EARTHLINK hoax email and web site scam
4th November 2003

Just in case earthlink.net haven't told you ..... Account Hijackers are now pretending to be Earthlink with a new Hoax Email Scam which includes a fake web site!

Have you received an email from Earthlink which tells you that you need to verify your data otherwise your account will be closed? Well, its a fake, forgery and a Hoax Email Scam created and distributed to hijack your email, credit or debit card and Bank accounts (not to mention your Social Security No). With that kind of data in the hands of the fraudsters (those that create, distribute and operate this kind of scam), your financial future is in certain peril.

This may not be the first email fraud scam to hit Earthlink users, and its doubtful that it will be the last - these spoof emails have a terrible habit of reappearing with links to different web pages, so read on because this kind of scam may be coming to an inbox near you soon!

see more of these hoax email scams - click here

In this hoax, scammers are preying on those in fear of losing their Earthlink access to the internet. Tainted with just the right suggestion, this email aims to convince recipients to use the link in the email to prevent this from happening. No, it wont take you to the genuine Earthlink site at all (although, the fake is very convincing), instead it will lead you to a fake Earthlink web site. See the images (below) for more.

We have informed Earthlink of this scam - particularly because we found no warning to their users on their site (perhaps they were unaware of its existance?) That being the case, this email has so far had 4 full days to spend in inboxes with the hope of collecting whatever data that unsuspecting users may provide.

See the images and report (below) for more .....

image is 80% of actual size ...

The Forged Earthlink Web Page...

The hoax web page looks like a genuine Earthlink page. It is clearly apparent that the page is a fake when you see the URL/web address in your browser's address bar.

http://200.161.151.54/track/billing.htm?session_id=849578..........
which is hosted by telesp.net.br (Telecomunicacoes De Sao Paulo in Brazil)

This page contains a form for you to provide your email user ID and password, credit card information, bank details, etc...

If you provide this information and submit it, it is captured using PHP script while you are sent to another fake Earthlink page ...