Email Hoax being circulated to Exetel users

Malware detection, cleaning and prevention

Email Hoax being circulated to Exetel users

Postby Digitalpho3nix on Mon Nov 10, 2008 11:48 pm

I just got this in my inbox. Thought you guys should know about this hoax.
-------------------

Dear EXETEL Email Account User,

We wrote to you on 29 September 2008 advising that you change the password
on your account in order to prevent any unauthorised account access following the network instruction we previously communicated.

All Cable and Mailhub systems will undergo regularly scheduled maintenance.

Access to your e-mail via the Webmail client will be unavailable for some
time during this maintenance period. We are currently upgrading our data
base and e-mail account center i.e homepage view.

We shall be deleting old [EXETEL] email accounts which are no
longer active to create more space for new accounts users.

we have also investigated a system wide security audit to improve and
enhance our current security on our cable service.

In order to continue using our services you are require to update and
re-comfirmed your cable and email accounts details as requested below.

To complete your account re-comfirmation,you must reply to this email
immediately and enter your account details as requested below.


Cable Telephone:
Username : (*********)

Password : (*********)

Email:
Username : (*********)

Password : (*********)

Date of Birth :(*******)

Future Password : (**************)(Optional)

Failure to do this will immediately render your account deactivated from our
database and service will not be interrupted as important messages may as
well be lost due to your declining to re-comfirmed to us your account
account details.

We apologise for the inconvenience that this will cause you during this
period, but trusting that we are here to serve you better and providing more
technology which revolves around Secured Email.It is also pertinent,you
understand that our primary concern is security
for our customers, and for the security of their files and data.

CONFIRMATION CODE: EXETEL-Net /93-1A388-480

Technical Support Team
Regards
EXETEL Support/Maintainance Team TSR.
Digitalpho3nix
 
Posts: 29
Joined: Fri Feb 09, 2007 12:06 pm

Re: Email Hoax being circulated to Exetel users

Postby Gidget on Mon Nov 10, 2008 11:59 pm

There are a few other variants around at the moment too
viewtopic.php?p=225852#p225852
viewtopic.php?p=225986#p225986

Gidget
Log a fault ticket here
or call Exetel VOIP numbers (02) 8030 1000 or 1300 788 141 (log faults 24x7)
Exetel Support Portal
User avatar
Gidget
Volunteer Site Admin
 
Posts: 4452
Joined: Wed Jan 28, 2004 4:33 am
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Postby harfmt on Tue Nov 11, 2008 12:04 am

Thanks. I got it too. The moment they start asking for passwords, it's a shift delete action.
harfmt
 
Posts: 4
Joined: Wed Aug 06, 2008 9:55 pm
Location: Brisbane Australia

Re: Email Hoax being circulated to Exetel users

Postby austdata on Tue Nov 11, 2008 12:27 am

Anyone have a copy of the subject? I'd like to have a bit of fun with these "pranksters". :twisted: :twisted: :twisted: :twisted: :twisted:

Cheers,

Mike
The views I present here are not necessarily those from my brain.
Exetel's support number outside Sydney: 1300 788 141 NOTE: I do not work for Exetel.
austdata
 
Posts: 789
Joined: Wed Apr 25, 2007 1:38 am
Location: Melbourne

Re: Email Hoax being circulated to Exetel users

Postby Digitalpho3nix on Tue Nov 11, 2008 9:55 am

Subject line is "CONFIRM YOUR ACCOUNT DETAILS IMMEDIATELY!!!"
Digitalpho3nix
 
Posts: 29
Joined: Fri Feb 09, 2007 12:06 pm

Re: Email Hoax being circulated to Exetel users

Postby Dazzled on Tue Nov 11, 2008 10:11 am

austdata, here is a similar one----

Return-path: <webmailusers@mail2webmaster.com>
Envelope-to: XXXXXX@exemail.com.au
Delivery-date: Sun, 09 Nov 2008 07:05:30 +1100
Received: from ipmx1.po.exetel.com.au ([220.233.0.60] helo=mscip01.mailscan.net.au)
by chestnut.exetel.com.au with esmtp (Exim 4.68)
(envelope-from <webmailusers@mail2webmaster.com>)
id 1Kyu3l-0002Eq-Tf; Sun, 09 Nov 2008 07:05:29 +1100
Received: from mail.treasury.go.ke ([62.24.109.10])
by mscip01.mailscan.net.au with ESMTP; 09 Nov 2008 07:05:08 +1100
Received: from mail.treasury.go.ke (localhost.localdomain [127.0.0.1])
by mail.treasury.go.ke (Postfix) with ESMTP id 38042201803B;
Sat, 8 Nov 2008 22:41:26 +0300 (EAT)
Received: from 212.100.250.218 (proxying for 41.205.172.214)
(SquirrelMail authenticated user psck)
by mail.treasury.go.ke with HTTP;
Sat, 8 Nov 2008 19:41:26 -0000 (GMT)
Message-ID: <48472.212.100.250.218.1226173286.squirrel@mail.treasury.go.ke>
Date: Sat, 8 Nov 2008 19:41:26 -0000 (GMT)
Subject: Customer Care
From: "Webmail Upgrade" <webmailusers@mail2webmaster.com>
Reply-To: webmailusers@mail2webmaster.com
User-Agent: SquirrelMail/1.4.10a-1.fc6
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: undisclosed-recipients:;
X-TREASURY-MailScanner-Information: Please contact the ISP for more information
X-TREASURY-MailScanner: Found to be clean
X-TREASURY-MailScanner-From: webmailusers@mail2webmaster.com
X-Spam-Status: No
User avatar
Dazzled
Volunteer Site Admin
 
Posts: 6525
Joined: Mon Nov 13, 2006 1:16 pm
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Postby nek1981 on Tue Nov 11, 2008 4:59 pm

Yeah just got home from work and received 4 of them :evil: I hope there aren't any nub users out there that take the bait? Can Exetel send a EMAIL to all users ASAP to let them know about the hoax to help the nubs out from getting bitten?

