VM change of email address?

[Taf]

We’re updating our email service which means we have to change our email address.

To make sure you don’t miss important news about your products and services as well as the latest offers, please update your address book or contact list with our new email address:

VirginMedia AT emails.image.email.virginmedia.com

Here's how


Many thanks



The Virgin Media Team

reply to VirginMedia.VBQI4.57 AT emails.image.email.virginmedia.com

Looks a bit suspect?

[Peter_]

FAKE!!!!!!!!!!!!!!!!!!!!

That is not a Virginmedia email address.

[Rob]

I've had one of these too. It would be a very weird address for them to be using.

[Ken W]

I have just received the email, it looks very suspect.

[Peter_]

Originally Posted by Ken W

I have just received the email, it looks very suspect.

As I said above it is fake!!!!!!

[Kymmy]

Weird though as normally a fake involves a scam address, the subdomain given can only belong the vm.. So what's the point in it??

[Toto]

The point is that email.virginmedia.com resolves to Virgin Media:

$ host email.virginmedia.com
email.virginmedia.com has address 92.238.96.11

whois 92.238.96.11
[Querying whois.arin.net]
[Redirected to whois.ripe.net:43]
[Querying whois.ripe.net]
[whois.ripe.net]
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '92.238.96.0 - 92.238.96.127'

inetnum:        92.238.96.0 - 92.238.96.127
netname:        BROADBANDAUDIT
descr:          KNOWSLEY VLAN
country:        GB
admin-c:        TWIP1-RIPE
tech-c:         TWIP3-RIPE
status:         ASSIGNED PA
mnt-by:         AS5462-MNT
source:         RIPE # Filtered

role:           Telewest Broadband IP Network Services
address:        Genesis Business Park
address:        Albert Drive
address:        Woking
address:        Surrey UK
address:        GU21 5RW
e-mail:         ripe@telewest.net
remarks:        To report abuse:
remarks:        file an online case @ http://netreport.virginmedia.com/netreport/

So, adding a few extra bits before the legitimate domain then could confuse some people into thinking its a legitimate email from Virgin Media. It's a known phishing trick that can fool the unsuspecting person.

The email though is making an unusual request, well it would seem unusual at first:

To make sure you don’t miss important news about your products and services as well as the latest offers, please update your address book or contact list with our new email address

That does not look like a phishing email, except that because Virgin are now using Google for their email platform, white listing an email address will almost guarantee that even if the content is marked as spam by Google's Postini spam filter, it will still drop into the mailbox.

This is a very clever precursor to what looks like a future strategy of phishing emails aimed at Virgin Media.

Interesting as well is this:

$ host emails.image.email.virginmedia.com
emails.image.email.virginmedia.com mail is handled by 50 mail-router.e-dialog.com.

That needs looking into.

---------- Post added at 12:32 ---------- Previous post was at 12:24 ----------

Originally Posted by Taf

Looks a bit suspect?

Taf, were there any links in that email sir?

[Taf]

The "Here's how" was a clickable link which I killed on posting... just in case someone clicked on it in here.

I've binned it now, so don't know where the link pointed to.

[Toto]

Originally Posted by Taf

The "Here's how" was a clickable link which I killed on posting... just in case someone clicked on it in here.

I've binned it now, so don't know where the link pointed to.

Hmmm, interesting..........if anyone else still has the email, could they PM me the link please.

So, probably a full blown phishing email then.

[Scrubbs]

I have the mail if your still needing it?

[Toto]

Originally Posted by Scrubbs

I have the mail if your still needing it?

If you can PM me the link they have in it, that would be cool.

[Scrubbs]

Originally Posted by Toto

If you can PM me the link they have in it, that would be cool.

done, with the "unsubscribe" link as well. I couldn't fit the "privacy" and "about us" links but I think they are similair to the "heres how"

[Toto]

Thanks Scrubbs.

I have to be honest, I'm a bit baffled with this one.

On the one hand, this is not a phishing attempt, as it does not ask you to give up any important information. On the other hand though, I just don't see why Virgin Media would change a marketing address and ask its customers to update their address book.

I've checked the link supplied by Scrubbs, it looks legitimate of sorts.

It takes you to a page that gives instructions on how to white list an email address for various email clients and web mail services.

I would ask though that if Virgin Media had sent this, why didn't they include an image of their branded web mail service hosted by Google.

The company handling the links is a legitimate email marketing company. It boast associations with many common brand names, so I am really not sure if this email is genuine or not.

Masque, if you have any contacts in VM that can help confirm or deny this email, I think it may help.

[Peter_]

I will look into it Monday but an @virginmedia.com email address is a public email address not an address that would be used for business as they all end in @virginmedia.co.uk so very unlikely to have been sent by Virginmedia.

[danbayliss]

I have looked into this today and can now confirm that this email is genuine