank.com.userset.net:34/cindex.htm

Richard 

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/