1-800 Vishing in Spam, Scam and Phishbusters

Re: 1-800 Vishing

Mon, 17 Dec 2007 18:47:41 EDT

garys_2k : Oh, that is TOO damn funny! Great to see this "modality" not working out so well for the vlads.

Re: 1-800 Vishing

Mon, 17 Dec 2007 15:07:50 EDT

Lizz : Your assumption is correct!

Too funny, using the real number :D

Re: 1-800 Vishing

Mon, 17 Dec 2007 14:59:02 EDT

MGD :

said by Lizz :

And pretty well-done too!

.
Indeed !! .... it may actually be overdone. That number 800-759-8722 is the real USAA phone number: »www.google.com/search?hl=en&q=800-759-8722+

Did the Visher screw up and put their number instead of a Vish number??

Clearly the email originated from Slovenia:

212.18.40.31 ptr= cpe-212-18-40-31.static.amis.net.


 Information related to '212.18.32.0 - 212.18.43.255'
 
inetnum:        212.18.32.0 - 212.18.43.255
netname:        SI-AMIS-NET-1
descr:          Amis
descr:          Network infrastructure
country:        SI
admin-c:        ART15-RIPE
tech-c:         ART15-RIPE
status:         ASSIGNED PA
mnt-by:         AMIS-MNT
mnt-lower:      AMIS-MNT
mnt-routes:     AMIS-MNT
changed:        ripe@amis.net 20070523
source:         RIPE
 
role:           Amis RIPE Team
address:        Amis d.o.o.
address:        Trzaska cesta 85
address:        2000 Maribor
address:        Slovenia
phone:          +386 2 620 6309
fax-no:         +386 2 620 6325
e-mail:         ripe@amis.net
abuse-mailbox:  abuse@amis.net
admin-c:        BZ232-RIPE
tech-c:         BZ232-RIPE
tech-c:         DK1228-RIPE
tech-c:         DC2069-RIPE
tech-c:         SP4494-RIPE
tech-c:         AK3489-RIPE
tech-c:         VN565-RIPE
tech-c:         JH4603-RIPE
nic-hdl:        ART15-RIPE
mnt-by:         AMIS-MNT
source:         RIPE
changed:        ripe@amis.net 20060920
 
% Information related to '212.18.32.0/19AS8591'
 
route:          212.18.32.0/19
descr:          Amis
origin:         AS8591
mnt-by:         AMIS-MNT
changed:        ripe@amis.net 20051105
source:         RIPE

Maybe you can watch for a seconf "corrected" email with a revised number. I assume you do not have a USAA account.

MGD

1-800 Vishing

Mon, 17 Dec 2007 13:14:39 EDT

Lizz : And pretty well-done too!

From USAA Mon Dec 17 09:50:51 2007X-Apparently-To:myemail@pacbell.net via 209.191.85.225; Mon, 17 Dec 2007 09:55:57 -0800X-YahooFilteredBulk:64.166.24.133X-Originating-IP:[64.166.24.133]Return-Path:<usaa.web.services@customermail.usaa.com>Authentication-Results:mta130.sbc.mail.mud.yahoo.com from=customermail.usaa.com; domainkeys=neutral (no sig)Received:from 207.115.36.92 (EHLO nlpi076.prodigy.net) (207.115.36.92) by mta130.sbc.mail.mud.yahoo.com with SMTP; Mon, 17 Dec 2007 09:55:57 -0800X-Originating-IP:[64.166.24.133]Received:from mail.pressdemo.com (mail.pressdemo.com [64.166.24.133]) by nlpi076.prodigy.net (8.13.8 inb regex/8.13.8) with ESMTP id lBHHtuK2001494 for <myemail@pacbell.net>; Mon, 17 Dec 2007 11:55:56 -0600Received:from User [212.18.40.31] by mail.pressdemo.com with ESMTP (SMTPD-9.22) id A6D706CC; Mon, 17 Dec 2007 09:50:15 -0800From:"USAA" <USAA.Web.Services@customermail.usaa.com>  Add to Address BookAdd to Address Book  Add Mobile AlertSubject:Personal Information UpdateDate:Mon, 17 Dec 2007 18:50:51 +0100MIME-Version:1.0Content-Type:text/html; charset="Windows-1251"Content-Transfer-Encoding:7bitX-Priority:1X-MSMail-Priority:HighX-Mailer:Microsoft Outlook Express 6.00.2800.1081X-MimeOLE:Produced By Microsoft MimeOLE V6.00.2800.1081Message-Id:<200712170950890.SM03876@User>X-Declude-RefID:str=0001.0A010209.4766786F.00BD,ss=3,sh,fgs=0Content-Length:5989 To ensure delivery to your inbox, please add USAA.Web.Services@customermail.usaa.com to your address book.     Personal Information UpdateView Accounts |Privacy Promise | Contact UsOnline Security Guarantee      Please take a moment to verify the following information: Our records show that on 12/16/07, at 09:00 AM, you accessed usaa.com and established or updated the following information:     * Social Security Number    * Date of Birth No action is necessary unless this activity occurred without your knowledge or permission. Please call (800) 759-8722 to report unauthorized changes.We value your business and are committed to keeping your accounts and personal information safe and secure.Thank you,USAA        Please do not reply to this e-mail. To send a secure message to USAA, please contact us. Privacy PromiseUSAA, 9800 Fredericksburg Road, San Antonio, TX 7828866658-0307