Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Selected ISP Support » Earthlink DSL » Fraudulent Earthlink Email Again
Search Topic:
Uniqs:
1173
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
[OT] Excellent Desktop Wallpapers »
« (topic move) Re: EarthLink Electronic Support Response  
page: 1 · 2 · 3
AuthorAll Replies


Insimbi

join:2001-04-15
Layton, UT

 Fraudulent Earthlink Email Again

Received this today:

Dear Earthlink valued customer,

We regret to inform you, that we were unable to charge your card. This maybe due to our payment processing failure, billing system overload, invalid card number, exp date, daily limit, insufficient funds, or other reasons. We need you to re-enter valid payment and verification information.

Click here to continue payment verification process - »https://earthlink.net/payment/verification.cgi
Your information will be submitted via a secure server. Earthlink keeps all of your contact and billing information confidential and private.

Anyone else still getting these?


arden625

join:2001-07-10
Haledon, NJ

I just got that exact e-mail right now. I came here to actually make a post about it but I see you got it first.

Anyways, I didn't click the link. What I'm concerned is maybe a virus? The e-mail got that attachment icon in my OE, but when I opened the e-mail, I didn't see any info about an attached file.
--
[ Section 6 :: Urban Terror :: Clan {TRIAD} ]


skj
Welcome to the far side of reality
Premium,Mod
join:2002-04-04
Atlanta, GA

Host:
Charter HSI/CATV
Earthlink DSL
Embarq
ISP b2b etc
Cisco

reply to Insimbi
Click for full size
The link itself does resolve and you get the following: Action canceled Internet Explorer was unable to link to the Web page you requested. The page might be temporarily unavailable.

The address comes up as a "legitimate" Earthlink address when you enter it into the verify a website checker. So much for identifying fraudulent websites.



Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:
reply to Insimbi
Please post the Full Message with Full Headers (minus your address or any account numbers).

type [ code ] "paste the contents here" then type [ /code ] (take out spaces between [ and ])

Regards,

Doctor Olds


fatness
subtle
Janitor
join:2000-11-17
fishing
·EarthLink

Host:
Earthlink DSL
TekSavvy
Forum Feature Requ..
Need Site Help?
Rants, Raves, and ..
reply to skj
said by e-mail message source:
Status: U
Return-Path:
Received: from charterwv.net ([68.119.159.63])
by samuel.mail.atl.earthlink.net (EarthLink SMTP Server) with SMTP id 1alaS01JG3Nl3pv0
for ; Sat, 15 Nov 2003 19:34:26 -0500 (EST)
Received: from ip-wv-68-119-159-063.charterwv.net (ip-wv-68-119-159-063.charterwv.net [68.119.159.63])
by charterwv.net (8.12.8p1/8.12.8) with ESMTP id slaior19247
for ; Sat, 15 Nov 2003 23:51:37 -0400 (EST)
Date: Sat, 15 Nov 2003 23:51:35 -0400 (EST)
From: Earthlink.net
X-Mailer: The Bat! (v1.61) Personal
Reply-To: Anna-diana_Tonia@1-base.com
X-Priority: 3 (Normal)
Message-ID:
To: XXXXX@mindspring.com
Subject: Problems with your Earthlink account.
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------34062072612200"
X-ELNK-AV: 0

------------34062072612200
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: base64
If I'm reading that right, the e-mail came from ip-wv-68-119-159-063.charterwv.net, which is a Charter address in West Virginia?
--
...all the livelong day...


Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:

Correct.

11/15/03 20:45:53 dns 68.119.159.63
nslookup 68.119.159.63
Canonical name: ip-wv-68-119-159-063.charterwv.net
Addresses: 68.119.159.63

They didn't try very hard.

X-Mailer: The Bat! (v1.61) Personal
Reply-To: Anna-diana_Tonia@1-base.com


Did anyone get the attachment?

Regards,

Doctor Olds


fatness
subtle
Janitor
join:2000-11-17
fishing
OE shows that there is an attachment with the message, but there is none that I can find.

