Results 1 to 8 of 8

Thread: Strange Email Claiming to be From BT

  1. #1
    ASL Kev's Avatar
    Join Date
    Jul 2013
    Location
    Hwicce
    Posts
    3,746
    Thanks
    372
    Thanked 745 Times in 544 Posts

    Strange Email Claiming to be From BT

    I just received an email with subject 'New BT Bill'. The content claims to be from BT Business and gives me an amount of the bill and a download link, saying it will take up to 24 hours to be ready. It all looks legit, all the links are to BT but it doesn't ring true to me. The end of the message says "If you've received this email in error, please let me know immediately on the email address above. Thank you. We monitor our email system, and may record your emails." Looking back the reply address is designed to look like it is [email protected] but is actually [email protected] (so not BT).

    My guess is this is a spammer trying to add data to a list of email addresses, ie. if I replied along the lines of a rant about the bill being too high or me not being a BT customer, here are all my details, go check, then they would have all those details associated with an active email address. I haven't seen one quite like this before, am I correct?

  2. #2
    Member
    Join Date
    Jan 2017
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I also received one of these detailing my very expensive BT invoice. Slightly suspicious as I don't have BT....
    It's someone trying it on

  3. #3
    Assistant Beaver Leader Keith's Avatar
    Join Date
    Jul 2004
    Location
    Ingleby Barwick, England
    Posts
    3,740
    Thanks
    135
    Thanked 124 Times in 88 Posts
    Domain is registered to an individual named Sung Lee from China and was first registered on Sunday. A quick whois lookup brings up his name, address and telephone number.

    Looks very much like a scammer, and not a very intelligent one at that.
    Keith "Hawkeye"
    (Acting) Beaver Scout Section Leader (Woodbadge)
    Group Executive Committee Member
    Group Badge Secretary
    Group Web Manager
    Fundraising Co-ordinator - Group Family Camp 2018
    1st Ingleby Barwick (St Francis) Scout Group



    https://www.inglebybarwickscouts.org.uk


    WE NEED MORE ADULT VOLUNTEERS!
    Volunteer at 1st Ingleby Barwick Scout Group
    Section Leaders, Assistant Section Leaders, Sectional Assistants, Occasional Helpers, etc.


  4. The Following 2 Users Say Thank You to Keith For This Useful Post:

    Kev (20-06-2017),shiftypete (20-06-2017)

  5. #4
    CSL (In training)
    Join Date
    Jun 2014
    Posts
    2,556
    Thanks
    2,058
    Thanked 584 Times in 431 Posts
    If you've opened any of the attachments, you quite possibly have a virus now too.....

    If it looks dodgy, delete it. If it's legit, they'll chase it up by other means, and can re-send....

  6. The Following User Says Thank You to nevynxxx For This Useful Post:

    shiftypete (20-06-2017)

  7. #5
    ASL Kev's Avatar
    Join Date
    Jul 2013
    Location
    Hwicce
    Posts
    3,746
    Thanks
    372
    Thanked 745 Times in 544 Posts
    Quote Originally Posted by nevynxxx View Post
    If you've opened any of the attachments, you quite possibly have a virus now too.....
    It hasn't got the usual attached Microsoft format document. It literally looks like they just want me to reply to it (presumably in the hope I will give information about myself in the reply). As Keith says, it just looks like a dumb spammer but I bet a lot of people would fall for it.

  8. #6
    CSL (In training)
    Join Date
    Jun 2014
    Posts
    2,556
    Thanks
    2,058
    Thanked 584 Times in 431 Posts
    Quote Originally Posted by Kev View Post
    It hasn't got the usual attached Microsoft format document. It literally looks like they just want me to reply to it (presumably in the hope I will give information about myself in the reply). As Keith says, it just looks like a dumb spammer but I bet a lot of people would fall for it.
    It's possible.... are you looking at raw source though, it could well have image links and all sorts you can't immediately see...


    Sent from my iPad using Tapatalk

  9. #7
    ASL Kev's Avatar
    Join Date
    Jul 2013
    Location
    Hwicce
    Posts
    3,746
    Thanks
    372
    Thanked 745 Times in 544 Posts
    Quote Originally Posted by nevynxxx View Post
    looking at raw source
    Source

