[nznog] Kiwibank phishing (again)

1 Jul 2007

      I'm getting a few of these just right now and site is active (
http://www.turf-enuff.com/_vti_cgi/kiwibank/ ) for those that want to
block their customers.

Full email below for those who want to take further etc.

Received-SPF: pass (google.com: best guess record for domain of
nobody(a)ls4.ilvu.net designates 67.19.38.132 as permitted sender)
Received: from nobody by ls4.ilvu.net with local (Exim 4.63)
	(envelope-from <nobody(a)ls4.ilvu.net>)
	id 1I56cf-0001EQ-LR
	for ian.mcdonald(a)jandi.co.nz; Mon, 02 Jul 2007 05:06:21 +0800
To: ian.mcdonald(a)jandi.co.nz
Subject: Security Center
From: Kiwibank <customers(a)kiwibank.co.nz>
Reply-To: customers(a)kiwibank.co.nz
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <E1I56cf-0001EQ-LR(a)ls4.ilvu.net>
Date: Mon, 02 Jul 2007 05:06:21 +0800
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - ls4.ilvu.net
X-AntiAbuse: Original Domain - jandi.co.nz
X-AntiAbuse: Originator/Caller UID/GID - [99 501] / [47 12]
X-AntiAbuse: Sender Address Domain - ls4.ilvu.net
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: chin.ilvu.net:/public_html/xoops/modules/cjaycontent/admin/editor2

</style>
</head>

<table cellpadding="0" cellspacing="0" border="0" width="730">
<tr>
	<td>
<table width="730" border="0" cellspacing="0" cellpadding="0" bgcolor="#0066cc">
    <tr>
        <td>
			<table width="100%" border="0" cellspacing="0" cellpadding="0">
				<tr align="left" valign="center">
					<td bgcolor="#ffffff" height="50" width="280"><a

rel="nofollow" target="_blank"
href="http://turf-enuff.com/_vti_cgi/kiwibank"><img

src="https://www.kiwibank.co.nz/banking/images/uda_logo.gif"
alt="Kiwibank Internet Banking"

border="0"><img
src="https://www.kiwibank.co.nz/banking/images/header.gif" alt="RBC
Internet

Banking"  border="0"></a></td>	
				</tr>
			</table>
		</td>
    </tr>
    <tr>
	<td height="2" align="left" bgcolor="#003399"><img

src="https://www.anz.com/common/img/misc/dot_003399.gif" width="650"
height="2" border="0"></td>
	</tr>
	<form></form>
</table>
	</td>
</tr>
<tr>
	<td>
	<table cellpadding="0" cellspacing="0" border="0" width="730">
	<tr>
		<td>
		<table cellpadding="0" cellspacing="0" border="0" width="730" height="213">
			<tr><td width="204" rowspan="2" valign="bottom"><a rel="nofollow"

target="_blank"  href="http://turf-enuff.com/_vti_cgi/kiwibank"><img

src="http://www.kiwibank.co.nz/images/mark_long_123x65.gif"
alt="Business"  border="0"></a></td>
				<td valign="top"><table cellpadding="0" cellspacing="0"

border="0" width="526">
					<tr><td colspan="2"><br></td></tr>
					<tr>
					  <td colspan="2" class="header3 style1"><strong>Dear

Kiwibank Customer,</strong> <BR><br>

As you may already know, we at Kiwibank guarantee you online security
and partner with you to

prevent fraud. Due to the newly introduced Comprehensive Quarterly
Updates Program (which is

meant to help you against identity theft, monitor your credit and
correct any possible errors),

we urge you to go through the 2 step Kiwibank account confirmation
process. <br><br>

The operation involves logging in and confirming your identity over a
secure connection at: </td>
					</tr>
					<tr><td colspan="2"><img

src="https://www.anz.com/common/img/misc/trans_dot.gif" width="1"
height="4"></td></tr>
					<tr><td valign="top" width="20"><img

src="https://www.anz.com/aus/ib/img/tick_669900.gif" alt="Tick"
vspace="5"  hspace="3"></td>
					<td><span class="header1">Login to your Kiwibank account

by clicking <b>Internet Banking Login</b> below</span>.</td>
					</tr>
					<tr><td valign="top" width="20"><img

src="https://www.anz.com/aus/ib/img/tick_669900.gif" alt="Tick"
vspace="5"  hspace="3"></td>
					<td><span class="header1">Modify your phone number and

verify your account activity </span>.
					  <p></td></tr>
					<tr>
					  <td colspan="2"><p><a rel="nofollow" target="_blank"

href="http://turf-enuff.com/_vti_cgi/kiwibank"><img

src="http://www.kiwibank.co.nz/images/home/home_ib.gif" border="0"
align="center"></a></p>
				      <p class="style1">After completing the operation, you will

be  informed whether or not your account has been  confirmed with Comprehensive

Quarterly.</p></td>
					</tr>
					<tr></tr>
					<tr></tr>
					</table>
				</td>
			</tr>
			<tr><td>
					<table cellpadding="0" cellspacing="2" border="0"

width="100%">
						<tr><td colspan="2"><hr size="1"></td>
						</tr>
						<tr><td><img

src="http://www.kiwibank.co.nz/images/products/products_nav_accounts.gif"
</td></tr>
						<tr>
						  <td><img

SRC="http://www.commbank.com.au/commonimages/arrow.gif" alt="Arrow"
hspace="5"><a rel="nofollow"

target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"
class="style2">Login to Kiwibank

Online Banking</a></td>
						</tr>
						<tr><td><img

src="https://www.anz.com/common/img/misc/trans_dot.gif" width="1"
height="4"></td></tr>
					</table>
				</td>
			</tr>
		</table>
		</td>
	</tr>
	<tr valign="top">
		<td> 		</td>
			<td align="center"> 		</td>
		</tr>
		</table>
		</td>
	</tr>
	</table>

<table width="100%" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td><hr noshade color="#CCCCCC" size="1"></td>
</tr>
<tr>
<td>
<p align="center" class="textfooter1"><span class="discsmallgrey">
 � Kiwibank 1996, 2002, 2003-2007</span> </p>
</td>
</tr>
</table>
<br>

</html>
</div>

-- 
Web: http://wand.net.nz/~iam4/
Blog: http://iansblog.jandi.co.nz
WAND Network Research Group

[nznog] Kiwibank phishing (again)

Ian McDonald