# MA-100.012006: MyCERT Advisory - Circulation of New Fraudulent Email

**Date:** 20 Jan 2006  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-100.012006  
**Advisory ID:** MA-100.012006

---

#### MyCERT received a report from a local Financial Institution regarding the circulation of a fraudulent email. Copy of the email is attached below for precautions purposes.
========Copy of the Fraudulent Email=============
From: Maybank2u Service
Reply-To: Maybank2u Service
Sent: Thursday, January 19, 2006 1:59 AM
To:
Subject: Please Verify
Inbox
Dear Maybank2u.com customer. Please read this message and follow it's instructions
Confirm Your Identity.
We are performing maintenance, which may interfere with access to your online services. Due to these technical updates your online account had been flagged and we must confirm you are the rightful owner of the account.
To Confirm Your Identity click the link below, please make sure you do this in a timely fashion as we look forward of bringing you updates regularly.
To get started, please click the link below:
https://secure.Maybank2u.com/
Important information from Maybank2u.com
This e-mail contains information directly 
Maybank2u.com and its service providers are committed to protecting your privacy and ask you not to send sensitive account information through email.
===============================
MyCERT had analysed the email and our analysis indicates the above email is a fraudulent email purportedly from Maybank requesting users/recipients to login to the links attached in the email.
Once clicked on the link given in the email, it re-directs to a phishing site with the below URL:
http://root.blackcobra-x.ws/~vex/mb2u/mbb/login.htm
Our analysis indicates the above phishing site is hosted on a server with the IP address 84.244.5.199 located in Sweden.
As of our checking now, the above phishing site is still accessible on the net. Currently, MyCERT had taken action to inform our counterpart in Sweden, the Swedish CERT to assist by communicating with relevant party/s to shutdown the phishing site immediately.
As a precaution against phishing activities, MyCERT advises the followings:
1. Do not click on any links or attachments received via emails or messages. Do not respond to such email and delete the email received immediately.
2. MyCERT advise users who receive any such emails to report to MyCERT or to the respective Financial Institutions for analysis and verification purposes.
3. All PCs/machines must be patched accordingly with latest patches.
4. Users must make sure their PCs are installed with personal firewalls and updated versions of anti-virus or anti trojan software.
5. Install pop-up blocker at your browsers using i.e. Google Toolbar, Yahoo Toolbar.
6. Users who are using Windows XP are advised to upgrade to Service Pack 2 as it comes with pop-up blocker.
Service Pack 2 for Windows XP, can be downloaded:
http://www.microsoft.com/windowsxp/sp2/default.mspx
7. System Administrators may consider to block these emails at their email gateways.
8. System Administrators may consider blocking the phishing site's IP address 84.244.5.199 and the site http://root.blackcobra-x.ws/~vex/mb2u/mbb/login.htm at their gateway.
MyCERT can be reached for assistance at:
Tel: 03-89961901
Fax: 03-89960827
Email: [[email protected]](/cdn-cgi/l/email-protection)
Web: [https://www.mycert.org.my/report\_incidents/online\_form.html](/report_incidents/online_form.html)
SMS: 019-2813801