Hsbc Safeguard Account Update – Phishing

Phishing Scam

Another Banking phish. This time HSBC. What makes this “slightly” more believable is the url the phishing email leads to   which is a very plausible web address and easily mistaken for a genuine HSBC address. Luckily they didn’t bother to add a SSl certificate, but if they had done and the web address started with HTTPS: then more victims would be likely to fall for this scam.

There are several different subjects in this phishing campaign that I have seen so far :

  • HSBC Safeguard
  • Account Update
  • Account Verification
  • Update
  • Action Required

All the senders are random and coming via botnets not the email address listed in the email. So in this example, not only is the HSBC team spoofed but the is also spoofed.

From: HSBC Team <>

Date: Tue 14/02/2017 08:22

Subject:  HSBC Safeguard

Body content:


Privacy & Security
HSBC Safeguard

Action Required
HSBC Safeguard is a collection of measures taken to safeguard your hard-earned savings and savings from online and financial fraud. To accomplish this, we need to ensure that the record we have about you is correct and up to date. We’ll use this information to protect you, and ourselves, from financial crime. We take our obligation to protect your data very seriously. All the information you provide will be subject to HSBC Group’s data and security standards to ensure its protection. Please click on “Update” button below to start your updating procedure. Update Please note, your online and card services will remain blocked until you complete the process. Thank you, HSBC
HSBC Bank plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. It is listed with the registration number 114216. HSBC Bank plc is a company incorporated under the laws of England and Wales with company registration number 14259 and its registered office at 8 Canada Square, London E14 5HQ. HSBC Bank plc’s registered VAT Number is GB 365684514. © HSBC Bank plc 2017


Email Headers:

Received: from [] (port=63650 helo=
by with smtp (Exim 4.88)
(envelope-from <>)
id 1cdYV5-0001fN-6o
for; Tue, 14 Feb 2017 08:30:16 +0000
Received: from unknown (HELO gyyi4q) ([])
by with ESMTP; Tue, 14 Feb 2017 15:34:41 +0700
Message-ID: <001701d2869c$8e938b60$6b3b793e@WINDOWS0PCDEJAgyyi4q>
From: “HSBC Team” <>
To: <>
Subject: HSBC Safeguard

IP Hostname City Region Country Organisation Hanoi Thanh Pho Ha Noi VN AS45899 VNPT Corp US
Note: Only the final IP address outside of your network in the Received: fields can be trusted as others can be spoofed


The link goes to  where you see a webpage like this, which leads to a typical set of  phishing pages asking for all your bank, credit card and personal details, so they can empty your bank and credit card accounts and take over your identity completely.

Once again the registrars are not taking enough precautions and allowing dodgy domain names to be registered to non existent  people. It clearly shows a not acceptable registrant, so why was the domain registered at all. If there are incomplete or obviously false details then registrations should not be automatic, but held in a queue and manually examined and accepted or rejected

Address lookup

canonical name

Domain Whois record

Queried with ““…

Domain name:

        Not Acceptable

    Registrant type:

    Registrant's address:
        IJweg 9
        Nieuw Vennep
        2152 ND

    Data validation:
        Nominet was not able to match the registrant's name and/or address against a 3rd party source on 13-Feb-2017

        PDR Ltd. d/b/a t/a [Tag = PDR-IN]

    Relevant dates:
        Registered on: 13-Feb-2017
        Expiry date:  13-Feb-2018
        Last updated:  13-Feb-2017

    Registration status:
        Registered until expiry date.

    Name servers:

    WHOIS lookup made at 08:57:21 14-Feb-2017