EMail Phishing Threat: Comcast.net

Self | 8/16/09 | GRRRRR

[GRRRRR]

ALERT! COMCAST EMAIL USERS....

Keep an eye open for phishing emails today. I've received TWO from the same person.

See headers and email below. DO NOT REPLY or FORWARD. See below how to handle these emails.

Return-Path: skulekci@cox.net Received: from imta11.westchester.pa.mail.comcast.net (LHLO IMTA11.westchester.pa.mail.comcast.net) (76.96.62.22) by sz0165.ev.mail.comcast.net with LMTP; Sun, 16 Aug 2009 12:48:50 +0000 (UTC) Received: from fed1rmmtao107.cox.net ([68.230.241.39]) by IMTA11.westchester.pa.mail.comcast.net with comcast id V0oc1c00W0ricp80B0ocp0; Sun, 16 Aug 2009 12:48:49 +0000 X-Authority-Analysis: v=1.0 c=1 a=03BE8P92kNoA:10 a=B2Z70H6xJSUkDJ515Yrr0Q==:17 a=7IhTD8vkESaNYZtRJxgA:9 a=-6uiuEKKr_hCM7RAdZYA:7 a=CpA5JfuKFtJpqYyoAsU9_fVhKq8A:4 a=H74sq46YGBEA:10 a=FpThlCNnufZFiDQM:21 a=xeKNeA5vEFupyxM6:21 Received: from fed1rmimpo01.cox.net ([70.169.32.71]) by fed1rmmtao107.cox.net (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP id <20090816124835.MYJR21470.fed1rmmtao107.cox.net@fed1rmimpo01.cox.net>; Sun, 16 Aug 2009 08:48:35 -0400 Received: from fed1rmwml32 ([172.18.140.218]) by fed1rmimpo01.cox.net with bizsmtp id V0oa1c0054iv3b8030oa54; Sun, 16 Aug 2009 08:48:35 -0400 X-VR-Score: 140.00 X-CM-Score: 0.00 Received: from 64.185.238.44 by webmail.west.cox.net; Sun, 16 Aug 2009 8:48:34 -0400 Message-ID: <20090816084835.HPWLE.47812.imail@fed1rmwml32> Date: Sun, 16 Aug 2009 8:48:35 -0400 From: COMCAST WEBMAIL ! Reply-To: passwordreset@9.cn Subject: VERIFY YOUR ACCOUNT MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) Sensitivity: Normal

HERE's the actual phishing email, trying to get you to send private info back...

Dear Email User,

This Email is from our Comcast Customer Care Email Service and we

are sending it to every Email User Accounts Owner for safety. we are having congestions due to the anonymous registration of Email accounts so we are shutting down some accounts and your account was among those to be deleted. We are sending this email to you so that you

can verify and let us know if you still want to use this account.

If you are still interested please confirm your account by filling the space below.

Your User name, password, date of birth and your country

We would be shutting down all unused Accounts, You will have to confirm your E-mail by filling out your Login Information within 24 hours for security reasons. And send it to this mail address

passwordreset@9.cn

* Username: * Password: * Date of Birth: * Country Or Territory:

Warning!!! Account owner that refuses to update his/her account will lose his or her account. Sincerely,

The Comcast Webmail Customer Support Team

And, another one...

Return-Path: skulekci@cox.net Received: from imta10.westchester.pa.mail.comcast.net (LHLO IMTA10.westchester.pa.mail.comcast.net) (76.96.62.14) by sz0165.ev.mail.comcast.net with LMTP; Sun, 16 Aug 2009 13:37:58 +0000 (UTC) Received: from fed1rmmtao105.cox.net ([68.230.241.41]) by IMTA10.westchester.pa.mail.comcast.net with comcast id V1dk1c00R0uHxVg0A1dk5x; Sun, 16 Aug 2009 13:37:58 +0000 X-Authority-Analysis: v=1.0 c=1 a=03BE8P92kNoA:10 a=B2Z70H6xJSUkDJ515Yrr0Q==:17 a=C_IRinGWAAAA:8 a=sIjbQkv-GlZIcbPhMhUA:9 a=fkl-ACfyfHyOUvdQGZAA:7 a=DBLOJ0tDqdM3IfE-cxZFvE530YwA:4 a=oIWDkQLH8BMA:10 a=FMYxdwqBsaAA:10 Received: from fed1rmimpo03.cox.net ([70.169.32.75]) by fed1rmmtao105.cox.net (InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP id <20090816133743.QNFQ21106.fed1rmmtao105.cox.net@fed1rmimpo03.cox.net>; Sun, 16 Aug 2009 09:37:43 -0400 Received: from fed1rmwml32 ([172.18.140.217]) by fed1rmimpo03.cox.net with bizsmtp id V1di1c0064hdPEs041diH8; Sun, 16 Aug 2009 09:37:42 -0400 X-VR-Score: 240.00 X-CM-Score: 0.00 Received: from 64.185.238.44 by webmail.west.cox.net; Sun, 16 Aug 2009 9:37:43 -0400 Message-ID: <20090816093743.OZD0Q.48049.imail@fed1rmwml32> Date: Sun, 16 Aug 2009 6:37:43 -0700 From: COMCAST SUPPORT TEAM Reply-To: upgrade000@9.cn Subject: VERIFY YOUR EMAIL ACCOUNT MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) Sensitivity: Normal

This message is from COMCAST.NET messaging center to all COMCAST.NET email Account owners. We are currently upgrading our data base and e-mail account centre. We are also using this process to delete all unused COMCAST.NET email accounts to create more space for new accounts. To prevent your account from being closed, you will have to update it so that we will know that it's a present active account. To complete your COMCAST.NET webmail account, you must reply to this email immediately and enter your Username and your Password here below:

CONFIRM YOUR EMAIL AND PASSWORD BELOW: Email Username : .......... ..... EMAIL Password : ................ Date of Birth : ................. Country or Territory : .......... Log-In Site or Link........... http://

After confirmation, you are to send it to the Upgrading Department Warning!!! Account owner that refuses to update his or her account information within Seven days, will be assumed that its not longer in use, Hence we will deactivate the account.

Thanks for using COMCAST NET, Comcast Team 2009.

[GRRRRR]

http://security.comcast.net/get-help/report-a-security-threat-or-scam.aspx

Reporting a Phishing email sent from the Comcast Network

1. Copy the email, including headers, and paste it into a new email. Please do not forward the phishing message: this will remove the email headers. 2. Send the email to abuse@comcast.net.

[Dallas59]

Com Cast is a scam. We’ve had DirecTV since 98. CC came in 2003 and started to advertise for their services. When you refused, they left a little note on your door claiming you had tried to illegally obtain cable. I ripped CC a new one over that. Will never have cable.

[Rocky]

Love your tagline!

[Rocky]

I don’t understand how people fall for these things. By now, the public should be wary of any message requesting personal information such as checking account number, Social Security number, passwords, etc.

And the spelling and grammar are usually atrocious in these phishing e-mails, as in the two examples you posted.

[timydnuc]

As I told my congressman, Acorn is going to take my vote, Cap and Trade is going to take my freedom, and now this Health Care POS is going to take my life. I'm a 62 year old Viet Nam Vet, I fought for this country once and I'll do it again, and again, and again, until I draw my last breath. I'm a Ranger, we don't quit, not ever.

[EggsAckley]

I noticed they used the word “centre” which leads me to think that the scam is from off-shore somewhere.

[Rocky]

Eggsackley the kind of thing to which I was referring.