• Apparent Sender: Hawaiian Tel Federal Credit Union
• Visible Link: a text of “Clic Here” in hyperlink form
• Phishing Link: http://213.207.2.99/horde/services/help/htfcu/index.html
• Phishing Technique Used: Explicit Display of Phishing URL
• Overview: Obtaining victim’s personal account information such MasterCard Check Card, expiration date, PIN and email address through spoofed URL. Spammed email pretends to be a legitimate Hawaiian Tel FCU verification email. The said email instructs the user to click a fake link that opens to a malicious Web site.

Email

The email instructs its recipients to sign in to their Hawaiian Tel FCU account through the link provided in the email. The visible link to readers of the said email is a text of Clic Here in hyperlink form. Clicking this hyperlink directs a user to the phishing Web site. The phishing URL, http:// 213.207.2.99/horde/services/help/htfcu/index.html, is seen in the status bar when the mouse is hovered over the visible link. Also, it may be seen when the email is viewed via a text editor such as Notepad.

Visited Site

The spoofed Web site bears a close resemblance to the legitimate Hawaiian Tel FCU’s online login Web page. The visible differences of the spoofed Web site as opposed to the official one are the URL displayed on the address bar and the absence of the security icon on the browser’s status bar.

After logging onto the spoofed Web site, it redirects to a Home Banking Self-Verification Web page asking the user to enter various account information such as MasterCard Check Card, expiration date, PIN code, and email address.

Verification Details

Nslookup Result:

Address: 213.207.2.99
Name: jaap3-gateway.twproductions.nl

Address 213.207.2.99 is listed in 1 antispam database.