Is this a scam (or not!!)

[Anonymous]

Has anybody received a message like this recently :-

Subject:  Your O2 bill is ready #2230798

From:  O2 billing <conneask-pinter@platan.praguebest.cz>

Dear Customer,

Your O2 bill for 28/05/14 is now ready. You can look at your bill here

In total, your bill for this month comes to £312,48. We'll request this amount from your chosen account on, or just after, the date in your bill.

To see your bill, you'll need the username and password you were given when you joined O2. If you've forgotten them, we can give you a reminder

Is your bill more than you were expecting ?
If so, here's a few reasons why this might be:

• You could have gone over the minutes, texts or data that's in your allowance.
• You could have called or sent texts to numbers that can't be taken from your allowance such as International, 0800, 0845 numbers or directory enquiries.
• You have used your phone for calls, text or data whilst abroad.

To view any charges outside your allowance click here

If you have any questions, just ask Lucy. She's our online virtual agent. You can also find out more about what's included in your bill with an online demonstration.

Best regards

O2

This email is sent from Telefónica UK Limited. Registered office:
260 Bath Road,Slough, Berkshire, SL1 4DX. Registered number: 3270368.
Please do not reply.

What makes me question it, is that the resistered number is different to other bills I've received.

Any thoughts?

[Anonymous]

Hi

I've flagged this for @Toby to check for you.

He is official O2 site staff.

[Anonymous]

Thanks for passing it on.  I didn't know who to contact on the O2 website.

[jonsie]

It's a scam, reported here :

http://community.o2.co.uk/t5/Welcome-News/Phishing-Email/m-p/674079/highlight/true#M9599

[jonsie]

and here:

http://community.o2.co.uk/t5/Pay-Monthly-and-Pay-Go/BIG-BILL-Email-Not-from-O2-Phishing-Alert/m-p/67...

[MI5]

I think is is the dead giveaway
"From: O2 billing <conneask-pinter@platan.praguebest.cz>"

[viridis]

if clicked on that link disconnect your computer from the internet and run a full virus scan in safe mode.
It is a phishing trojan installer and even though it directs to a hosting site, you never know....

[jonsie]

asked the mods to remove any links

[Anonymous]

The only link that would have been malicious is the very first one. All the rest point to O2 website pages.

As it stands the hosting for the first page has been removed:

[aldaweb]

---

@viridis wrote:
if clicked on that link disconnect your computer from the internet and run a full virus scan in safe mode.
It is a phishing trojan installer and even though it directs to a hosting site, you never know....

---

Probably academic as the host is offline but in cases of suspected virus infection it's better to use a bootable CD such as Kaspersky Rescue Disk to scan for malware rather than boot a possibly infected system.