An
Email with the Subject "CitiBusiness security system update" was
received in one of Scamdex's honeypot email accounts on Fri, 17 Mar 2006 09:10:51 -0800
and has been classified as a Generic Scam Email.
The sender shows as CitiBusiness Online Security Management Staff <securitystaff@citibusinessonline.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
assistanceessobpbankloginactivitydrawsafeaccountstaffcustomerserviceclientaccessprocessbusinesscustomlegalfundonlinebank userreference will securitydearhttps://citibusinessonlin...
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[received:] => Array
(
[0] => from relay1.cpsoftwaregroup.com (mailin.mailcentro.com [207.183.238.20])by uniplex.uniplex.com (8.12.5/8.12.5) with ESMTP id k2HHApK8001084for ; Fri, 17 Mar 2006 09:10:51 -0800
[1] => from mail.webbox.com (mail.webbox.com [207.231.76.69])by relay1.cpsoftwaregroup.com (8.13.3-MC/AXH&MJD/8.13.4.mjd-axh) with ESMTP id k2HHAeSD020114for ; Fri, 17 Mar 2006 09:10:40 -0800
[2] => from SMTP32-FWD by mail.webbox.com (SMTP32) id AED24F48F00A83F47; Fri, 17 Mar 2006 09:08:52 -0800
[3] => from webboxmx01.mailcentro.net [207.183.238.111] by mail.webbox.com with ESMTP (SMTPD32-8.12) id AD24F48F00A8; Fri, 17 Mar 2006 09:08:52 -0800
[4] => from -1214172712 (200-127-50-97.cab.prima.net.ar [200.127.50.97] (may be forged))by webboxmx01.mailcentro.net (8.13.3-MC/AXH&MJD/8.12.0.axh) with SMTP id k2HH07vO011109for ; Fri, 17 Mar 2006 09:10:15 -0800
[5] => from citibusinessonline.com (-1214169768 [-1213956840])by 200-127-50-97.cab.prima.net.ar (Qmailv1) with ESMTP id FB5E910C69for ; Sat, 18 Mar 2006 01:09:36 -0500
)
[date:] => Sat, 18 Mar 2006 01:09:36 -0500
[from:] => CitiBusiness Online Security Management Staff
[sender:] => CitiBusiness Online Security Management Staff
[to:] => Billing
[x-mailer:] => Array
(
[0] => <7608149112.20060318010936@citibusinessonline.com>
[1] => The Bat! (v2.00.2) Personal
)
[subject:] => CitiBusiness security system update
[x-priority:] => 3
[x-mc-sender:] => securitystaff@citibusinessonline.com
[x-mc-ipaddr:] => 200-127-50-97.cab.prima.net.ar [200.127.50.97] (may be forged)
[x-virus-scanned:] => by amavisd-milter at 200-127-50-97.cab.prima.net.ar
[x-mc-filter:] => Array
(
[0] => 3.0.2
[1] => 2.2.09
)
[x-mc-connected:] => Array
(
[0] => mail.webbox.com
[1] => 200-127-50-97.cab.prima.net.ar
)
[x-mc-filterskip:] => Array
(
[0] => 0
[1] => 0
)
[x-mc-filter(bodycnt):] => Array
(
[0] => 1
[1] => 1
)
[x-mc-filter-antivirus:] => Array
(
[0] => Scanned for virus - Status 0
[1] => Scanned for virus - Status 0
)
[x-mc-ctfilter:] => Array
(
[0] => CT RefID = str=0001.0A090205.441AED29.0015,ss=3,fgs=0 - Class:Bulk - Virus Threat:Unknown - Phishing Threat:Low
[1] => CT Engine Not Utilised
)
[x-mc-spamscore:] => 3.200000
[mime-version:] => 1.0
[content-type:] => multipart/related;boundary="----------D6BDD458CE71154"
[status:] => RO
[x-status:] =>
[x-keywords:] =>
[x-uid:] => 7827
[message-id:] => <7827@30892>
[x-scamdex-scores:] => S:110 P:97 A:95 L:90 E:107 G:89
[x-scamdex-classtype:] => S
[x-scamdex-classscore:] => 110
[x-scamdex-totscore:] => 588
[x-scamdex-kw:] => God,access,account,activity,assistance,bank,box,business,citi,citibank,customer,fund,inc.,legal,login,ltd,process,safe,service,software,staff
[x-scamdex-em:] => securitystaff@citibusinessonline.com
[x-scamdex-dir:] => P
[x-scamdex-id:] => P1204819267.M748511P23786V
[x-scamdex-copyright:] => This Email is Copyright Scamdex.com 2009, Reproduction Prohibited
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
We are looking forward to your support and understanding and inform you about new
CitiBusiness® department system updrade performed by security management team in
order to protect our clients from increased online fraud activity, unauthorized account
access, illegal funds withdrawal and also to simplify some processes.
9mgMBp1PwAoXPp7F2otGlmTEt0l3bGXk3d8FDavaJV7AkffmET416LFnM1rYTojLCrrgCYpmTyXeMdBr
The new updated technologies guaranty convenience and safety of CitiBusiness® account
usage. New services for your account will be effective immediately after an account
confirmation process by a special system activation application.
WGu3t9rgbUfTizGW28cE6D2ZbZdZdOr9vWdY5FfhzvaT5QP7Z2L5GN5QNtQ28icEfoDk4TCEnMxuEmCE
To take an advantages of current updrade you should login your account by using
CitiBusiness® Online application. For the purpose please follow the reference:
Please note that changes in security system will be effective immediately after relogin.
pnI6dOY28O4g9gUoFyJJqmnPbWjPjWuKkeRy3PBbGFrOWmeBVZkmmJdzGxo1tULN8EmcuYnbEQ1Aegca
Current message is created by our automatic dispatch system and could not be replyed.
For the purpose of assistance, please use the "User Guide" reference of an original CitiBusiness® website.
gyxDtJcZtC0KwLAFpYRVXh7B88cmnnxEW5tfPve87fUE1uirrcmotu1BDdZ1CxGyCZMru2BBhvfiZzKr
Best Regards, CitiBusiness® Security Staff.
K9RfETPh7PiImZtZY5rr844pzjIzUu1FEUUtNKzVBREYRWYQ2qjbvnB4IjEDOFitAeKn0kiCdYB6UzXX
