Is This Legitimate or a Scam?

[dave6x]

I have just received this message relating to an email from a relative who is also on Virgin email user with a @ntlworld.com address:

"Subject: [IMPORTANT] Your mailbox is full

THIS IS AN AUTOMATED MESSAGE - THERE'S NO NEED TO REPLY.

Unfortunately, because your mailbox is full, messages cannot be delivered
to you. This may be as a result of you receiving large files that have
used up your quota.

But don't worry it.s easy to fix. All you have to do is delete the messages
you don't need from your "Inbox", "Sent", "Trash/Deleted" and any other
webmail folder, starting with the oldest ones first.

That way you'll make plenty of room for your new messages and you'll start
to receive them straight away. Please remember that we can't keep any emails
that we can't deliver to you. So it's important to make sure you've always
got space in your mailbox for incoming messages.

Details:
Quota Type: bytes in the message
Quota Available: 10485760
Total Quota: 10485760

The following is the information on the message that was not delivered:

Sender: XXXX@ntlworld.com>
Subject: family history
Size: 11517498
Message ID: XXXX@ntlworld.com>
Date: Thu Jul 16 10:45:15 2009


To fix this problem, delete some messages from your "Inbox", "Sent",
"Trash/Deleted" or any other webmail folder. Remember, if the size of
the message being sent to you is too big, ask the sender to reduce it
if they can and resend"

The source of this email was apparently: admin@email-argos.co.uk <admin@email-argos.co.uk>

The email from my relative was received OK, it was a short text message with a 2.53MB photo attached, and "Properties" shows the message size to be 3.458MB.

I don't currently use Virgin Webmail and as far as I am aware all my mail from Virgin/NTL is downloaded from the POP servers to Windows Mail.

Any suggestions? Legitimate or Scam?

[mentalis]

I don't use Virgin for incoming email at all, so I am not sure about their quotas.

When you download mail from the servers to your computer, do you have the option to keep a copy on the server set to on? If so, if there is a quote all the email could still be on the server.

[Kymmy]

Details:
Quota Type: bytes in the message
Quota Available: 10485760
Total Quota: 10485760

Unless the message was above the Quota available I don't see why that message would have been triggered anyway.

You'll probably find it's either a spam or corrupt message, just ignore and carry on, if you get another probaby best to copy the full mail header to the list (removing your own email addies of course)

[fireman328]

As it has something about argos in the address it may be a disgruntled ex customer trying to get redress from them

[dave6x]

Originally Posted by Kymmy

Unless the message was above the Quota available I don't see why that message would have been triggered anyway.

You'll probably find it's either a spam or corrupt message, just ignore and carry on, if you get another probaby best to copy the full mail header to the list (removing your own email addies of course)

Thanks for that. Seems that it is a legitimate Admin message but may have been an erroneous trigger.

It would appear that a poorly worded catch-all Admin message is being used to cover over-full mail-boxes and over-sized incoming messages that are undeliverable.

To test I've just sent myself 3 messages from another mail account:

The first I sent had minimal text and an attachment of 9.17MB, this triggered a similar message saying that the email was undeliverable and email size was 12856104 Bytes.

The second message I sent had an attachment of 3.66MB, this was received OK.

The third I sent had minimal text and 7 attachments each 1MB, this triggered a similar message saying that the email was undeliverable and email size was 10513666 Bytes.

I have subsequently checked my Webmail and all mailboxes there are empty.

[progers]

Here's a typical Virgin (ex ntl|) e mail header, no mention of Argos!

Return-Path: <ebill@virginmedia.com>
Received: from aamtain14-winn.ispmail.ntl.com ([81.103.221.35])
by mtain04-winn.ispmail.ntl.com
(InterMail vM.7.08.04.00 201-2186-134-20080326) with ESMTP
id <20090629200611.FRIG7057.mtain04-winn...spmail.ntl.com>
for <xxxx@NTLWORLD.COM>; Mon, 29 Jun 2009 21:06:11 +0100
Received: from smtp-out5.blueyonder.co.uk ([195.188.213.8])
by aamtain14-winn.ispmail.ntl.com
(InterMail vG.2.02.00.01 201-2161-120-102-20060912) with ESMTP
id <20090629200611.JXBN25073.aamtain14-w...ueyonder.co.uk>
for <xxxx@NTLWORLD.COM>; Mon, 29 Jun 2009 21:06:11 +0100
Received: from [172.23.133.221] (helo=wbis104p.blueyonder.net)
by smtp-out5.blueyonder.co.uk with esmtp (Exim 4.52)
id 1MLN7B-0007aC-7q
for xxxx@NTLWORLD.COM; Mon, 29 Jun 2009 21:06:09 +0100
Message-ID: <1253657273.1246305969242.JavaMail.bgadmin@wbis104p .blueyonder.net>
From: Virgin Media <ebill@virginmedia.com>
Reply-To: ebill@virginmedia.com
To: xxxx@NTLWORLD.COM
Subject: Your latest Virgin Media bill
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Sender: ebill@virginmedia.com
Organization: Virgin Media
Date: Mon, 29 Jun 2009 21:06:11 +0100
X-Cloudmark-Analysis: v=1.0 c=1 a=xIteB-9UAgYA:10 a=NcN59idvAAAA:8 a=KjKxK1CW637ir3mHgNsA:9 a=GKhJ4dPHQ7AKLe6W2DUA:7 a=hRxiD7tDfn9-_gW26-DXkdrRneUA:4 a=sOm5urgJQCgoPNv6:21 a=BJmCtkd568XwCgmr:21 wl=env:6

