Howdy All,
In my previous posting, I informed everyone about the pishing email sent to people to steal their login info. This time, I received an email, sent to my company’s email, trying to steal the information. For me, I’m not worry about it since I do not have any account with Google but it is good to remind others. I share with you the content of the email that I received below. PLEASE DO NOT CLICK ON THE LINK GIVEN BELOW!!!
————————
Dear Google AdWords Customer!
In order to update your billing information, please sign in to your AdWords account at https://adwords.google.com, and update your billing information. Your account will be reactivated as soon as you haveentered your payment details. Your ads will show immediately if you decide to pay for clicks via credit or debit card. If you decide to pay by direct debit, we may need to receive your signed debit authorization before your ads start running, depending on your location. If you choose bank transfer, your ads will show as soon as we receive your first payment. (Payment options vary by location.)
Thank you for choosing AdWords. We look forward to providing you with the most effective advertising available.
Sincerely,
The Google AdWords Team
————————
This message was sent from a notification-only email address that does not accept incoming email. Please do not reply to this message. If you have any questions after following the steps above, please visit the
Google AdWords Help Center at https://adwords.google.com/support/bin/topic.py?topic=8336&hl=en_US to
find answers to frequently asked questions and a ‘contact us’ link near the bottom of the page.
————————
I know it is a pishing email because the link given is not pointing to the said URL as we see it but it is actually pointing to a sub-domain created similar as google’s sub-domain for a domain a country of China - fgreo3.cn
You can also verify the email by looking at the original message (its header parter specially), it is not from Google. Please see below
Return-path: <firewalker434@yahoo.com>
Received: from [92.112.35.159] ([92.112.35.159])
by my.acctrak21.com (my.acctrak21.com)
(MDaemon.PRO.v7.2.3.R)
with ESMTP id md50001165699.msg
for <abrahman@my.acctrak21.com>; Sat, 22 Mar 2008 21:01:39 +0800
Received: from [92.112.35.159] by e.mx.mail.yahoo.com; Sat, 22 Mar 2008 16:01:37 +0300
Date: Sat, 22 Mar 2008 16:01:37 +0300
From: “Google Adwords-noreply” <adwords-noreply@google.com>
X-Mailer: The Bat! (v3.62.03) Home
Reply-To: firewalker434@yahoo.com
X-Priority: 3 (Normal)
Message-ID: <048989728.86776683630043@yahoo.com>
To: abrahman@acctrak21.com
Subject: Please Update Your Billing Information
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=”———-{nHEX}”
X-Lookup-Warning: MAIL lookup on firewalker434@yahoo.com does not match 92.112.35.159
X-MDRcpt-To: abrahman@acctrak21.com
X-Rcpt-To: abrahman@acctrak21.com
X-MDRemoteIP: 92.112.35.159
X-Return-Path: firewalker434@yahoo.com
X-MDaemon-Deliver-To: abrahman@my.acctrak21.com
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11)
X-Spam-Report:
* 3.0 BAYES_60 BODY: Bayesian spam probability is 60 to 70%
* [score: 0.6079]
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.1 HTML_TITLE_EMPTY BODY: HTML title contains no text
X-Spam-Status: No, hits=3.2 required=5.0 tests=BAYES_60,HTML_MESSAGE,
HTML_TITLE_EMPTY autolearn=no version=2.64
X-Spam-Level: ***
X-Spam-Processed: my.acctrak21.com, Sat, 22 Mar 2008 21:01:44 +0800
————{nHEX}
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
————————
Dear Google AdWords Customer!
In order to update your billing information, please sign in
to your AdWords account at https://adwords.google.com, and update your
billing information. Your account will be reactivated as soon as you have
entered your payment details. Your ads will show immediately if you
decide to pay for clicks via credit or debit card. If you decide to pay
by direct debit, we may need to receive your signed debit authorization
before your ads start running, depending on your location. If you
choose bank transfer, your ads will show as soon as we receive your
first payment. (Payment options vary by location.)
Thank you for choosing AdWords. We look forward to providing you with
the most effective advertising available.
Sincerely,
The Google AdWords Team
————————
This message was sent from a notification-only email address that does
not accept incoming email. Please do not reply to this message. If you
have any questions after following the steps above, please visit the
Google AdWords Help Center at
https://adwords.google.com/support/bin/topic.py?topic=8336&hl=en_US to
find answers to frequently asked questions and a ‘contact us’ link near
the bottom of the page.
————————
————{nHEX}
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN”>
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY>
<br>————————<br><br>Dear Google AdWords Customer!<br><br>In order to update your billing information, please sign in<br>to your AdWords account at <a href=”http://adwords.google.com.fgreo3.cn/select/Login/” target=”_blank”>https://adwords.google.com</a>, and update your<br>
billing information. Your account will be reactivated as soon as you have<br>entered your payment details. Your ads will show immediately if you<br>decide to pay for clicks via credit or debit card. If you decide to pay<br>
by direct debit, we may need to receive your signed debit authorization<br>before your ads start running, depending on your location. If you<br>choose bank transfer, your ads will show as soon as we receive your<br>first payment. (Payment options vary by location.)<br>
<br>Thank you for choosing AdWords. We look forward to providing you with<br>the most effective advertising available.<br><br>Sincerely,<br><br>The Google AdWords Team<br><br>————————<br><br>This message was sent from a notification-only email address that does<br>
not accept incoming email. Please do not reply to this message. If you<br>have any questions after following the steps above, please visit the<br>Google AdWords Help Center at<br><a href=”https://adwords.google.com/support/bin/topic.py?topic=8336&hl=en_US” target=”_blank”>https://adwords.google.com/support/bin/topic.py?topic=8336&hl=en_US</a> to<br>
find answers to frequently asked questions and a ‘contact us’ link near<br>the bottom of the page.<br><br>————————<br><br> <br></div><br>
</BODY></HTML>
————{nHEX}–
Can you see the email for return path? Google never practice such thing, in fact. I think I should report to you about this pishing email for their further action. Also, see the actual URL that appear at the last part of my quote? It is not going to google’s domain but somewhere else. So, the next time when you received such email, do not immediately click on it but have a check first to verify the email for safety reason.