WillieFox

join:2002-03-24
Park Ridge, IL
The hyperlink is the attachment.


Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:
reply to fatness
Did the Elink AV scanner clean it? I noticed your header shows this below

>>X-ELNK-AV: 0

Regards,

Doctor Olds


skj
Welcome to the far side of reality
Premium,Mod
join:2002-04-04
Atlanta, GA

Host:
Charter HSI/CATV
Earthlink DSL
Embarq
ISP b2b etc
Cisco
It is supposed to let you know when it removes a virus.

From: »www.earthlink.net/myaccount/help···tivating

A note will be inserted at the top of your message indicating that it was cleaned by Virus Blocker.


Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:
Thanks, but I wonder about the override feature.


fatness
subtle
Janitor
join:2000-11-17
fishing

reply to Doctor Olds
There's no message saying that it was cleaned.


skj
Welcome to the far side of reality
Premium,Mod
join:2002-04-04
Atlanta, GA
reply to Insimbi
It looks like all the emails have that X-ELNK-AV: 0 . I just looked at mine and all of them have that line.


Jtmo
Premium
join:2001-05-20
Novato, CA
reply to Insimbi
I got it, sent it on to Fraud@earthlink.net
--
RIP Steve Rucker


Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:

 reply to Insimbi
This is what an "Official credit card needs updating request" looks like.


Status:  U
Return-Path: <creditcard@earthlink.net>
Received: from blount.mail.mindspring.net ([207.69.200.226])
by bissell.mail.mindspring.net (Earthlink Mail Service) with ESMTP id xxxxxxxxx
for <xxxxxxxxx@mindspring.com>; Mon, 10 Feb 2003 23:27:01 -0500 (EST)
Received: from ggz-2.atl2.fw.earthlink.net ([198.185.0.140] helo=mail.mindspring.com)
by blount.mail.mindspring.net with esmtp (Exim 3.33 #1)
id xxxxxxxxx
for xxxxxxxxx@mindspring.com; Mon, 10 Feb 2003 23:25:11 -0500
Received: (from root@localhost)
by mail.mindspring.com (8.11.6+Sun/8.10.2) id h1B4FgL14594;
Mon, 10 Feb 2003 23:15:42 -0500 (EST)
Date: Mon, 10 Feb 2003 23:15:42 -0500 (EST)
From: creditcard@earthlink.net
Message-Id: <20030211xxxxxxxxx.xxxxxxxxx@mail.mindspring.com>
To: xxxxxxxxx@mindspring.com
Subject: EarthLink Subscriber Alert: Credit Card Expiration
X-Hercules-ID: xxxxxxxxx@mindspring.com
X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: xxxxxxxxxxxxxxxxxx

Dear EarthLink Subscriber,

Our records indicate that the MasterCard associated with
your EarthLink account #xxxxxxxxx is about to expire.

To avoid any interruption to your EarthLink service,
please update your credit card information as soon as the
replacement card arrives in the mail, or immediately if
this information is outdated.

It's quick and easy to update your billing information online.
Simply visit your "My Account" web page, available 24/7:

http://myaccount.earthlink.net

If your credit card number is NOT changing, you can simply
reply to this email with your new expiration date. (Please
Note: Do not send your credit card number by email. Email
is not secure enough for sensitive financial information.)

Thank you for your prompt attention to this matter. We value
you as a subscriber and look forward to continuing to serve
you.

Sincerely,
The EarthLink Customer Service Team

Notice there are no Attachments or Blank Fields to fill out. Plus they tell you to Login at http://myaccount.earthlink.net

That is the only legit way.

Regards,

Doctor Olds


Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
clubs:

reply to skj
said by skj See Profile:
It looks like all the emails have that X-ELNK-AV: 0 . I just looked at mine and all of them have that line.
I just check my last few emails from today and none of mine have that.

I also do not have the AV protection enabled. Might that be the difference?

