VM phishing scam?

[iadom]

I have had two accounts with VM for over 6 years now and have always paid by DD.

I opted for paperless billing a while back and receive e-mail notification so that I can view the latest bills and print them out if required.

According to my bank accounts both accounts are paid up to date.

This morning I received an e-mail, supposedly from VM, contents as follows.

.................................................. ................................................

Dear Customer,
This e-mail has been sent to you by Virgin Media to inform you that we were unable to process your most recent payment of bill. This might be due to either of the following reasons:

1. A recent change in your personal information. (eg: billing address, phone)
2. Submitting incorrect information during bill payment process.

Due to this, to ensure that your service is not interrupted, we request you to confirm and update your billing information today by clicking here.

If you have already confirmed your billing information then please disregard this message as we are processing the changes you have made.

Regards,
Virgin Media
Billing Department


Thanks for your co-operation.
.................................................. ........................

Needless to say I didn't click on the link, it leads to dogstudio or something, anyone else had one?

Jim.

[Maggy J]

http://netreport.virginmedia.com/netreport/index.php

Take a look here.

[Kymmy]

Nice of you to warn people yet actually post the phishing link so poeple can follow

LINK DISABLED

[webcrawler2050]

What was the email address it came from? Can you post the headers, if you are in Outlook?

[Maggy J]

Ooops!

I didn't check that..

However if everyone notes the link I gave they can send their phishing emails to VM so they can let everyone know the latest version.It's VM's Internet Security Teams contact

It's also where to report abusive emails..and child abuse images.and any other problems that you may be experiencing security wise.

[iadom]

Originally Posted by Kymmy

Nice of you to warn people yet actually post the phishing link so poeple can follow

LINK DISABLED

Sorry about that, didn't think anyone would have been stupid enough to do that, but I suppose its the 'DON'T PRESS THE RED BUTTON' syndrome.

I have been away for two weeks and am absolutely snowed under with work so I was in a bit of a rush when I posted it.

Here are the headers.

Return-Path: billing@virginmedia*****
Received: from aamtain07-winn.ispmail.ntl.com ([81.103.221.35])
by mtain06-winn.ispmail.ntl.com
(InterMail vM.7.08.04.00 201-2186-134-20080326) with ESMTP
id <20090929004706.RZOK2473.mtain06-winn.******>;
Tue, 29 Sep 2009 01:47:06 +0100
Received: from cpaq.edelmanpc.com ([64.113.245.235])
by aamtain07-winn.ispmail.ntl.com
(InterMail vG.2.02.00.01 201-2161-120-102-20060912) with ESMTP
id <20090929004706.EUTM29165.aamtain07-w....edelmanpc.com>;
Tue, 29 Sep 2009 01:47:06 +0100
Received: from User ([86.24.163.149]) by cpaq.edelmanpc.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 28 Sep 2009 18:55:58 -0400
From: "billing@virginmedia.co.uk"<billing@virginmedia.co .uk>
Subject: Virgin Media Billing Notification
Date: Mon, 28 Sep 2009 23:55:51 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Return-Path: billing@virginmedia
Message-ID: CPAQlG0JadWd7Kkibfm00000cf1@cpaq.******
X-OriginalArrivalTime: 28 Sep 2009 22:55:58.0559 (UTC) FILETIME=[D7EC1EF0:01CA408E]
X-Cloudmark-Analysis: v=1.0 c=1 p=ujI_JsH1AAAA:8 p=ReLKieXd8d3rEIRprJcA:9 p=G9mCXvYS5SnX_xtE:21 p=zTxnlkfPjds7nvD4:21 a=NcN59idvAAAA:8 a=WDWk6Nmf5ErKO-Tphq4A:7 a=csgVhjFkVw5GM9SpHg4EzzpfzNgA:4 a=7CFSc7VBqM0A:10

I have doctored the hyperlinks in the headers.

[cookie_365]

Always be suspicious of 'Dear Customer' messages - I'm pretty sure NTL as it was then asked me my name at some point when I signed up

[AbyssUnderground]

It's simple, if Virgin need to get in touch with you they'll use snail-mail. Never ever rely on e-mail based stuff like this if the company normally contacts you by letter. If its urgent enough they will mail you it. Just think, you might not have got that e-mail, but you would have got a letter sent to you Too many things to go wrong with e-mail delivery, including changing e-mail address.

[webcrawler2050]

Received: from User ([86.24.163.149]) by cpaq.edelmanpc.com with Microsoft SMTPSVC(6.0.3790.3959);

Yes, this is the "user" it come from - classic spoofing.

[NeilH]

Spoofing. They probably got your email address in a mass mailing list.

These mails are sent out from drones on irc nets and a lot of the major drones you see from business ips are from people who have been exploited by not correctly patching a php program (usually one of them). Others are from known bugs because the owner is to lazy to update the system.

Just ignore them. The more you let them annoy you the more you will get.

Oh. And if in doubt..... Always call the company in question and ask if they sent you a mail.