[Peter_]

admin@email-argos.co.uk Definately a scam as here is a real Argos email address notice the difference after the ampersand it does not say email-argos.co.uk trading.enquiries@argos.co.uk

[dave6x]

Originally Posted by Moldova

admin@email-argos.co.uk Definately a scam as here is a real Argos email address notice the difference after the ampersand it does not say email-argos.co.uk trading.enquiries@argos.co.uk

If you are suggesting this really is a scam then there is a very serious security issue with the Virginmedia/NTL mail servers as I am receiving a similar message from the same source address for every over-size test message I have sent to my Viginmedia/NTL mail accounts!!!


Maybe somebody else would like to try a similar exercise to the one I tried at Serial #5 above, i.e. send themselves an oversized message from another email account, and then report back the message they receive and the address it was sourced from? I used a googlemail account as the send addy for this.

Thanks

[Peter_]

Originally Posted by dave6x

If you are suggesting this really is a scam then there is a very serious security issue with the Virginmedia/NTL mail servers as I am receiving a similar message from the same source address for every over-size test message I have sent to my Viginmedia/NTL mail accounts!!!


Maybe somebody else would like to try a similar exercise to the one I tried at Serial #5 above, i.e. send themselves an oversized message from another email account, and then report back the message they receive and the address it was sourced from? I used a googlemail account as the send addy for this.

Thanks

You can report the email here http://netreport.virginmedia.com/netreport/index.php

[Toto]

Can you copy the full email header for that quota message you received, as I am having difficulty in trying to understand why Argos would be telling you your Virgin Media (ntlworld) account is full.

$ whois email-argos.co.uk
[Querying whois.nic.uk]
[whois.nic.uk]


Domain name:
email-argos.co.uk

Registrant:
Home Retail Group Plc

Registrant type:
Unknown

Registrant's address:
Avebury
489-499 Avebury Boulevard
Saxon Gate West
Milton Keynes
MK9 2NW
United Kingdom

[Avebury is the Argos Head Office]



The email looks very legitimate if it came from the ntlworld.com email platform system, and is consistent with a primary mailbox being over quota. I say primary because secondary mail boxes contribute to the primary quota,

[Peter_]

Originally Posted by Toto

email-argos.co.uk




The email looks very legitimate if it came from the ntlworld.com email platform system, and is consistent with a primary mailbox being over quota. I say primary because secondary mail boxes contribute to the primary quota,

All emails I have seen from ARGOS do not have anything before the argos.co.uk which makes me think its a phishing email but the only way to check would be to send the email address to ARGOS for verification.

[Kymmy]

Moldova, if it was a scam then why is it being triggered on his test emails??? More likely a corrupt mail database which the warning message was stored on..

Dave, the limit is 10Mb, the 9.7 triggered it as a binary (jpg/exe/zip files) have to be encoded into text to allow them to be abled to send via email which is text based, the encoding adds more data hence a 9.7Mb message goes over the 10Mb limit As asked though can you forward the full header from one of the emails please (taking out your email addies)

[Peter_]

Originally Posted by Kymmy

Moldova, if it was a scam then why is it being triggered on his test emails??? More likely a corrupt mail database which the warning message was stored on..

Thats why I posted the Netreport link so if not sure he can always report it to Virgin or even use the contact us option on the ARGOS site to ask if its legitimate. Contact us

[Toto]

Just to be clear the Whois registration data does point to an official Argos registration.

http://www.homeretailgroup.com/home/tools/contact/

Just because you don't get emails from that domain from Argos,doesn't mean that it isn't from them.

[dave6x]

Originally Posted by Kymmy

Moldova, if it was a scam then why is it being triggered on his test emails??? More likely a corrupt mail database which the warning message was stored on..

Dave, the limit is 10Mb, the 9.7 triggered it as a binary (jpg/exe/zip files) have to be encoded into text to allow them to be abled to send via email which is text based, the encoding adds more data hence a 9.7Mb message goes over the 10Mb limit As asked though can you forward the full header from one of the emails please (taking out your email addies)

I am aware that there is a message overhead due to MIME encoding of attachments, thus I deliberately sized my test emails to attempt to trigger further messages.

The header below is interesting in that the detail appears to be suppressed, I have spent a bit of time checking to make sure that this wasn't a "feature" of the rather nasty VISTA Windows Mail email client I have been using on this particular PC, I really must get this machine onto Thunderbird! All the headers for these messages are similar.

Return-Path: <>
From: admin
Subject: [IMPORTANT] Your mailbox is full
Date: Thu, 16 Jul 2009 10:45:16 +0100
X-Antivirus: avast! (VPS 090716-0, 16/07/2009), Inbound message
X-Antivirus-Status: Clean

A report has been sent to Virginmail security as suggested by Moldova. I'll post any reply I get from them.

Thanks guys