Vonage customers - Is this legit?

Discussion in 'Community Discussion' started by jeremy.king, May 8, 2006.

  1. jeremy.king macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
    #1
    All,

    I got an email supposedly from Vonage (I am a customer) claiming to offer IPO pricing on stock when they go public. They have officially filed for public trading, but to my knowledge, haven't gone public nor released a date. The weird part is that the email is very suspicious in that its generic, doesn't mention my name or any information about me then encourages me to a different URL...So my thought is SCAM!

    Your thoughts?!??!?!?

    Edit: update...Just tried to register using bunk information, but its validates and and picked up on that false info...could this be legit?

    Edit #2: Looking back at other emails - anything account related always had my acct# and billing name included in the contents. The newsletters do not have any specific information...


     
  2. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #2
    What is the source IP/DNS entry of the email?

    Beyond that.. the IP for the website isn't owned by Vonage, it's owned by "Savvis" from Cary, NC. It's just a webhosting place..

    I'd say it wasn't legit. No.

    Code:
    Search results for: 216.74.162.26
    
    
    OrgName:    Savvis 
    OrgID:      SAVVI-2
    Address:    3300 Regency Parkway
    City:       Cary
    StateProv:  NC
    PostalCode: 27511
    Country:    US
    
    ReferralServer: rwhois://rwhois.savvis.net:4321/
    
    NetRange:   216.74.128.0 - 216.74.191.255 
    CIDR:       216.74.128.0/18 
    NetName:    SAVVIS
    NetHandle:  NET-216-74-128-0-1
    Parent:     NET-216-0-0-0-0
    NetType:    Direct Allocation
    NameServer: DNS01.SAVVIS.NET
    NameServer: DNS02.SAVVIS.NET
    NameServer: DNS03.SAVVIS.NET
    NameServer: DNS04.SAVVIS.NET
    Comment:    
    RegDate:    
    Updated:    2004-10-07
    
    OrgAbuseHandle: ABUSE11-ARIN
    OrgAbuseName:   Abuse 
    OrgAbusePhone:  +1-877-393-7878
    OrgAbuseEmail:  abuse@savvis.net
    
    OrgNOCHandle: NOC99-ARIN
    OrgNOCName:   Network Operations Center 
    OrgNOCPhone:  +1-800-213-5127
    OrgNOCEmail:  ipnoc@savvis.net
    
    OrgTechHandle: UIAA-ARIN
    OrgTechName:   US IP Address Administration 
    OrgTechPhone:  +1-800-213-5127
    OrgTechEmail:  ipadmin@savvis.net
    
    # ARIN WHOIS database, last updated 2006-05-07 19:10
    # Enter ? for additional hints on searching ARIN's WHOIS database.
     
  3. jeremy.king thread starter macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
    #3
    Full email headers - doesn't look legit...I also notified Vonage to see if it is a real offer.

    From Vonage IPO Information Mon May 8 05:53:22 2006
    X-Apparently-To: XXXXX@yahoo.com via 66.163.179.153; Mon, 08 May 2006 07:13:11 -0700
    X-Originating-IP: [129.41.78.149]
    Return-Path: <v-hobja_lbbgollj_oijjjh_oijjjh_a@vonage.bounce.abacus-email.com>
    Authentication-Results: mta309.mail.re4.yahoo.com from=vonageipo.com; domainkeys=neutral (no sig)
    Received: from 129.41.78.149 (EHLO mail1145.abacus-email.com) (129.41.78.149) by mta309.mail.re4.yahoo.com with SMTP; Mon, 08 May 2006 07:13:11 -0700
    Received: by mail1145.abacus-email.com id hbt8ve064rkj for <xxx@yahoo.com>; Mon, 8 May 2006 08:53:22 -0400 (envelope-from <v-hobja_lbbgollj_oijjjh_oijjjh_a@vonage.bounce.abacus-email.com>)
    Message-ID: <31581688.1147092802435.JavaMail.root@mailgen04.atlp1>
    Date: Mon, 8 May 2006 08:53:22 -0400 (EDT)
    From: "Vonage IPO Information" <donotreply@vonageipo.com> Add to Address BookAdd to Address Book Add Mobile Alert
    Reply-to: donotreply@vonageipo.com
    To: xxx@yahoo.com
    Subject: Important Customer Information Regarding Vonage's Proposed IPO
    Mime-Version: 1.0
    Content-Type: multipart/alternative; boundary="----=_Part_53544_33408798.1147092789479"
    x-mid: 516496
    Content-Length: 930
     
  4. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #4
  5. jeremy.king thread starter macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
    #5
    DONE.

