Heads up - MWEB mail scam

[bekdik]

If you get the following, then ignore it! Note the return address in bold.

From: MWEB Customer Care Centre [mailto:[email protected]]
Sent: 02 November 2008 04:50 AM
To: undisclosed-recipients:
Subject: 2008 UPGRADE


We are currently carrying out an upgrade on our system due to the fact that it had come to our notice that one or more of our subscriber are introducing a strong virus into our system and it is affecting our network.We are trying to find out the specific person.For this reason all subscribers are to provide their USER NAME AND PASSWORD for us to verify and have them cleared against this virus.

Those that refuses, their Email Account will be terminated in the next 72 hours.

Information to send are;

USER NAME:
PASSWORD:

Hoping to serve you better
Customer Care Centre.

 

[The_Unbeliever]

Thanks.

Let's feed them bogus data

 

[LazyLion]

LOL... if you are going to perpetrate a Scam, please try to use correct spelling and Grammar!

That said... if anyone falls for this, they have got to be pretty dumb.

 

[LazyLion]

Alexa Owner: MWEB Zimbabwe
Server IP: 196.2.64.32
Server NameServers: falcon.mweb.co.za.; ns1.mweb.co.zw.;
Server Location: Harare [ZIMBABWE (ZW)]

that IP address points to...

inetnum: 196.2.64.0 - 196.2.79.255
netname: MWEB_AFRICA_BLK-3
descr: M-WEB
descr: Private Bag X001
descr: N1 City
descr: 7463
country: ZA
org: ORG-MA20-AFRINIC
admin-c: FS2-AFRINIC
tech-c: FS2-AFRINIC
status: ALLOCATED PA
mnt-by: AFRINIC-HM-MNT
mnt-lower: TF-196-2-64-0-196-2-79-255-MNT
source: AFRINIC # Filtered
parent: 196.0.0.0 - 196.255.255.255

organisation: ORG-MA20-AFRINIC
org-name: M-WEB
org-type: LIR
address: M-WEB
address: Private Bag X001
address: N1 City
address: 7463
country: ZA
e-mail:
admin-c: NOC1327-AFRINIC
tech-c: NOC1327-AFRINIC
remarks: abuse e-mail: <>, phone: +27 21 596 8300
mnt-ref: TF-196-2-128-0-196-2-159-255-MNT
mnt-by: AFRINIC-HM-MNT
source: AFRINIC # Filtered

person: Frederik Strauss
nic-hdl: FS2-AFRINIC
address: Emtelworld,
address: 11-12,
address: EbeneCybercity
address: Quatre Bornes
address: Mauritius
e-mail:
e-mail:
phone: +230 454 5400
phone: +230 729 7555
fax-no: +230 454 0400
source: AFRINIC # Filtered

Hmm... Time to contact AFRINIC...

http://www.afrinic.org/

 

[LazyLion]

If you get the following, then ignore it! Note the return address in bold.

Bekdik, can you give us the complete headers of the e-mail plz?

 

[Snekko]

Let's Bomb Them By Mail Of Course ROFL

 

[LazyLion]

Let's Bomb Them By Mail Of Course ROFL

Not Advisable! They are probably using a Third party e-mail provider or hosting service. All you will succeed in doing is overloading the servers so that other legitimate users cannot check their mail. Besides mail bombing is a violation of the TOS of your OWN ISP. You can get disconnected for that.

Please don't advocate doing silly things. Better to do it the proper way. I have contacted M-Web. They will take the appropriate legal action.

 

[bekdik]

Bekdik, can you give us the complete headers of the e-mail plz?

Unfortunately not, it was sent to one of clients who forwarded it to me.

 

[LazyLion]

Unfortunately not, it was sent to one of clients who forwarded it to me.

OK, thanks anyway. I'm sure they can track it through the domain owner.

 

[SonicApe]

Nice work Garyvdh, glad to see someone taking the bull by the horns and being proactive about a situation like this.

big up to you.

 

[LazyLion]

Nice work Garyvdh, glad to see someone taking the bull by the horns and being proactive about a situation like this.

big up to you.

fanks, I would like to fank my mudder and my fudder...

j/k... I hate spammers and scammers

 

[The_Unbeliever]

fanks, I would like to fank my mudder and my fudder...

j/k... I hate spammers and scammers

hope the sc/spammers gets a good and proper assreaming by mweb...

but I wonder how many people have fallen for this scam.

What can they do with your username/password?

ADSL = leech it till it's dry

ISDN dialup = ?
Anlogue dialup = ?

 

[bekdik]

The problem is that while most people would not fall for this type of scam, if one is not concentrating, mind elsewhere, the defences may be lowered.

@Gary thanks for following up.

 

[Abe]

fanks, I would like to fank my mudder and my fudder...

j/k... I hate spammers and scammers

The only thing worse then getting SPAM is to have them use your address as the "from" address when sending their SPAM. You get reams of bounced emails and have to worry about being listed. I would love to rip off their heads and p..s down their necks.

 

[LazyLion]

The problem is that while most people would not fall for this type of scam, if one is not concentrating, mind elsewhere, the defences may be lowered.

@Gary thanks for following up.

The simple rule to remember is... no site or bank or institution will ever ask you for your password. Any e-mail or person asking you for your password is a scammer. They already know what your password is.

If you get an e-mail asking you to confirm details, log onto the official site by googling their name or by typing their name into address bar and contact the owners from there.

 

[Abe]

hope the sc/spammers gets a good and proper assreaming by mweb...

but I wonder how many people have fallen for this scam.

What can they do with your username/password?

Interesting question. A lot of people don't even know their user name and password so I don't think they caught out too many.

 

[-toady-]

"those that refuses" had me rolling in the aisle! Maybe our Controller could take a few tips at being threatening? whoohoooo!