News & Press releases

MX Lab has captured some emails intended for Belgian customers that have all the trademarks of phishing techniques.

A quick investigation learns us that this emails is not valid. The senders email address is from primenetworks.com or wcoasthosting.com. As subject we have "Notice for Citibank Customer" or "Important Notice for Citibank Belgium Customers".

The email itself is very traditional: claiming that your account could be abused and that you need to verify your details.

Following the links makes you go to for example:

http://xx.xx.xx.xxx/~adshead/components/com_login/www.citibank.be/
cbb.cd.citibank.be/CappWebAppBelgium/producttwo/capp/action/
UsernameSignon.do.php

http://www.citibank.be.verification.process.belgiumciti.dl.am/

Most of the used URLs are already unavailable or are suspended by the hosting provider like ld.am which is a free subdomain hosting provider.

Recommendation:

Citibank will never ask you to verify your details when your account was abused. Do not follow the instructions in these emails and don't give any critical information away by visiting the phishing web site. If in doubt make contact with your local Citibank representative.