Email Hoax being circulated to Exetel users

Malware detection, cleaning and prevention
Digitalpho3nix
Posts: 26
Joined: Fri Feb 09, 2007 12:06 pm

Email Hoax being circulated to Exetel users

Post by Digitalpho3nix » Mon Nov 10, 2008 11:48 pm

I just got this in my inbox. Thought you guys should know about this hoax.
-------------------

Dear EXETEL Email Account User,

We wrote to you on 29 September 2008 advising that you change the password
on your account in order to prevent any unauthorised account access following the network instruction we previously communicated.

All Cable and Mailhub systems will undergo regularly scheduled maintenance.

Access to your e-mail via the Webmail client will be unavailable for some
time during this maintenance period. We are currently upgrading our data
base and e-mail account center i.e homepage view.

We shall be deleting old [EXETEL] email accounts which are no
longer active to create more space for new accounts users.

we have also investigated a system wide security audit to improve and
enhance our current security on our cable service.

In order to continue using our services you are require to update and
re-comfirmed your cable and email accounts details as requested below.

To complete your account re-comfirmation,you must reply to this email
immediately and enter your account details as requested below.


Cable Telephone:
Username : (*********)

Password : (*********)

Email:
Username : (*********)

Password : (*********)

Date of Birth :(*******)

Future Password : (**************)(Optional)

Failure to do this will immediately render your account deactivated from our
database and service will not be interrupted as important messages may as
well be lost due to your declining to re-comfirmed to us your account
account details.

We apologise for the inconvenience that this will cause you during this
period, but trusting that we are here to serve you better and providing more
technology which revolves around Secured Email.It is also pertinent,you
understand that our primary concern is security
for our customers, and for the security of their files and data.

CONFIRMATION CODE: EXETEL-Net /93-1A388-480

Technical Support Team
Regards
EXETEL Support/Maintainance Team TSR.

User avatar
Gidget
Volunteer Site Admin
Posts: 1806
Joined: Wed Jan 28, 2004 4:33 am
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Post by Gidget » Mon Nov 10, 2008 11:59 pm

Log a fault ticket here
or call Exetel VOIP numbers (02) 8030 1000 or 1300 788 141 (log faults 24x7)
Exetel Support Portal

harfmt
Posts: 4
Joined: Wed Aug 06, 2008 8:55 pm
Location: Brisbane Australia

Re: Email Hoax being circulated to Exetel users

Post by harfmt » Tue Nov 11, 2008 12:04 am

Thanks. I got it too. The moment they start asking for passwords, it's a shift delete action.

austdata
Posts: 629
Joined: Wed Apr 25, 2007 12:38 am
Location: Melbourne

Re: Email Hoax being circulated to Exetel users

Post by austdata » Tue Nov 11, 2008 12:27 am

Anyone have a copy of the subject? I'd like to have a bit of fun with these "pranksters". :twisted: :twisted: :twisted: :twisted: :twisted:

Cheers,

Mike
The views I present here are not necessarily those from my brain.
Exetel's support number outside Sydney: 1300 788 141 NOTE: I do not work for Exetel.

Digitalpho3nix
Posts: 26
Joined: Fri Feb 09, 2007 12:06 pm

Re: Email Hoax being circulated to Exetel users

Post by Digitalpho3nix » Tue Nov 11, 2008 9:55 am

Subject line is "CONFIRM YOUR ACCOUNT DETAILS IMMEDIATELY!!!"

User avatar
Dazzled
Volunteer Site Admin
Posts: 5987
Joined: Mon Nov 13, 2006 1:16 pm
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Post by Dazzled » Tue Nov 11, 2008 10:11 am

austdata, here is a similar one----

Return-path: <webmailusers@mail2webmaster.com>
Envelope-to: XXXXXX@exemail.com.au
Delivery-date: Sun, 09 Nov 2008 07:05:30 +1100
Received: from ipmx1.po.exetel.com.au ([220.233.0.60] helo=mscip01.mailscan.net.au)
by chestnut.exetel.com.au with esmtp (Exim 4.68)
(envelope-from <webmailusers@mail2webmaster.com>)
id 1Kyu3l-0002Eq-Tf; Sun, 09 Nov 2008 07:05:29 +1100
Received: from mail.treasury.go.ke ([62.24.109.10])
by mscip01.mailscan.net.au with ESMTP; 09 Nov 2008 07:05:08 +1100
Received: from mail.treasury.go.ke (localhost.localdomain [127.0.0.1])
by mail.treasury.go.ke (Postfix) with ESMTP id 38042201803B;
Sat, 8 Nov 2008 22:41:26 +0300 (EAT)
Received: from 212.100.250.218 (proxying for 41.205.172.214)
(SquirrelMail authenticated user psck)
by mail.treasury.go.ke with HTTP;
Sat, 8 Nov 2008 19:41:26 -0000 (GMT)
Message-ID: <48472.212.100.250.218.1226173286.squirrel@mail.treasury.go.ke>
Date: Sat, 8 Nov 2008 19:41:26 -0000 (GMT)
Subject: Customer Care
From: "Webmail Upgrade" <webmailusers@mail2webmaster.com>
Reply-To: webmailusers@mail2webmaster.com
User-Agent: SquirrelMail/1.4.10a-1.fc6
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: undisclosed-recipients:;
X-TREASURY-MailScanner-Information: Please contact the ISP for more information
X-TREASURY-MailScanner: Found to be clean
X-TREASURY-MailScanner-From: webmailusers@mail2webmaster.com
X-Spam-Status: No

User avatar
nek1981
Posts: 4
Joined: Sun Apr 01, 2007 1:12 pm

Re: Email Hoax being circulated to Exetel users

Post by nek1981 » Tue Nov 11, 2008 4:59 pm

Yeah just got home from work and received 4 of them :evil: I hope there aren't any nub users out there that take the bait? Can Exetel send a EMAIL to all users ASAP to let them know about the hoax to help the nubs out from getting bitten?

