Anatomy of an AIB Phishing Email

I’m well used to getting phishing emails for American or internationally known banks but this morning an email supposedly from AIB made it past Gmail’s spam filters.

AIB phishing email

AIB posted an alert a few days ago to watch out for fraudulent emails, but this one appears to be different. I’m forwarding it on to alert@aib.ie

The content of the email is a Jpeg image, and it links to a php file on http://internetbanking.aib.ie.2.3h8ax3.com/

As the rest of this post has a number of large screenshots click the link below to read the rest. You can probably ignore this if you’re not living in Ireland. 🙂

Continue reading “Anatomy of an AIB Phishing Email”

The strangest invoice ever

Just moments ago I received the following in an email. Searching for the companies mentioned doesn’t return anything useful or suspicious so I thought I’d post it here in case anyone else got it too.

**Electronic Invoice** Date: January 5, 2007

To: From:
Massimo Ferranti AllWebCo
Delfo Italiana Srl 180 Juniper Avenue
Via Varese 9 Satsuma, AL 36572
Muggio, MI 20053 Italy

Item Description Rate Amount
———————————————————————–
Annual Hosting denav.com $599.40/year $599.40
————————————————————————
Tax (0%) 0.00
– Balance Due when rendered – Total $599.40

Total Paid $599.40
Balance Due $ 0.00

********************************************
AllWebCo
To change the credit card we bill for your account:
https://plus40.safe-order.net/allwebco/cc_change.shtml
–=============–
To pay through PayPal:
http://allwebco.com/paypal-payment.htm
–=============–
To pay by electronic check, please use the following secure url:
http://www.allwebco.com/icheckpay.shtml
–=============–
Please make any checks payable to AllWebCo, and mail to:
AllWebCo
180 Juniper Ave.
Satsuma, AL. 36572
–=============–
If you have any questions regarding your billing, please
email Billing@AllWebCo.com

********************************************

Moments later I received a thank you email in response to payment of the invoice. The mind boggles.

Hi,

Thank you!

We have received your new billing information and have renewed the annual
hosting for denav.com.

Total cost $599.40.

Have a wonderful day,

Kendra
AllWebCo

Do not delay – how to spot a fake charity flyer

Update! (2009-10-28) 3 years later and the Do Not Delay website has been updated. Thanks to this comment for pointing it out. Their About the Project page gives a detailed account of what they do in Lithuania:

Six years ago, the Lithuanian rate of deaths caused by breast cancer was the highest in Europe.

DO NOT DELAY, a breast cancer awareness program, was initiated by Agnė Zuokienė in 2003. Today, the number of deaths is significantly lower.

The Do Not Delay team includes professional doctors – specialists of their field who face breast cancer cases on a daily basis.

The Pink Bus travels to the most remote locations in Lithuania to deliver the message to all women – “Take care of your health, pay more attention to yourselves for your own sake and for the sake of those who love you!”

It would appear from this that “Do Not Delay” are in fact a charity in Lithuania. They’re not registered as one in Ireland or the UK however. This report by the Fermanagh Herald covers some of the same concerns I have and I will repeat my advice below. You’re better off handing your clothes in to a local second hand shop. At least then you’ll be certain the proceeds from the sale of those items will go to registered charities in your locality.

The original post continues below:

Do not delay! It’s not unusual for junk mail to be delivered to my door. Thankfully there’s a lot less of it than the electronic equivalent. Over the summer a number of flyers made their way to my doorstep, supposedly from charities looking for old clothes to sell to raise funds. Unfortunately only one of those was from an actual charity and they collected the clothes at a local carpark.

The latest one is from donotdelay.org. I was going to let it pass but my neighbour had a bag out for collection this morning which prompted me to grab the laptop and show them this page on letterbox spam. That page points out that donotdelay.org redirects to nedelsk.lt, which asks for donations to be sent to this bank account in Vilnius, Lithuania.

Azzara VšĮ
Enterprise code 124013046
Account no. LT267044060001204079
SEB Vilniaus Bankas
Bank code 70440

There’s a phone number too, 0044-28-3084-9971, which is a UK number and not exactly encouraging for an Irish person.

How do you spot the fake charity flyers?

  • It will have a contact number but it’s more than likely a mobile number. In Ireland, that’s an 085, 086, 087 number. A landline number means that they at least have a base or premises in the country.
  • The flyer should have a registered charity number. A registered business number is not the same.
  • Ring your local authority and ask if the “charity” is licensed to make door-to-door collections.
  • Use the Google search engine to find out about them. Use any registration numbers you find, an identifying website address, even search for text from the flyer. Any charity with the resources to organise a door-to-door clothes collection will have at least some presence on the Internet.

If you do have old clothes to give away, pop them into a bag and bring them into one of the charity shops in your local town or city. They’re always looking for quality saleable items. Here’s a list of Irish charities if you want to donate money. Some well known and reputable charities include Trocaire (they even have an rss feed!), Bothair and Simon Community.

If you live in the UK, this page has some useful information including how to report a fake charity.

“Do Not Delay” collect money for breast cancer research but you would be better off making a donation to The Irish Cancer Society who will put your donation to good use.

I’ll update this post from time to time with thumbnails and summaries of flyers that hit my door. Check back often!

Just as I was wondering when donotdelay would collect their clothes I spotted an old blue van parked outside. It’s a Dublin reg vehicle and quite old, given that it’s a van and presumably used for business. The reg is “97 D 45516”. I spotted a man in denims walking down the road. He ducked into a house at a corner for a moment then walked up a hill out of sight. I waited a few minutes and he returned with a woman. Both got into the van, drove down to the end of the cul-de-sac and about 5 minutes later drove past again. On closer examination of the photos below I recognised the top of the heart shaped flyer they had in their hands. One was delivered here a few weeks back. I might have it arond here somewhere.

More flyers being handed out

Update: Another blogger received the same flyer. Hopefully someone will search online for “Clothing Collection For Breast Cancer Prevention Programm”.

2006-11-21 – a new leaflet was dropped in the door a few minutes ago. It has an Irish mobile number, 0876815133, and reg. no. 382101. No sign of a charity number.

Not every family in developing countries can afford to buy new, often expensive clothes, footwear and household things.

If you search for their reg no. the first link is a pdf file (view as HTML) from Dublin City Council. Councillor Naoise O’Muiri asked, in a question to the City Manager, if he can

confirm that the following agencies currently engaged in collections in the City Area have all applied for and received Permits: …
“Unwanted Clothing Collection”, no Reg No given, 087 0552513

He replied:

The Collectors referred to by the Councillor do not have a waste collection permit from Dublin City Council.

Chances are they’re collecting ilegally in Cork too.

2006-11-29 – “Thank you for help” – another flyer appeared this morning before 8am, they’re out early! Identifying text includes the above badly constructed sentence and: “we urgently need clothing that you and your family may never wear again” and “Company Reg. Nr. 5655565A”, “Phone: +353851670878” – another mobile number. No landline, address or charity number.

2006-12-05 – “We support Orphanages.” just fell in the door. Here are their details: Reg. no. 9027839, phone 085-1337528. That’s a mobile phone number.

Update! I have set up a new site, Clothingcollection.org where I post details about all the fake charity leaflets I get. I’m sure you’ll recognise a few of them!