Regards,

Doctor Olds


fatness
subtle
Janitor
join:2000-11-17
fishing
Although I made no choice to enable it, the AV protection was enabled for my account. I just diabled it.
--
...all the livelong day...


skj
Welcome to the far side of reality
Premium,Mod
join:2002-04-04
Atlanta, GA

Host:
Charter HSI/CATV
Earthlink DSL
Embarq
ISP b2b etc
Cisco

reply to Doctor Olds
said by Doctor Olds See Profile:
said by skj See Profile:
It looks like all the emails have that X-ELNK-AV: 0 . I just looked at mine and all of them have that line.
I just check my last few emails from today and none of mine have that.

I also do not have the AV protection enabled. Might that be the difference?

Regards,

Doctor Olds

That is probably it, since mine is enabled.

Edit: I just disabled the AV protection and that line is no longer in the emails.


opensecret5

join:2001-02-16
Kansas City, MO

reply to skj
Clever Scam

I got the same fraudulent email in my Earthlink box. But I'm at home where I'm using Roadrunner.

For me the link that shows in the message as »https://earthlink.net/payment/verification.cgi

resolves to a very different address:

»211.230.148.73/image/location/step1_e.htm.

Once I got that site and clicked on a button to continue, I was given the opportunity to tell them my name, address, email address, password, credit card info, social security number, ATM pin #, and Mother's maiden name.

I wanted to be helpful, so I filled it all in -- but, just to be on the safe side, I provided info for a guy I made up named Oscar Felix (in loving memory of the movie The Odd Couple).

It may be that if you go thru Earthlink, that address is blocked, which could prevent a lot of people from making a gift to to some not-so-nice people in some obscure corner of the globe who will steal as much as they can.


skj
Welcome to the far side of reality
Premium,Mod
join:2002-04-04
Atlanta, GA

Host:
Charter HSI/CATV
Earthlink DSL
Embarq
ISP b2b etc
Cisco
Looks like this one is coming out of Australia

11/16/03 08:01:59 IP block 211.230.148.73
Trying 211.230.148.73 at ARIN
Trying 211.230.148 at ARIN

OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU

ReferralServer: whois://whois.apnic.net

NetRange: 210.0.0.0 - 211.255.255.255
CIDR: 210.0.0.0/7
NetName: APNIC-CIDR-BLK2
NetHandle: NET-210-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS.RIPE.NET
NameServer: RS2.ARIN.NET
NameServer: DNS1.TELSTRA.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or »www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to »www.apnic.net/info/faq/abuse
Comment:
RegDate: 1996-07-01
Updated: 2002-09-11

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3100
OrgTechEmail: search-apnic-not-arin@apnic.net

# ARIN WHOIS database, last updated 2003-11-15 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
Forums » Selected ISP Support » Earthlink DSL[OT] Excellent Desktop Wallpapers »
« (topic move) Re: EarthLink Electronic Support Response  
page: 1 · 2 · 3


Thursday, 26-Nov 15:51:32 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [109] New AT&T Ad Campaign Hits Back At Verizon
· [106] Time Warner Cable Fires Broadside At Broadcasters
· [95] Apple Joins AT&T Verizon Snark Fest
· [87] New Bill Takes Aim At Higher Verizon ETFs
· [69] TiVo Sees Record Customer Losses
· [57] In-Flight Internet Headed For Bumpy Landing?
· [38] Thanksgiving Open Thread
· [37] ICANN Slams DNS Redirection
· [34] Senators Want ACTA Made Public
· [34] Despite Billions In USF Fees, U.S. Libraries Lack Bandwidth
Most people now reading
· I'll Just Unplug That... [No, I Will Not Fix Your #@$!! Computer]
· Newegg Black Friday Sale started [Users Find Hot Deals]
· Connecting to Google Voice Via SIP [VOIP Tech Chat]
· What is the spell hit cap for a lvl 80 full arcane spec mage [World of Warcraft]
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· About throttling on non-torrent p2p transfers [TekSavvy]
· Windows 7 boot manager editing questions [Microsoft Help]
· Not strictly "Home" related - but WOW anyways... [Home Repair & Improvement]
· Slow speeds in the evenings [TekSavvy]
· [ PVP] 3.2 DK PvP D/W Spec... [World of Warcraft]