Browsers forum: genuine or phishing

We need details Amos

Firstly, a translation. We could use a resource like Google translate or some translate web site to do that, but since you know the French language, you could provide that without error

Next, where are you? In France or some French language country? If not, do you know any reason why L\'equipe of GMail would contact you?

I assume your secondary email is GMail, so what do their support say?

What does Source say for this email? This is the hidden details of the email which shows where this email originated from and if you are using email client software can be seen by going to View > Message source.

Mark

Amos, I've removed some other email addresses from your post and re-posted. Hope you don't mind.

Mark

Thanks, Mark - I have been working on four continents, but never in a French-speaking country. For the past eight years, my home has been in Jerusalem, Israel. Here is first of all a translation of the questionnaire that arrived by Gmail. I shall then try to send you the "source" but am not sure if it is any good - it is of the copy of the questionnaire that I sent to myself to keep. The original has been deleted with all the rest of my incoming mail on Gmail. Here goes:
"Dear member: Maximal optimisation of the electronic message service. In the context of your use of Gmail we introduce technologies and algorithms to ensure a better and more efficient way of surfing. In this context, our aim is to expunge all the inactive accounts, since with the increasing demands of the users we have the duty to serve you better. The Gmail staff informs you of the disactivisation of your account, in line with our rules if you do not confirm your address. We ask you to copy and fill in the attached form, including all the details asked for, and to return it within 48 hours. Please use this form in order to confirm that you are the owner of this address; if you do not comply with this your account will be disabled for disregard of the Gmail rules. Identity of the user.... Name and Surname...... Date of birth....... Gmail account...... Gmail password.... Country and town of residence..... Profession..... Telephone number..... Your response to the security question..... Secondary address.......
Attention: The Gmail staff are not responsible of what may happpen in the event of your account being disabled if you do not fill in the questionnaire correctly. With best wishes the Gmail staff ! Copyright c
2011 - for the organisations - rules of confidentiality - rules of the programme - conditions of use"

This, as I said previously arrived on the 26th of December. I shall now try to send you the "source" that I obtained form the copy of the incoming message to my main account at Google (by the way, they do not have a customer or technical service, except one that requires payment. And my PayPal account in still in US dollars, while they insist on charging me in Shekels. Impasse) Here goes, I hope:

Return-Path: Received: from [192.168.2.110] (bzq-84-111-73-198.red.bezeqint.net. [84.111.73.198])
by mx.google.com with ESMTPS id y12sm221620546eeb.11.2012.01.04.10.28.29
(version=SSLv3 cipher=OTHER);
Wed, 04 Jan 2012 10:28:30 -0800 (PST)
Message-ID: <xxxxxxxx.xxxxxxx@Gmail.com>
Date: Wed, 04 Jan 2012 20:28:23 +0200
From: amos .... User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; he; rv:1.9.1.12) Gecko/20100914 Thunderbird/3.0.8
MIME-Version: 1.0
To: Gmail Service Maintenance Alerte Mot de passe <service.securitexxxxxxxx@gmail.com>,...
Subject: Re: [Gmail Security] =?UTF-8?B?Y2zDtHR1cmUgc3lzdMOpbWF0aXF1ZSBkZQ==?=
=?UTF-8?B?IHZvdHJlIGNvbXB0ZSBkYW5zIDI0SOKAj+KAjw==?=
References: <DUB102-W4830CAD7214059C088FF70BCAC0@phx.gbl> <DUB102-W29D209603152D536D920FCBCAD0@phx.gbl>
In-Reply-To: <DUB102-W29D209603152D536D920FCBCAD0@phx.gbl>
Content-Type: multipart/alternative;
boundary="------------000404090005030103050605"

This is a multi-part message in MIME format.
--------------000404090005030103050605
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

I have blacked out my particulars including Gmail and Yahoo account details. By the way, the original was still there on January 4th when I copied it. But it apparently self-destructed in some manner. All the best - Amos

but frankly I'm stumped.

And by the way, also good work Amos in blanking out your own personal information. I had forgotten to say that in my first reply.

