This message claims that recipients are getting this letter because of new measures being implemented by the US Treasury Department. Yet it originates from Poland!

Fortunately the Web site has already been shut down. But if you see this wording again you can bet there's something phishy going on.

Message text:
*Important:*

You're getting this letter in connection with new directions issued by
U.S. Treasury Department. The directions concern U.S. Federal Wire
online payments.

A country-wide phishing attack began on April 21, 2009. It's taking
place hitherto. Therefore a great number of banks and credit unions is
affected by this attack and quantity of illegal wire transfers has
reached an extremely high level.

U.S. Treasury Department, Federal Reserve and Federal Deposit Insurance
Corporation (FDIC) in common worked out a complex of immediate actions
for the highest possible reduction of fraudulent operations. We regret
to inform you that definite restrictions will be applied to all Federal
Wire transfers from April 29 till May 8.

Here you can get more detailed information regarding the affected banks
and U.S. Treasury Department restrictions:

 http :// treasurydept.direct-ebank.us/32268/CM/wire/issue-127532/
<http :// treasurydept.direct-ebank.us/31970/CM/wire/issue-127333/>

*Federal Reserve Bank System Administration*

Headers:
Return-Path: <chris_odonnell @ uml.edu>
X-REPLACEME: No
Received: from 94-40-89-194.idk.net.pl (94-40-89-194.idk.net.pl
[94.40.89.194]) by [removed] (Postfix) with ESMTP id 017572FEF for
[removed]; Wed, 29 Apr 2009 01:40:23 +0300 (EEST)
Received: from [94.40.89.194] by emailgw2.uml.edu; Tue, 28 Apr 2009
23:42:36 +0100
Date: Tue, 28 Apr 2009 23:42:36 +0100
From: ADMINISTRATION <security @ banking.va.us>
X-Mailer: The Bat! (v3.62.14) Educational
Reply-To: chris_odonnell @ uml.edu
X-Priority: 3 (Normal)
Message-ID: <765534636.39422059108355 @ uml.edu>
To: [removed]
Subject: Read carefully - Important Customer Notification
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------4016E92584258B6E"

WHOIS direct-ebank.us
(Courtesy: http://whois.domaintools.com/direct-ebank.us):
Domain Status:     Deleted And Available Again

WHOIS sender IP 94.40.89.194
(Courtesy: http://whois.domaintools.com/94.40.89.194):
IP Location:       Poland  Poland Warsaw Agnes P.jedrzejek
Resolve Host:     94-40-89-194.idk.net.pl
IP Address:     94.40.89.194
descr:          Agnes P.Jedrzejek
country:        PL
admin-c:        PJ344-RIPE
tech-c:         BS4075-RIPE
status:         ASSIGNED PA
mnt-by:         TKTELEKOM-MNT
mnt-lower:      TKTELEKOM-MNT
mnt-routes:     TKTELEKOM-MNT
source:         RIPE # Filtered
person:         Pawel Jedrzejek
address:        74-100 Gryfino, PL
e-mail:         pawel @ idk.net.pl
e-mail:         info @ idk.net.pl
phone:          +48 914168198
phone:          +48 609838516
mnt-by:         TKTELEKOM-MNT
nic-hdl:        PJ344-RIPE
source:         RIPE # Filtered
person:         Bartek Swedrowski
address:        74-100 Gryfino, PL
e-mail:         bartek @ idk.net.p
e-mail:         admin @ idk.net.pl
phone:          +48 914168198
mnt-by:         TKTELEKOM-MNT
nic-hdl:        BS4075-RIPE
source:         RIPE # Filtered

Comments

Add New Search RSS

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."

---

Tag it: