Scam. You surmised correctly. The HTML snippet shows the reader one URL, but the real "target" of the link is somewhere else entirely. China, actually.
Three great web resources to find out who a domain is or where it is: http://openrbl.org http://whois.sc http://www.senderbase.org Using "whois" to look up the details on who registered a domain, you'll often find that spammy domains are only a few months old, and/or they have obviously fake contact details. Andrew 8) -----Original Message----- From: Goran Jovanovic [mailto:[EMAIL PROTECTED] Sent: Monday, June 14, 2004 7:46 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] USBank Scam? Hi all, I don't know enough about HTML to know if the link below is a normal way to do something, or if it simply meant to display the www.usbank.com info (which is what displays in the e-mail)and thengo the www.pll8782.info website? A client received this at home and is wondering if it is a phishing attempt? I know nothing of USBank if it is real or not. Below is an excerpt from the e-mail with the "double" link in it Any info on this would be appreciated. Thanx ============================================== During our regular update and verification of the Internet Banking Accounts, we could not verify your current information. Either your information has been changed or incomplete, as a result your access to use our services has been limited. Please update your information. To update your account information and start using our services please click on the link below: <a href="http://www.pll8782.info/faq_files/approved/index.html";>http://www. usbank.com/internetBanking/RequestRouter?requestCmdId=DisplayLoginPage</ a> Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