I'm stumped because I think it's genuine! The message source is full of information about who sent this to you, and I can't find anything that suggests it is phishing or otherwise a scam. This is what I see;

1] Return-Path: - red.bezeqint.net

I did a WHOIS for red.bezeqint.net and found the information here; http://whois.domaintools.com/79.179.51.162

Israel Petach Tikva Bezeq International-ltd seems a genuine Israeli company whose IP address 79.179.51.162 has been allocated by RIPE.Net, http://www.ripe.net/data-tools/db

RIPE "The RIPE Database contains registration information for networks in the the RIPE NCC service region and related contact details."

2] BEZEQINT HOSTMASTERS TEAM - Bezeq International
Address: 40 Hashacham St, Petach, Tikva 49170, Israel
{This is information available on the internet so I don't mind posting it here}
Their web site - http://ir.bezeq.co.il/phoenix.zhtml?c=159870&p=irol-faq involved in telecommunications.

3] Also noted in the source, bzq-84-111-73-198.

Whois - http://whois.domaintools.com/84.111.73.198 the same Israeli company.

4] From the source, Message-ID xxxxxxxx.xxxxxxx@Gmail.com {random characters removed}, but the GMail is significant.

5] From the source, Email from Amos To: Gmail Service Maintenance Alerte Mot de passe <service.securitexxxxxxx@gmail.com> {x's included to protect correct address}

There's nothing there that says this is false. But what I do not understand is why an email was sent to you requesting your personal information like your password, address, security question/answer and so on. Especially so since this is an Israeli company as they should know better.

I also fail to understand the language used. Why French? Is there some significance to that in Israel?

It is just all strange, but I do think it is genuine.

Sorry. Not much help from me and I am not sure what you can do now. I'm surprised GMail doesn't have support, even for free email accounts. I wonder if this would help?
http://support.google.com/mail/bin/request.py?hl=en

Mark

Mark, bezeq is my ISP, and its central station in Israel is located in Petah Tiqva. So there is no surprise in that. There is nothing in Israel that would justify anyone addressing me in French. So there we are. I would not mind paying for the Google support, but they have a standard PayPal formula that apparently tells them anyone in Israel should pay in Shekels. And I do not want to pay by credit card because in recent days several thousand Israel credit card accounts have been hacked into and their particulars published on the Web. Apparently some revenge action by a Saudi hacker. Shall try your URL again, although I think that I have tried it in the past. I have in the meantime inserted another firewall in the hope that the attackers who apparently purport to be acting on behalf of Google can be stopped. Thanks so far - Amos

i found this link: which is from a google search

as the bottom line seems to be "send us all your private information
and we will be as gentle as possible while ******* you" i would say
SCAM/PHISHING

jonah

,.

Any idea how they could have disabled Amos' Gmail account?

Mark

"sometimes just reading the email is enough to allow identity theft"

they (possibly) took his name and password, but i find it strange
that they just deleted things and didn't change the password (as
happened to a friend a few weeks ago, she was locked out and
everybody in her address book received a frantic "i'm stranded
in Barcelona, my credit cards have been stolen, can you send
money??? email)

she managed to contact google and they cancelled the bogus
password, she retrieved her address book, deleted all emails
and said no more google"

,.

Hi Jonah - did check out all these possibilities - and then some. All of them are standardised formulas and none of them fits. One of the reasons is that the original message sent to me was also deleted in some manner, so that I had only the copy I made of it, and this was seen by Mark and found useless because the original sender was not traceable through "source". There was nothing like my tale on the google and gmail forums. And the offered help by experts will have to wait until Monday because it costs money, and my PayPal account is in dollars only, while they demand shekels and nothings else, having traced my IP address to Petah Tiqvah. I cannot send them my credit card details, because Israel has recently come under attack by hackers who published several thousand of them on the web. And since Google experts seem to be off on weekends the adjustment and subsequent trial to get to them again will have to wait. Thanks for trying - Amos.

Hello - I cannot see a link called "view source" or anything similar on my toolbar. In any case, it was not the original. Gmail finally solved my main concern: how to get my inmail back, and they referred me to the in-box at Gmail (not Thunderbird through which I usually work). There it was. Cost some money, but it was worth it. Thanks you all for trying - Amos/