    This is probably one of the most sophisticated spam/phishing attempts I have seen...That is, if it is illegitimate...
     
  6. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #6
    I concur.. the site is pretty over the top with FAQs and info and legitimacy.. but I (like you) suspect it's a scam. After all.. isn't this insider trading?
     
  7. eva01 macrumors 601

    eva01

    Joined:
    Feb 22, 2005
    Location:
    Gah! Plymouth
    #7
    or one of the most iffy legitimate emails i have seen
     
  8. jeremy.king thread starter macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
    #8
    True...

    So did any other vonage (or non-vonage) customers get this email?
     
  9. CanadaRAM macrumors G5

    CanadaRAM

    Joined:
    Oct 11, 2004
    Location:
    On the Left Coast - Victoria BC Canada
    #9
    Things to look for

    1) Lookalike domain names and subdomain extensions
    "macrumorsverify.com" has nothing to do with macrumors.com
    macrumors.moderator.com is also unrelated to Macrumors, it would be a subdomain on the moderator.com server

    2) Corporate mail that originates from a webmail address or a residential dialup address

    Look in the headers for where the email originated. If you see AOL, hotmail, yahoo, gmail or any of the other free email services, or if you see a long string with ppp in it somewhere, you can be sure that the mail did not originate within the company in question. -- not on your receive address, but the origin. Sometimes you;ll also see a DSL address in the header -- that may be a residential address or it may be a smaller company that uses a cable or dsl service for their hookup.

    3) look for tracking IDs in the headers

    The more sophisticated bulk email sending programs embed bounce back and reply tracking codes

    v-hobja_lbbgollj_oijjjh_oijjjh_a@vonage.bounce.abacus-email.com

    The long string of nonsense could be an identifier of your address, so they can tell if it bounced. If it didn't then your address is valid.
    abacus-email.com would appear to be the destination -- again the vonage there is just window dressing, it could be anything they want.

    Now, following these guides, you'll get a few false positives, because some legit companies do use outside service providers to send mass mailings to customers, so occasionally a legit email will come from "emailblast.com" and have tracking IDs. I believe this is poor practice, and any company with any smarts will handle their communications in house from their own servers.

    Next: does the address it was sent to make sense?
    Does Vonage have your Yahoo address as a contact email?
    A company should only ever communicate with you through the email address you provided them.
    For example, only PayPal has the specific address I use for PayPal emails, which is not public, so any incoming emails 'from' Paypal that are not to that address, are automatically scams.

    Does the content make sense?
    I highly doubt that Vonage is going to sell shares at a discount to millions of people just because they had a phone. An expert in this area could also verify whether it would even be legal to make such an offer.

    First step in any offer is to go to the real company site like vonage.com -- typing it in manually, NOT choosing the link -- and searching for corroborating information. Look in their News Releases and in their Support or customer service or Company information areas. If it is a legit program, it will be announced somewhere there. If it involves stocks on the stock market, it legally HAS to be released through the newswire services before any other announcements are made.
     
  10. jeremy.king thread starter macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
    #10
    Good info CanadaRAM..All things I usually consider...Now for a wrench in the mix - the headers from a legit Vonage newsletter are strangely familar to the message in question...

    X-Apparently-To: XXXXX@yahoo.com via 66.163.179.141; Wed, 22 Feb 2006 10:21:37 -0800
    X-Originating-IP: [129.41.78.149]
    Return-Path: <v-hcomb_ijndfpbk_kenigg_kenigg_a@vonage.bounce.abacus-email.com>
    Authentication-Results: mta328.mail.scd.yahoo.com from=vonage.messages1.com; domainkeys=neutral (no sig)
    Received: from 129.41.78.149 (EHLO mail1145.abacus-email.com) (129.41.78.149) by mta328.mail.scd.yahoo.com with SMTP; Wed, 22 Feb 2006 10:21:37 -0800
    Received: by mail1145.abacus-email.com id hvilr2064lcb for <XXX@yahoo.com>; Wed, 22 Feb 2006 13:15:47 -0500 (envelope-from <v-hcomb_ijndfpbk_kenigg_kenigg_a@vonage.bounce.abacus-email.com>)
    Message-ID: <28683487.1140632147017.JavaMail.root@mailgen01.atlp1>
    Date: Wed, 22 Feb 2006 13:15:47 -0500 (EST)
    From: "Vonage Customer Care" <vonage@vonage.messages1.com> Add to Address BookAdd to Address Book Add Mobile Alert
    Reply-to: vonage@vonage.messages1.com
    To: XXX@yahoo.com
    Subject: News from Vonage
    Mime-Version: 1.0
    Content-Type: multipart/alternative; boundary="----=_Part_5796_2181074.1140632026150"
    x-mid: 470721
    Content-Length: 8441
     