Cheers NeK
Image

jemappelle
Posts: 12
Joined: Thu Mar 17, 2005 11:20 am

Re: Email Hoax being circulated to Exetel users

Post by jemappelle » Fri Nov 21, 2008 9:39 am

I just got this one headed "Exetel Scheduled Network and Systems Maintenance" and presume it is spam:
Exetel.
Scheduled Network and Systems Maintenance Period : 23TH, Nov. 2008
3:00pm to 8:00pm

Reasons: Scheduled Network and Systems Maintenance
Details:
Exetel will be conducting our monthly scheduled maintenance during the period indicated above. This is to ensure that we provide the highest quality in Internet connectivity and services to customers.
Your connectivity and services with us may be interrupted for short periods during the maintenance window. Exetel will ensure minimal disruption to services where possible.

In order to enable us perform maintenance on your service connections and webmail services, please you must reply to this email message confirming your Exetel account details below.

Confirm Account Details
_____________________________________
1. Account Name:
2. Full Webmail Login Address:
3. Account Username & Password:
4. Confirm your Webmail current Password:
_____________________________________

Note: Failure to do this may result to technical problems on your Internet access and Webmail services.

Thanks for choosing the Exetel Internet services,

We wish you a pleasant day ahead.


Exetel Technical Support Team,
Copyright © 2006, 2007, 2008 Exetel Pty Ltd - ABN 350 979 865 46

User avatar
Gidget
Volunteer Site Admin
Posts: 1806
Joined: Wed Jan 28, 2004 4:33 am
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Post by Gidget » Fri Nov 21, 2008 10:05 am

See also
http://forum.exetel.com.au/viewtopic.php?f=288&t=29742

Thanks for the alert - I've advised Exetel Support in case they start getting phone queries.

Gidget
Log a fault ticket here
or call Exetel VOIP numbers (02) 8030 1000 or 1300 788 141 (log faults 24x7)
Exetel Support Portal

NeK
Posts: 1
Joined: Thu Feb 25, 2010 4:47 pm
Location: AUS

Re: Email Hoax being circulated to Exetel users

Post by NeK » Sat Feb 27, 2010 9:35 am

Hey guys got another hoax email the other day in very much the same format as the first post but deleted before posting here. Just though it might be a idea to let everyone know there circulating again

Old Flame
Posts: 212
Joined: Sat Oct 02, 2004 8:08 pm
Location: Wollongong, NSW

Re: Email Hoax being circulated to Exetel users

Post by Old Flame » Sat Feb 27, 2010 11:33 am

Is there a way that (if we worked with Exetel) to show these low life scum that Exetel is probably not a good ISP to target? IE relpying to their original email with a made up email address @exemail.com.au (we get 20) where we can send a predefined username that is unique but say starts with say 66 with a generic password provided by Exetel that is the same for all the 66xxxxx accounts so that when logging in with that username is flagged by Exetel and goes to a page that lets them know that they have breached Exetels Security and they will be investigated or something? Dunno but it would be good to have a bit of recourse to these pond scum.

User avatar
Dazzled
Volunteer Site Admin
Posts: 5987
Joined: Mon Nov 13, 2006 1:16 pm
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Post by Dazzled » Sat Feb 27, 2010 6:37 pm

Nearly 100% of these low lifes and pond scum are actually uneducated and careless ordinary users of Microsoft Windows who haven't a clue what is happening. You won't find the zombie masters by tracing emails.

Old Flame
Posts: 212
Joined: Sat Oct 02, 2004 8:08 pm
Location: Wollongong, NSW

Re: Email Hoax being circulated to Exetel users

Post by Old Flame » Sat Feb 27, 2010 7:01 pm

Dazzled wrote:You won't find the zombie masters by tracing emails.
Hence my suggestion for when the pond scum get the results they are after :wink:

User avatar
Dazzled
Volunteer Site Admin
Posts: 5987
Joined: Mon Nov 13, 2006 1:16 pm
Location: Sydney

Re: Email Hoax being circulated to Exetel users

Post by Dazzled » Sat Feb 27, 2010 7:55 pm

The email addresses are spoofed, so you can't reply to them. The messages usually contain a link, sometimes disguised, to a shonky website, which is likely to be a relay station. They don't care what goes to these, unless it's money. If it were simple to catch the masters it would have been done long ago.

Old Flame
Posts: 212
Joined: Sat Oct 02, 2004 8:08 pm
Location: Wollongong, NSW

Re: Email Hoax being circulated to Exetel users

Post by Old Flame » Sat Feb 27, 2010 8:58 pm

Dazzled wrote:The messages usually contain a link, sometimes disguised, to a shonky website, which is likely to be a relay station.
Well the info outlined sent to their shonky link then.

Post Reply