{"id":128,"date":"2023-05-05T10:29:52","date_gmt":"2023-05-05T15:29:52","guid":{"rendered":"https:\/\/freshphish.info\/?p=128"},"modified":"2023-09-23T16:16:16","modified_gmt":"2023-09-23T21:16:16","slug":"phish-landing-page-hosted-on-citibank-server-redirects-to-phish-on-microsoft-server","status":"publish","type":"post","link":"https:\/\/freshphish.info\/?p=128","title":{"rendered":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server"},"content":{"rendered":"\n<p>I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1006\" height=\"457\" src=\"https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank01.jpg\" alt=\"\" class=\"wp-image-129\" srcset=\"https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank01.jpg 1006w, https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank01-300x136.jpg 300w, https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank01-768x349.jpg 768w\" sizes=\"auto, (max-width: 1006px) 100vw, 1006px\" \/><\/figure>\n\n\n\n<p>You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the link.<\/p>\n\n\n\n<p>Here is the page I was redirected to from the landing page on Citibank to a subdomain of windows.net.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"753\" height=\"568\" src=\"https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank02.png\" alt=\"\" class=\"wp-image-130\" srcset=\"https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank02.png 753w, https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank02-300x226.png 300w\" sizes=\"auto, (max-width: 753px) 100vw, 753px\" \/><\/figure>\n\n\n\n<p>I notified Citibank of the phish landing page on their servers and it appears they and Microsoft have taken it down from their respective pages.<\/p>\n\n\n\n<p>&#8211;Matt<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further<\/p>\n<p><a href=\"https:\/\/freshphish.info\/?p=128\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\">Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[12],"tags":[42,19,4],"class_list":["post-128","post","type-post","status-publish","format-standard","hentry","category-phish","tag-citibank","tag-microsoft","tag-phish"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.9 - aioseo.com -->\n\t<meta name=\"description\" content=\"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Matt\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/freshphish.info\/?p=128\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.9\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Fresh Phish - All the freshest phish\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish\" \/>\n\t\t<meta property=\"og:description\" content=\"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/freshphish.info\/?p=128\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-05-05T15:29:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-09-23T21:16:16+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish\" \/>\n\t\t<meta name=\"twitter:description\" content=\"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#blogposting\",\"name\":\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish\",\"headline\":\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server\",\"author\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/?author=1#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/freshphish.info\\\/wp-content\\\/uploads\\\/2023\\\/05\\\/citibank01.jpg\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128\\\/#articleImage\",\"width\":1006,\"height\":457},\"datePublished\":\"2023-05-05T10:29:52-05:00\",\"dateModified\":\"2023-09-23T16:16:16-05:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#webpage\"},\"articleSection\":\"Phish, Citibank, Microsoft, phish\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/freshphish.info\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?cat=12#listItem\",\"name\":\"Phish\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?cat=12#listItem\",\"position\":2,\"name\":\"Phish\",\"item\":\"https:\\\/\\\/freshphish.info\\\/?cat=12\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#listItem\",\"name\":\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#listItem\",\"position\":3,\"name\":\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?cat=12#listItem\",\"name\":\"Phish\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/#organization\",\"name\":\"Fresh Phish\",\"description\":\"All the freshest phish\",\"url\":\"https:\\\/\\\/freshphish.info\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?author=1#author\",\"url\":\"https:\\\/\\\/freshphish.info\\\/?author=1\",\"name\":\"Matt\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/82f14a734f69eb729d8b59b4a2438ea6e14bd793d23b22d4299ec5228b06260a?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#webpage\",\"url\":\"https:\\\/\\\/freshphish.info\\\/?p=128\",\"name\":\"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish\",\"description\":\"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/?p=128#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/?author=1#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/?author=1#author\"},\"datePublished\":\"2023-05-05T10:29:52-05:00\",\"dateModified\":\"2023-09-23T16:16:16-05:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/freshphish.info\\\/#website\",\"url\":\"https:\\\/\\\/freshphish.info\\\/\",\"name\":\"Fresh Phish\",\"description\":\"All the freshest