    Received: from static.24.41.9.176.clients.your-server.de ([176.9.41.24] helo=mail30.ddconnections.org)
    by smtp12.mailcore.me with esmtp (Exim 4.80.1)
    (envelope-from <[email protected]>)
    id 1dNI8E-0000FT-MD
    for XXXXXXXXXXXX; Tue, 20 Jun 2017 13:19:43 +0100
    DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dd.connect; d=ddconnections.org;
    h=Message-ID:From:To:Subjectate:MIME-Version:Content-Type:List-Unsubscribe; [email protected];
    bh=116eWTyxO5qEGB5zB861TJRhABQ=;
    b=UkHlnHF4Js2ynArDIKFDQQPWmdYB6umwAwv71eyPVnEs9DPI cwQb8OvQmSJ0GB9P0NXWdFLp8IzV
    R6lHh2Vzvh5ZEr8eeS2OUdD5HJeQ1BXpMQQNexCRL4mCHmXYUm 1Nc4japmjKq53476CQz3zaysvW
    PwfbTJ053Dvstyea4vc=
    DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dd.connect; d=ddconnections.org;
    b=KOMZg3D5ZIKKSPMWVBPcotPs+Cj7zGDk3/UCZWR8upcf8LFy1jfCa3dWprMwqxunp8WXIwPLclOA
    1eemxj+JrDAJNF0336iEyuFVu/5CTfNp3ySu2TVs4QxbaKF8/3DvotPuMey2TQUrkNSumMzlBzUh
    Up/sR4c0J/CeSuqgiB0=;
    Message-ID: <[email protected] g>
    From: "[email protected]" <[email protected]>
    To: <XXXXXXXXXXXX>
    Subject: New BT Bill
    Date: Tue, 20 Jun 2017 05:17:53 -0700
    MIME-Version: 1.0
    Content-Type: multipart/alternative; boundary="30dfc3f75e903e12e8405116d823"
    List-Unsubscribe: <mailto:[email protected]>
    X-KLMS-Rule-ID: 1
    X-KLMS-Message-Action: clean
    X-KLMS-AntiSpam-Status: not scanned, license restriction
    X-KLMS-AntiPhishing: not scanned, license restriction
    X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server, version 8.0.1.721, bases: 2017/06/20 08:01:00 #9850813
    X-KLMS-AntiVirus-Status: Clean, skipped

    This is a multi-part message in MIME format.

    --30dfc3f75e903e12e8405116d823
    Content-Type: text/plain; charset="utf-8"
    Content-Transfer-Encoding: quoted-printable

    New BT Bill=20

    Your bill amount is: 142.13 GBP. This doesn't include any amounts brought=
    forward from any other bills.
    We've put your latest BT bill for you to view. See your bill here.
    The PDF version of your bill might not be available for download yet. It =
    can take up to 48 hours.
    We'll take your payment from your account as usual by Direct Debit.
    Reduce paper waste
    You're still getting paper bills by post. Why not go paper-free, and stop=
    storing and shredding them once and for all?
    Need some help?
    Go to www.bt.com/business/support.
    Thanks for choosing BT.
    Iluminada Ohme
    CEO, BT Business
    Payment processing fee: BT Payment Services Ltd, a BT Group Company, char=
    ges this fee.

    This or confidential. It's meant only for the individual(s) email contain=
    s BT information, which may be privileged or entity named above. If you'r=
    e not the intended recipient, note that disclosing, copying, distributing=
    or using this information is prohibited. If you've received this email i=
    n error, please let me know immediately on the email address above. Thank=
    you. We monitor our email system, and may record your emails.

    --30dfc3f75e903e12e8405116d823
    Content-Type: text/html; charset="utf-8"
    Content-Transfer-Encoding: quoted-printable

