The link would take you to http://www.us-bp-im-pt.info/index_files/imp/us/index.html. According to http://www.afilias.info/whois_search/ the domain us-bp-im-pt.info was registered on May 18 (I received the email on May 19). The server is in China:
And the web page looks like:
I am getting a bit annoyed at these web pages because they defeat my ability to do a cut and paste, which forces me to reboot to regain those capabilities.
I got another one, supposedly from ReplyRequirvs@UsBank.com, with a subject of UsBank.com Security Update - URGENeo (note: it is also not URGENT, but this time it is URGENeo).
This time the link would actually go to http://www.abchost.us/tab/index.html. The domain abchost.us was actually registered on March 27, with a change made on May 19 (I received the email on May 28). As you can see below, the server is in China.
Dear Citibank Member, This email was sent by the Citibank server to verify your E-mail address. You must complete this process by clicking on the link below and entering in the small window your Citibank ATM/Debit Card number and PIN that you use on ATM.
This is done for your protection - because some of our members no longer have access to their email addresses and we must verify it.
To verify your E-mail address and access your bank account, click on the link below:
https://web.da-us.citibank.com/signin/citifi/scripts/email_verify.jsp
---------------------------------------
Thank you for using Citibank
The link does not take you to https://web.da-us.citibank.com, but rather to http://www.cservices.us/scripts/email_verify.htm
That domain was registered to someone in Australia on May 6 (I got the email on May 7), and the server is really in China:
That is not the only domain they use. The email I got on May 7 must have worked for some that received that messagem becayse I just got 51 copies on May 9 with the domain http://www.customerverify.us/scripts/email_verify.htm which was registered on May 7 to someone in New Jersey, and the server is also in China:
Clicking on the click here would go to http://paypal-supports.com/support/update.html. This domain name was registered on May 5 (I got the email on May 7), and this time the server is in the US:
I tried to save the complete webpage, but got an error trying to do that, but here is what it looks like:
For more information on the Tulsa Computer Society click here