phish\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/freshphish.info\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish","description":"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the","canonical_url":"https:\/\/freshphish.info\/?p=128","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/freshphish.info\/?p=128#blogposting","name":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish","headline":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server","author":{"@id":"https:\/\/freshphish.info\/?author=1#author"},"publisher":{"@id":"https:\/\/freshphish.info\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/freshphish.info\/wp-content\/uploads\/2023\/05\/citibank01.jpg","@id":"https:\/\/freshphish.info\/?p=128\/#articleImage","width":1006,"height":457},"datePublished":"2023-05-05T10:29:52-05:00","dateModified":"2023-09-23T16:16:16-05:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/freshphish.info\/?p=128#webpage"},"isPartOf":{"@id":"https:\/\/freshphish.info\/?p=128#webpage"},"articleSection":"Phish, Citibank, Microsoft, phish"},{"@type":"BreadcrumbList","@id":"https:\/\/freshphish.info\/?p=128#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/freshphish.info#listItem","position":1,"name":"Home","item":"https:\/\/freshphish.info","nextItem":{"@type":"ListItem","@id":"https:\/\/freshphish.info\/?cat=12#listItem","name":"Phish"}},{"@type":"ListItem","@id":"https:\/\/freshphish.info\/?cat=12#listItem","position":2,"name":"Phish","item":"https:\/\/freshphish.info\/?cat=12","nextItem":{"@type":"ListItem","@id":"https:\/\/freshphish.info\/?p=128#listItem","name":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server"},"previousItem":{"@type":"ListItem","@id":"https:\/\/freshphish.info#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/freshphish.info\/?p=128#listItem","position":3,"name":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server","previousItem":{"@type":"ListItem","@id":"https:\/\/freshphish.info\/?cat=12#listItem","name":"Phish"}}]},{"@type":"Organization","@id":"https:\/\/freshphish.info\/#organization","name":"Fresh Phish","description":"All the freshest phish","url":"https:\/\/freshphish.info\/"},{"@type":"Person","@id":"https:\/\/freshphish.info\/?author=1#author","url":"https:\/\/freshphish.info\/?author=1","name":"Matt","image":{"@type":"ImageObject","@id":"https:\/\/freshphish.info\/?p=128#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/82f14a734f69eb729d8b59b4a2438ea6e14bd793d23b22d4299ec5228b06260a?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt"}},{"@type":"WebPage","@id":"https:\/\/freshphish.info\/?p=128#webpage","url":"https:\/\/freshphish.info\/?p=128","name":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish","description":"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/freshphish.info\/#website"},"breadcrumb":{"@id":"https:\/\/freshphish.info\/?p=128#breadcrumblist"},"author":{"@id":"https:\/\/freshphish.info\/?author=1#author"},"creator":{"@id":"https:\/\/freshphish.info\/?author=1#author"},"datePublished":"2023-05-05T10:29:52-05:00","dateModified":"2023-09-23T16:16:16-05:00"},{"@type":"WebSite","@id":"https:\/\/freshphish.info\/#website","url":"https:\/\/freshphish.info\/","name":"Fresh Phish","description":"All the freshest phish","inLanguage":"en-US","publisher":{"@id":"https:\/\/freshphish.info\/#organization"}}]},"og:locale":"en_US","og:site_name":"Fresh Phish - All the freshest phish","og:type":"article","og:title":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish","og:description":"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the","og:url":"https:\/\/freshphish.info\/?p=128","article:published_time":"2023-05-05T15:29:52+00:00","article:modified_time":"2023-09-23T21:16:16+00:00","twitter:card":"summary_large_image","twitter:title":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server - Fresh Phish","twitter:description":"I recently came across a phishing emails with a link leading to a subdomain of citi.com, owned by Citibank. Further investigation shows that this particular subdomain is used by Citibank for marketing emails. You can see the link, rewritten by an email security system, links to l.info16.citi.com, shown in brackets at the end of the"},"aioseo_meta_data":{"post_id":"128","title":null,"description":null,"keywords":[],"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":[],"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2023-05-05 15:29:52","updated":"2025-06-04 04:46:59","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/freshphish.info\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/freshphish.info\/?cat=12\" title=\"Phish\">Phish<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tPhish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/freshphish.info"},{"label":"Phish","link":"https:\/\/freshphish.info\/?cat=12"},{"label":"Phish Landing Page Hosted on Citibank Server Redirects to Phish on Microsoft Server","link":"https:\/\/freshphish.info\/?p=128"}],"_links":{"self":[{"href":"https:\/\/freshphish.info\/index.php?rest_route=\/wp\/v2\/posts\/128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/freshphish.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/freshphish.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/freshphish.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/freshphish.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=128"}],"version-history":[{"count":1,"href":"https:\/\/freshphish.info\/index.php?rest_route=\/wp\/v2\/posts\/128\/revisions"}],"predecessor-version":[{"id":131,"href":"https:\/\/freshphish.info\/index.php?rest_route=\/wp\/v2\/posts\/128\/revisions\/131"}],"wp:attachment":[{"href":"https:\/\/freshphish.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/freshphish.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/freshphish.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}