Results 1 to 7 of 7
  1. #1

    Interesting email from TelCan regarding rate change...

    Just received this following email from TelCan with an Excel attachment 212 bytes. I'm not sure how legit this and if it is bogus, how they got my email address. Spelling and grammatical errors are left intact and are not mine. The only changes made are the "removed" in the headers.

    Return-Path: <[email protected]>
    Received: from ns1.removed.com ([email protected])
    by removed.com (8.11.6/8.11.6) with ESMTP id i3L375e12570
    for <removed>; Tue, 20 Apr 2004 23:07:05 -0400
    Received: from ns1.removed.com ([email protected])
    by removed.com (8.11.6/8.11.6) with ESMTP id i3L372M25992
    for <removed>; Tue, 20 Apr 2004 23:07:02 -0400
    X-ClientAddr: 64.124.51.103
    Received: from telcan.net (go.web800call.com [64.124.51.103] (may be forged))
    by ns1.removed.com (8.11.6/8.11.6) with SMTP id i3L36ju28808
    for <removed>; Tue, 20 Apr 2004 23:06:46 -0400
    Received: by telcan.net with MERCUR Mailserver (v4.02.15 MTE1OC0xMDUwMS0xNzE2NQ==) for <removed>; Tue, 20 Apr 2004 23:01:49 -0400
    From: [email protected]
    To: removed
    Date: Tue, 20 Apr 2004 23:01:48 -0500
    Subject: Rates change notification ( CR0150120383 ) - Telcan Inc.
    MIME-Version: 1.0
    Content-Type: multipart/mixed; boundary="XX7BD67B46-02967BD6XX"
    Content-Transfer-Encoding: 7bit
    Message-Id: <[email protected]>
    X-yoursite-MailScanner: Found to be clean, Found to be clean
    X-yoursite-MailScanner-SpamCheck: not spam, SpamAssassin (score=0.261,
    required 6, BAYES_50 0.00, MIME_SUSPECT_NAME 0.10,
    NO_REAL_NAME 0.16), not spam, SpamAssassin (score=0.26,
    required 6, MIME_SUSPECT_NAME 0.10, NO_REAL_NAME 0.16)
    X-yoursite-MailScanner-Information: Please contact the ISP for more information
    Status:


    Dear Chris Holland,

    Your longdistance rates would have some changes effective 5/4/2004 as shown on the attached file. Please contact your account manager if you have any question.

    Thank you for using Telcan.

    Sincerely,

    TELCAN SUPPORT TEAM
    1 905 804 9111
    1 905 804 9888 FAX
    I'm going to be calling to verify, but this might be something to look out for in the meantime. That kind of spelling and unprofessionalism just screams virus to me.
    www.square-network.com www.squarenetwork.com
    Now available in regular and dehyphenated.
    May 2003 Member of the Month
    Useless Community Liason Ever Since.

  2. #2
    Join Date
    Aug 2000
    Location
    NYC
    Posts
    6,627
    Yeah, looks like just a variant on the virus-carrying emails that purport to be from your isp regarding problems with your email account or whatever. Seems pretty unlikely that they'd send you an Excel file to illustrate a change in long distance rates, doesn't it? How would they know you'd have any idea what to do with it?
    Specializing in SEO and PPC management.

  3. #3
    Join Date
    Sep 2002
    Location
    Western Canada
    Posts
    1,888
    I got the same thing. And since the name it is addressed to is only known by telcan, I'm assuming it's real.

  4. #4
    Join Date
    Aug 2000
    Location
    NYC
    Posts
    6,627
    Actually, looking now at what can be deciphered from the headers posted it does look like it came from telcan.net. Still seems odd to send an Excel file, but I suppose that really could be a good thing, that they're giving more detailed information.

    If it were me I'd open that file and check it out. I ain't afraid of no macro virus (and if there's no hidden extension on that file, it couldn't be anything worse than that).
    Specializing in SEO and PPC management.

  5. #5
    Join Date
    Sep 2002
    Location
    Western Canada
    Posts
    1,888
    I downloaded it.

    Code:
    Rate TableID	Country	Rate            Code     Curr Rate	New Rate	Effective Date
    95	        Papua New Guinea-Proper	PGX	  0.342	        0.5535	        5/4/2004

  6. #6
    Join Date
    Aug 2000
    Location
    NYC
    Posts
    6,627
    Oh no! You now have the dreaded Papua New Guinea Rate Increase Virus!!1!

    Specializing in SEO and PPC management.

  7. #7
    Originally posted by JayC
    Oh no! You now have the dreaded Papua New Guinea Rate Increase Virus!!1!

    That's classic.

    It amazes me that a company like this would send something out without at least doing spell check. I checked the headers last night and saw that it was a telcan property that sent them email, however I just figured it was some l33t kiddy hacker who decided to play around with the customer database.
    www.square-network.com www.squarenetwork.com
    Now available in regular and dehyphenated.
    May 2003 Member of the Month
    Useless Community Liason Ever Since.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •