There is an email which appears to be from “Citibank”, which requests
customers to update their information on the scammer’s website. The
link on the page is directed to:

http://web.da-us.citibank.com.ssl898.pk/citifi/scripts/login2/index.html

Note the top-level domain name is NOT
citibank.com, but http://ssl898.pk, a domain name from Pakistan. We
tried the link only today, and the website has been removed.

Attached is the full email and header. Note the colour scheme which is similar to the usual citibank’s.

——– Header ——-
X-Originating-IP:    [88.240.228.67]
Return-Path:    [security@citibank.com]
Authentication-Results:    mta328.mail.scd.yahoo.com from=Citibank.com; domainkeys=neutral (no sig)
Received:    from 88.240.228.67 (HELO co.hennepin.mn.us) (88.240.228.67) by mta328.mail.scd.yahoo.com with SMTP; Thu, 14 Sep 2006 09:41:08 -0700
Message-ID:    [A4A51844.1952760@vista.com]
Date:    Thu, 14 Sep 2006 19:41:17 +0300
From:    “securityCitibank.com” [security@Citibank.com]  Add to Address BookAdd to Address Book  Add Mobile Alert
To: XxXXXXxxXX
Subject:    Additional Security Requirements

Related articles:

1. Fake Email from US Department of Homeland Security We received this report in our hotscams.com mail box about a fake email circling around...
2. Email Scam: Watch the Email Addresses How do we know its a email scam when we see one? Most of the...
3. Warning – Fake Paypal Email Scam Attached below is the fake paypal email. Those who are not familiar with such scams...