    <HTML><HEAD>
    <META http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
    </HEAD>
    <BODY>
    <DIV>
    <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" align=3Dcenter bgCo=
    lor=3D#ededed=20
    border=3D0>
    <TBODY>
    <TR>
    <TD>
    <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D500 align=3Dcenter b=
    gColor=3D#ededed=20
    border=3D0>
    <TBODY>
    <TR>
    <TD width=3D"100%">
    <DIV style=3D"DISPLAY: inline-block"><IMG alt=3DHello=20
    src=3D"http://www.bt.com/ext/static/wa/kci/btbusiness/30111_h=
    1_KeepingYouInformed.gif"=20
    width=3D500 height=3D86><SPAN style=3D"DISPLAY: none"> </SPAN=
    ><SPAN=20
    style=3D"DISPLAY: none"></SPAN></DIV>
    <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" align=3D=
    center=20
    bgColor=3D#ffffff border=3D0>
    <TBODY>
    <TR>
    <TD align=3Dright>
    <DIV style=3D"DISPLAY: inline-block"><A=20
    href=3D"http://www.bt.com/business/fyi/bt" target=3D_bl=
    ank><IMG=20
    border=3D0 alt=3D"From BT"=20
    src=3D"http://www.bt.com/ext/static/wa/kci/btbusiness/3=
    01111_small-bt.gif"=20
    width=3D123 height=3D73></A></DIV></TD></TR>
    <TR>
    <TD align=3Dcenter>
    <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"90%" bo=
    rder=3D0>
    <TBODY>
    <TR>
    <TD=20
    style=3D"FONT-SIZE: 14px; FONT-FAMILY: Tahoma,Helve=
    tica,Arial,sans-serif; COLOR: #001d27; TEXT-ALIGN: left"=20
    align=3Dleft><STRONG>New BT Bill</STRONG> </TD></TR=
    >
    <TR>
    <TD=20
    style=3D"FONT-SIZE: 12px; FONT-FAMILY: Tahoma,Helve=
    tica,Arial,sans-serif; COLOR: #001d27; TEXT-ALIGN: left"=20
    align=3Dleft><BR>Your bill amount is:=20
    142.13=20
    GBP. This doesn't include any amounts brought for=
    ward=20
    from any other bills.<BR><BR>We've put your lates=
    t BT=20
    bill for you to view. <A=20
    href=3D"https://secure.business.bt.com/Hub"=20
    target=3D_blank>See your bill here</A>.<BR><BR>Th=
    e PDF=20
    version of your bill might not be available for d=
    ownload=20
    yet. It can take up to 48 hours.<BR><BR>We'll tak=
    e your=20
    payment from your account as usual by Direct=20
    Debit.<BR><BR><STRONG>Reduce paper=20
    waste</STRONG><BR>You're still getting paper bill=
    s by=20
    post. Why not <A=20
    href=3D"http://www.bt.com/business/bill/gopaperfr=
    ee"=20
    target=3D_blank>go paper-free</A>, and stop stori=
    ng and=20
    shredding them once and for all?<BR><BR><BR><STRO=
    NG>Need=20
    some help?</STRONG><BR>Go to <A=20
    href=3D"http://www.bt.com/business/support"=20
    target=3D_blank>www.bt.com/business/support</A>.<=
    BR><BR>Thanks=20
    for choosing BT.<BR><BR>Iluminada=20
    Ohme<BR>CEO, BT=20
    Business<BR><BR>Payment processing fee: BT Paymen=
    t=20
    Services Ltd, a BT Group Company, charges this fe=
    e.=20
    </TD></TR></TBODY></TABLE></TD></TR>
    <TR>
    <TD bgColor=3D#ededed>
    <DIV style=3D"DISPLAY: inline-block"><IMG=20
    src=3D"http://www.bt.com/ext/static/wa/kci/btbusiness/3=
    01111_bggrey.gif"=20
    width=3D"100%" height=3D6><SPAN style=3D"DISPLAY: none"=
    >=20
    </SPAN><SPAN style=3D"DISPLAY: none"></SPAN></DIV></TD>=
    </TR>
    <TR>
    <TD align=3Dcenter>
    <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" b=
    order=3D0>
    <TBODY>
    <TR>
    <TD=20
    style=3D"FONT-SIZE: 11px; FONT-FAMILY: Tahoma,Helve=
    tica,Arial,sans-serif; COLOR: #001d27"=20
    align=3Dcenter>This or confidential. It's meant onl=
    y for=20
    the individual(s) email contains BT information, =
    which=20
    may be privileged or entity named above. If you'r=
    e not=20
    the intended recipient, note that disclosing, cop=
    ying,=20
    distributing or using this information is prohibi=
    ted. If=20
    you've received this email in error, please let m=
    e know=20
    immediately on the email address above. Thank you=
    . We=20
    monitor our email system, and may record your=20
    emails.</TD></TR></TBODY></TABLE></TD></TR></TBODY></=
    TABLE></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></DIV></BODY></=
    HTML>

    --30dfc3f75e903e12e8405116d823--

  10. #8
    CSL (In training)
    Join Date
    Jun 2014
    Posts
    2,556
    Thanks
    2,058
    Thanked 584 Times in 431 Posts
    Quote Originally Posted by Kev View Post
    Source
    Nice... yeah, not dangerous in itself.... probably just harvesting valid addresses as you say.


    Sent from my iPad using Tapatalk

Similar Threads

  1. Strange history
    By Tony Ransley in forum The Lounge
    Replies: 0
    Last Post: 27-02-2013, 05:21 PM
  2. Strange Air Scout request
    By RedCoat in forum Scouting Talk
    Replies: 5
    Last Post: 25-06-2012, 07:45 PM
  3. Strange find at the seaside
    By Jay Biggs in forum The Lounge
    Replies: 13
    Last Post: 14-02-2010, 10:17 PM
  4. Strange Question
    By MullofKintyre in forum Scouting Talk
    Replies: 14
    Last Post: 27-05-2009, 03:21 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •