FYI Fairly well constructed Phish

tricky D

Hi,

Heads up in case you haven't yet come across this phish species. No action required.

Header highlights

Return-Path: <bills.eir.ie.lc93701ufsvppnr47329@hotelsangeminiano.it>
Received: from 7.mo5.mail-out.ovh.net ([178.32.124.100])
by Cloudmark Gateway with SMTP
id hosyb0jzYxo0rhosyb5nyl; Thu, 08 Sep 2016 03:16:17 +0100
Received: from player737.ha.ovh.net (b9.ovh.net [213.186.33.59])
by mo5.mail-out.ovh.net (Postfix) with ESMTP id AC860100CE3D
for <ZZZ>; Thu, 8 Sep 2016 04:16:16 +0200 (CEST)
Received: from PC-PC (unknown [62.102.148.179])
(Authenticated sender: info@hotelsangeminiano.it)
by player737.ha.ovh.net (Postfix) with ESMTPSA id 2FD43E0097
for <ZZZ>; Thu, 8 Sep 2016 04:16:14 +0200 (CEST)
From: "eir Bill Notifications"
<bills.eir.ie.lc93701ufsvppnr47329@hotelsangeminiano.it>
Subject: Your latest eir Bill cannot be processed

Message Body

Logos here

Bill Notification



Dear ZZZ,

An error occured when we tried to process the payment for your latest My eir bill. It appears that some of your billing details have expired. Your bill cannot be processed at this time. Your service is scheduled for automatic disconnection on:

10 September, 2016

To avoid service interruption, we recommend you to update your billing details now by following the link below:

https://my.eir.ie/initiatebillling/action:z6625o184b2e

ACTUAL LINK which I have edited to deactivate/break: http://www.my.eir.ie.DEACTIVATION EDITaslpsdex.com/qmqm.php?id=z6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2e

Regards,

My eir Customer Support



This is an automated email. Please do not reply to it as you will not receive a response. Contact us here.
z6625o184b2e

Eir: Pamela

tricky D wrote: »

Hi,

Heads up in case you haven't yet come across this phish species. No action required.

Header highlights

Return-Path: <bills.eir.ie.lc93701ufsvppnr47329@hotelsangeminiano.it>
Received: from 7.mo5.mail-out.ovh.net ([178.32.124.100])
   by Cloudmark Gateway with SMTP
   id hosyb0jzYxo0rhosyb5nyl; Thu, 08 Sep 2016 03:16:17 +0100
Received: from player737.ha.ovh.net (b9.ovh.net [213.186.33.59])
   by mo5.mail-out.ovh.net (Postfix) with ESMTP id AC860100CE3D
   for <ZZZ>; Thu,  8 Sep 2016 04:16:16 +0200 (CEST)
Received: from PC-PC (unknown [62.102.148.179])
   (Authenticated sender: info@hotelsangeminiano.it)
   by player737.ha.ovh.net (Postfix) with ESMTPSA id 2FD43E0097
   for <ZZZ>; Thu,  8 Sep 2016 04:16:14 +0200 (CEST)
From: "eir Bill Notifications"
<bills.eir.ie.lc93701ufsvppnr47329@hotelsangeminiano.it>
Subject: Your latest eir Bill cannot be processed

Message Body

Logos here  

Bill Notification



Dear ZZZ,

An error occured when we tried to process the payment for your latest My eir bill. It appears that some of your billing details have expired. Your bill cannot be processed at this time. Your service is scheduled for automatic disconnection on:

10 September, 2016

To avoid service interruption, we recommend you to update your billing details now by following the link below:

https://my.eir.ie/initiatebillling/action:z6625o184b2e

ACTUAL LINK which I have edited to deactivate/break: http://www.my.eir.ie.DEACTIVATION EDITaslpsdex.com/qmqm.php?id=z6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2ez6625o184b2e

Regards,

My eir Customer Support



This is an automated email. Please do not reply to it as you will not receive a response. Contact us here.
z6625o184b2e

[font=Verdana, sans-serif]Hi [/font][font=Verdana, sans-serif] [/font][font=Verdana, sans-serif]tricky D,[/font]
[font=Verdana, sans-serif] [/font]
[font=Verdana, sans-serif]Thanks for getting in touch. We are aware of a series of unsolicited emails being received by members of the public where the email appears to come from eir. You can read more on this here http://support.eir.ie/article/phishingalert&#160;[/font]
[font=Verdana, sans-serif] [/font]
[font=Verdana, sans-serif]- Pamela [/font]

[font=Verdana, sans-serif] [/font]

McSim

I got the same phishing email today. As I made changes to my eir contract very recently I did click through to the phishing web site. It is very successful in resembling look and feel of the original myeir account.

I want to thank thread started for bringing the issue to the public.

But I do not agree with "no action required" as well as I think it is far not enough for Eir "to be aware of the issue". Eir should act on such reports, at very least put pressure on the hosting to shut down the phishing web site the link from email is pointing to ASAP.

Eir: Pamela

McSim wrote: »

I got the same phishing email today. As I made changes to my eir contract very recently I did click through to the phishing web site. It is very successful in resembling look and feel of the original myeir account.

I want to thank thread started for bringing the issue to the public.

But I do not agree with "no action required" as well as I think it is far not enough for Eir "to be aware of the issue". Eir should act on such reports, at very least put pressure on the hosting to shut down the phishing web site the link from email is pointing to ASAP.

[font=Verdana, sans-serif]Thanks for your feedback [/font][font=Verdana, sans-serif]McSim,[/font][font=Verdana, sans-serif] [/font][font=Verdana, sans-serif]I'll pass this onto the relevant team.[/font]
[font=Verdana, sans-serif] [/font]
[font=Verdana, sans-serif]-Pamela [/font]

[font=Verdana, sans-serif] [/font]