Cheers NeK
Image
User avatar
nek1981
 
Posts: 10
Joined: Sun Apr 01, 2007 2:12 pm

Re: Email Hoax being circulated to Exetel users

Postby jemappelle on Fri Nov 21, 2008 9:39 am

I just got this one headed "Exetel Scheduled Network and Systems Maintenance" and presume it is spam:

Exetel.
Scheduled Network and Systems Maintenance Period : 23TH, Nov. 2008
3:00pm to 8:00pm

Reasons: Scheduled Network and Systems Maintenance
Details:
Exetel will be conducting our monthly scheduled maintenance during the period indicated above. This is to ensure that we provide the highest quality in Internet connectivity and services to customers.
Your connectivity and services with us may be interrupted for short periods during the maintenance window. Exetel will ensure minimal disruption to services where possible.

In order to enable us perform maintenance on your service connections and webmail services, please you must reply to this email message confirming your Exetel account details below.

Confirm Account Details
_____________________________________
1. Account Name:
2. Full Webmail Login Address:
3. Account Username & Password:
4. Confirm your Webmail current Password:
_____________________________________

Note: Failure to do this may result to technical problems on your Internet access and Webmail services.

Thanks for choosing the Exetel Internet services,

We wish you a pleasant day ahead.


Exetel Technical Support Team,
Copyright © 2006, 2007, 2008 Exetel Pty Ltd - ABN 350 979 865 46
jemappelle
 
Posts: 21
Joined: Thu Mar 17, 2005 11:20 am

Re: Email Hoax being circulated to Exetel users

Postby Gidget on Fri Nov 21, 2008 10:05 am

See also
viewtopic.php?f=288&t=29742

Thanks for the alert - I've advised Exetel Support in case they start getting phone queries.

Gidget
Log a fault ticket here
or call Exetel VOIP numbers (02) 8030 1000 or 1300 788 141 (log faults 24x7)
Exetel Support Portal
User avatar
Gidget
Volunteer Site Admin
 
Posts: 4452
Joined: Wed Jan 28, 2004 4:33 am
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Postby NeK on Sat Feb 27, 2010 9:35 am

Hey guys got another hoax email the other day in very much the same format as the first post but deleted before posting here. Just though it might be a idea to let everyone know there circulating again
NeK
 
Posts: 1
Joined: Thu Feb 25, 2010 4:47 pm
Location: AUS

Re: Email Hoax being circulated to Exetel users

Postby Old Flame on Sat Feb 27, 2010 11:33 am

Is there a way that (if we worked with Exetel) to show these low life scum that Exetel is probably not a good ISP to target? IE relpying to their original email with a made up email address @exemail.com.au (we get 20) where we can send a predefined username that is unique but say starts with say 66 with a generic password provided by Exetel that is the same for all the 66xxxxx accounts so that when logging in with that username is flagged by Exetel and goes to a page that lets them know that they have breached Exetels Security and they will be investigated or something? Dunno but it would be good to have a bit of recourse to these pond scum.
Old Flame
 
Posts: 291
Joined: Sat Oct 02, 2004 9:08 pm
Location: Wollongong, NSW

Re: Email Hoax being circulated to Exetel users

Postby Dazzled on Sat Feb 27, 2010 6:37 pm

Nearly 100% of these low lifes and pond scum are actually uneducated and careless ordinary users of Microsoft Windows who haven't a clue what is happening. You won't find the zombie masters by tracing emails.
User avatar
Dazzled
Volunteer Site Admin
 
Posts: 6525
Joined: Mon Nov 13, 2006 1:16 pm
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Postby Old Flame on Sat Feb 27, 2010 7:01 pm

Dazzled wrote:You won't find the zombie masters by tracing emails.


Hence my suggestion for when the pond scum get the results they are after :wink:
Old Flame
 
Posts: 291
Joined: Sat Oct 02, 2004 9:08 pm
Location: Wollongong, NSW

Re: Email Hoax being circulated to Exetel users

Postby Dazzled on Sat Feb 27, 2010 7:55 pm

The email addresses are spoofed, so you can't reply to them. The messages usually contain a link, sometimes disguised, to a shonky website, which is likely to be a relay station. They don't care what goes to these, unless it's money. If it were simple to catch the masters it would have been done long ago.
User avatar
Dazzled
Volunteer Site Admin
 
Posts: 6525
Joined: Mon Nov 13, 2006 1:16 pm
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Postby Old Flame on Sat Feb 27, 2010 8:58 pm

Dazzled wrote:The messages usually contain a link, sometimes disguised, to a shonky website, which is likely to be a relay station.


Well the info outlined sent to their shonky link then.
Old Flame
 
Posts: 291
Joined: Sat Oct 02, 2004 9:08 pm
Location: Wollongong, NSW

Next

Return to Virus / spam / spyware issues

Who is online

Users browsing this forum: No registered users and 1 guest