This is a bogus email, right?

randycat99 · December 20, 2003 4:04PM

I got this in the email today. At first, I thought, "Aww crap! Now what?"

Then I thought, "Hey, wait a minute!"

Here's the message:

Quote:

Status: U

Date: Sat, 20 Dec 2003 18:19:21 -0400 (EST)

From: Earthlink.net <[email protected]>

Reply-To: [email protected]

X-Priority: 3 (Normal)

To: randycat99@xxxxxxxxxx

Subject: Problems with your Earthlink account.

Dear Earthlink valued customer,

We regret to inform you, that we were unable to charge your card. This maybe due to our payment processing failure, billing system overload, invalid card number, exp date, daily limit, insufficient funds, or other reasons. We need you to re-enter valid payment and verification information.

Click here to continue payment verification process - <https://[email protected]/step1_e.htm>https://earthlink.net/payment/verification.cgi

Your information will be submitted via a secure server. Earthlink keeps all of your contact and billing information confidential and private.

Did my BS detector flag it correctly? What do you think?

luca · December 20, 2003 4:07PM

Why would Earthlink use a Rocketmail.com email address?

Besides, I heard about something like this a couple weeks ago, it's probably a scam.

paul · December 20, 2003 4:11PM

yeah thats bullshit.. .you may want to forward that to earthlink's spam cop or fraud agency or whatever... because that is NOT from earthlink

alcimedes · December 20, 2003 4:12PM

actually you've gotten the first exploit of the IE hole that's in the wild.

PC versions of IE will display the internet address incorrectly, make it look like it's legitimatly from earthlink.

rageous · December 20, 2003 4:20PM

Here's one I've received about 40 times in the past 2 or 3 weeks:

Your credit card will be billed at $29.95 weekly and free 3 pack

of child porn CD is shipping to your billing address. To cancel your

membership and CD pack please email full credit card details to

[email protected] Ready to enjoy all types of underage

porn? We have the best selection for every taste! Click the

secret link below and have fun..._ www.darkprofits.com &

www.darkprofits.net

Geee.... maybe I ought to send them my info. You think?

randycat99 · December 20, 2003 4:20PM

OK thanks, guys! I'll get to my morse code clicker, right now!

macsrgood4u · December 20, 2003 4:23PM

I got the same email! Notified Earthlink. There's wrong syntax (Dear Earthlink valued customer) and "maybe" instead of may be. Also Earthlink always has a copyright line on all their correspondence. The url didn't connect nor did the email addresses. Also the sender name and address is different then Randycat's.

Happy Holidays.

macusers · December 20, 2003 4:23PM

ya everything before an @ sign is canceled out..so for my site i could do like [email protected] or [email protected] or whatever else

anders · December 20, 2003 4:24PM

[email protected]...

There is the proof.

It looks like a earthlink adress but really directs you to IP 211.154.171.106

drewprops · December 20, 2003 5:01PM

arin.net reports:

teProv: QLD

PostalCode: 4064

Country: AU

ReferralServer: whois://whois.apnic.net

NetRange: 210.0.0.0 - 211.255.255.255

CIDR: 210.0.0.0/7

NetName: APNIC-CIDR-BLK2

NetHandle: NET-210-0-0-0-1

Parent:

NetType: Allocated to APNIC

NameServer: NS1.APNIC.NET

NameServer: NS3.APNIC.NET

NameServer: NS.RIPE.NET

NameServer: RS2.ARIN.NET

NameServer: DNS1.TELSTRA.NET

Comment: This IP address range is not registered in the ARIN database.

Comment: For details, refer to the APNIC Whois Database via

Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl

Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry

Comment: for the Asia Pacific region. APNIC does not operate networks

Comment: using this IP address range and is not able to investigate

Comment: spam or abuse reports relating to these addresses. For more

Comment: help, refer to http://www.apnic.net/info/faq/abuse

Comment:

RegDate: 1996-07-01

Updated: 2002-09-11

OrgTechHandle: AWC12-ARIN

OrgTechName: APNIC Whois Contact

OrgTechPhone: +61 7 3858 3100

OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2003-12-19 19:15

# Enter ? for additional hints on searching ARIN's WHOIS database.

randycat99 · December 20, 2003 5:06PM

Yes, I've been down that track already. Taking the lead a little further will bring you to RIPE Whois Database, and then to [email protected].

I have some couvert CIA agents scaling their stronghold as we speak, to erm, "have a word" with their webmaster.

My sources inform me that Dr. Evil may actually reside there. We shall soon see...hope there aren't any fembots on the premises. Otherwise we may have to pull back and send in a special forces unit.

luca · December 20, 2003 5:07PM

Quote:

Originally posted by Randycat99

OK thanks, guys! I'll get to my morse code clicker, right now!

QUICK! To the bat-click!

anders · December 20, 2003 5:11PM

Quote:

Originally posted by Luca Rescigno

QUICK! To the bat-click!

To the bat-mouse

luca · December 20, 2003 5:13PM

KA-POW!

Holy email fraud, Batman!

anders · December 20, 2003 5:27PM

Quote:

Originally posted by Luca Rescigno

KA-POW!

Holy email fraud, Batman!

Robins hair cut looks like John Kerrys.

macsrgood4u · December 20, 2003 5:40PM

Just what kind of relationship did these two crime-fighters have with one another?

Earthlink confirmed it's a hoax. Here's the response:

Quote:

Thank you for contacting us.

We acknowledge that you received a supposed message from EarthLink about your account's status.

With regard to the message, a scam message has been circulating these past few days asking subscribers to provide their credit card information. It is possible that the message you received is a scam notice. EarthLink will NEVER ask you to send personal information using e-mail, including your Password, Secret Word, PIN, or credit card number. If you receive an e-mail asking you to put any of this sensitive account information into an email, it is suspect.

EarthLink will ALWAYS refer you to use the My Account website (http://myaccount.earthlink.net) to update your account information. If an email directs you to use any other URL, or provides a link to another URL, to enter your personal information, it is suspect.

There is a tool at: http://support.earthlink.net in the top-right corner, there is a box labeled ?Verify a Website.? If you have any doubt that the Web site you are entering is a legitimate EarthLink Web site, they can copy and paste the URL into this box and the tool will you whether it is legitimate or not.

For additional tips on how to identify and avoid scams, please visit http://www.earthlink.net/fraud

We hope that this information has been helpful. If you have other inquiries, please contact us.

Eddie B 2079

EarthLink Electronic Customer Support

EarthLink, Inc.

Case ID 35331400

der kopf · December 20, 2003 7:15PM

Quote:

Originally posted by rageous

Your credit card will be billed at $29.95 weekly and free 3 pack

of child porn CD is shipping to your billing address.

So you're into child porn, huh? Consider yourself REPORTED, mister!

dmband0026 · December 20, 2003 10:36PM

Quote:

. EarthLink will NEVER ask you to send personal information using e-mail, including your Password, Secret Word, PIN, or credit card number. If you receive an e-mail asking you to put any of this sensitive account information into an email, it is suspect.

That is the key right there. No responsible ISP will ever ask for your password/billing info for any reason. That should make the little red flags start flying up right there. Good catch on the scam, som people aren't as lucky as you and actually send their info back.

This is a bogus email, right?

Comments