Scam E-Mail - Earthline

my e-mail | 8/24/02 | dono

[don-o]

Dear EarthLink User,

We regret to inform you, but due to a recent system flush, the billing information for your account was lost ,and can not be found. In order to enjoy your EarthLink experience and keep your account active, you must enter your credit/debit card information within 24 hours of recieving this e-mail.

To re-enter your account information and keep your account active, http://www.earthlinkservices.net

This page is 100% Secure using SSL Technology with 128-Bit Encryption.

Sincerely, Sean Wright Earthlink Billing Department

[don-o]

Got this.

Trying to contact support on the phone. Anyone else get such?

Reeks of a scam.

[don-o]

Damn - EarthLINK.

[zlala]

What happens if a person is on vacation and doesn't even see the notice until after the 24 hour receiving period....
It's a scam.

[Mr170IQ]

Forward the message to the FBI.

[isthisnickcool]

It does not appear to be SSL and the way this is done is incredibly stupid. A whois indicates this.

Earthlink is out of Atlanta GA. The links on the top of the page go to earthlink.net but the page itself does not.

Looks totally bogus.

[ECM]

"WHO IS" look-up result via www.networksolutions.com:



Organization:
Schrameyer, Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com

Domain Name: EARTHLINKSERVICES.NET

Created on..............: Thu, Aug 22, 2002
Expires on..............: Fri, Aug 22, 2003
Record last updated on..: Thu, Aug 22, 2002

Administrative Contact:
Schrameyer, Robert
Mary Ross
4165 Gold Cup Drive
Cleburne, TX 76033-8674
US
Phone: 817-558-7856
Email: ranikumar1@yahoo.com

Technical Contact:
Schrameyer Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Zone Contact:
Schrameyer Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Domain servers in listed order:

NS3.FREESERVERS.COM 208.185.127.163
NS4.FREESERVERS.COM 209.210.67.154




Hmmm, doesn't look like Earthlink to me :)

[don-o]

Shall do so. See how user friendly their site is

Thanks. Sorry for the typo. don

[fjsva]

Looks like a scam to me...

The IP address (208.185.127.162) for the site is owned by:

AboveNet Communications Inc. 50 W. San Fernando Street, Suite 1010 San Jose, CA 95113 US

I would think earthink would host the site itself instead of a third party.

Pretty good hoax..most I've seen are pretty crude, this is well done.

[sigSEGV]

> whois eartlinkservices.net


Organization:
Schrameyer, Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com

Domain Name: EARTHLINKSERVICES.NET

Created on..............: Thu, Aug 22, 2002
Expires on..............: Fri, Aug 22, 2003
Record last updated on..: Thu, Aug 22, 2002

Administrative Contact:
Schrameyer, Robert
Mary Ross
4165 Gold Cup Drive
Cleburne, TX 76033-8674
US
Phone: 817-558-7856
Email: ranikumar1@yahoo.com

Technical Contact:
Schrameyer Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Zone Contact:
Schrameyer Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Domain servers in listed order:

NS3.FREESERVERS.COM 208.185.127.163
NS4.FREESERVERS.COM 209.210.67.154



stupid criminals.

[strela]

Just another phisher, trying to get personal info from rubes. If you'll post the full headers of the email, I'll try to trace it and let you know who to complain to.

[Chad Fairbanks]

Here's the whois for the domain... sure doesn't look like Earthlink...

Organization:
Schrameyer, Robert
Robert Schrameyer
901 Player Drive
Goshen, IN 46528
US
Phone: 5745332585
Email: ranikumar1@yahoo.com

Domain Name: EARTHLINKSERVICES.NET
Created on..............: Thu, Aug 22, 2002
Expires on..............: Fri, Aug 22, 2003
Record last updated on..: Thu, Aug 22, 2002

There's more info at netsol.com

[glock rocks]

Initiating server query ...
Looking up IP address for domain: www.earthlinkservices.net
The IP address for the domain is: 208.185.127.162
Connecting to the server on standard HTTP port: 80
[Connected] Requesting the server's default page.
The server returned the following response headers:
HTTP/1.1 200 OK
Date: Sat, 24 Aug 2002 18:23:33 GMT
Server: .V39 Apache/1.3.26 (Unix) mod_fs 6.005
Filter-Revision: 1.145
Last-Modified: Sat Aug 24 00:10:14 2002 GMT
Content-length: 146560
Connection: close
Content-Type: text/html
Query complete.

[Chad Fairbanks]

I bet the headers don't do any good, if they did it right... ;0)

Meow...

[isthisnickcool]

Earthlink is aware of this.

[dinasour]

From the whois record.

Created on..............: Thu, Aug 22, 2002

It's pretty darn unlikely that earthlink registered their domain two days ago

[don-o]

Thanks everybody.

I am using this as a lesson for my wife and son. Sweetie once got duped into deleting a file off the OS. Need to keep her on her toes.

[isthisnickcool]

It's a fun form to fill out. I hope I don't get in trouble for entering some things that are less than accurate:)

[don-o]

Anyone brave enough to go to the site? I did not for fear of virus.

Is such possible - to get a virus off a web page w/o opening an .exe?

[genefromjersey]

They had something of the sort on AOL when I started using it. I caught wise, and changed ID and passwords, but a lot of people didn't, and wound up with all kinds of credit card charges, etc.

[sigSEGV]

It is certainly possible if you are using Internet Explorer. Especially if you don't have all the latest patches.