  11. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
  12. CanadaRAM macrumors G5

    CanadaRAM

    Joined:
    Oct 11, 2004
    Location:
    On the Left Coast - Victoria BC Canada
    #12
    It could be legit, it could be a sophisticated fake, or as has happened recently to me, it could be an email service provider who is working both sides of the fence. I had a third party service provider mailing arrive for a legit supplier of ours, and within 10 minutes, 10 more pieces of outright spam addressed with all the same IDs addresses and codes. The service provider charged the company for mailing out to their customer list, then promptly (and illegally) resold the list 10 times to scammers.

    The supplier's legal team is on it (after my detailed and persistent complaints, pointing out that they had violated both their own terms and conditions and the Canadian privacy legislation...) and I am hoping they will bring a world of hurt down on that email provider.
     
  13. Zeke macrumors 6502

    Joined:
    Oct 5, 2002
    Location:
    Greenville, SC
    #13
    I think it's legit. I went through and no where did it ask for any personal info (social security, etc...) and they have company balance sheets.

    http://reviews.infoworld.com/article/06/04/28/77886_HPvonageipo_1.html?MEDIA NETWORKING

    The numbers were all correct so basically it just looks like if you sign up you're reserving the opportunity to buy shares. I would've worried if there was something asking for my bank account info. All it asked for was your Vonage account #.

    Here's a phone number for questions
    Technical Customer Care
    Phone: (866) 431- 9801
    Hours: Open 7 days a week from 8:00 am EST to 8:00 pm EST
     
  14. evoluzione macrumors 68020

    evoluzione

    Joined:
    Jul 19, 2002
    Location:
    down the road, that's where i'll always be
    #14
    i got that email this morning, haven't had time to read it yet. and yes, i'm a vonage customer...
     
  15. jeremy.king thread starter macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
    #16
    I don't like having to enter my acct #...Still no response from Vonage - I'll try calling, but usually end up with a dude who can't speak english. You should have seen me trying to request a wireless router/vonage bridge - I ended up giving up...
     

    Attached Files:

  16. CanadaRAM macrumors G5

    CanadaRAM

    Joined:
    Oct 11, 2004
    Location:
    On the Left Coast - Victoria BC Canada
    #17
    Well, it's a b*tt-stupid move on Vonage's part, setting up a different domain and soliciting by email using an outside provider.

    There's nothing on their Vonage.com site, nothing under Corporate, or FAQs, nothing relating when you search for IPO.
     
  17. jeremy.king thread starter macrumors 603

    jeremy.king

    Joined:
    Jul 23, 2002
    Location:
    Fuquay Varina, NC
  18. Abulia macrumors 68000

    Abulia

    Joined:
    Jun 22, 2004
    Location:
    Kushiel's Scion
    #19
    Based what's been posted in this thread and reviewing the website, I'd say it's legtimate. The FAQ alone sells me on the legitmacy of the site.
     
  19. plinden macrumors 68040

    plinden

    Joined:
    Apr 8, 2004
  20. Transeau macrumors 6502a

    Transeau

    Joined:
    Jan 18, 2005
    Location:
    Alta Loma, CA
    #21
    I got this email too this morning.

    The first problem that I see is that the Vonage Logo is different than the one on the Vonage.com site.

    However, the WHOIS information is identical to Vonage's website.
     
  21. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #22
    It is?? Doesn't look the same to me..

    www.vonageipo.com

    Code:
    OrgName:    Savvis 
    OrgID:      SAVVI-2
    Address:    3300 Regency Parkway
    City:       Cary
    StateProv:  NC
    PostalCode: 27511
    Country:    US
    
    ReferralServer: rwhois://rwhois.savvis.net:4321/
    
    NetRange:   216.74.128.0 - 216.74.191.255 
    CIDR:       216.74.128.0/18 
    NetName:    SAVVIS
    NetHandle:  NET-216-74-128-0-1
    Parent:     NET-216-0-0-0-0
    NetType:    Direct Allocation
    NameServer: DNS01.SAVVIS.NET
    NameServer: DNS02.SAVVIS.NET
    NameServer: DNS03.SAVVIS.NET
    NameServer: DNS04.SAVVIS.NET
    Comment:    
    RegDate:    
    Updated:    2004-10-07
    
    OrgAbuseHandle: ABUSE11-ARIN
    OrgAbuseName:   Abuse 
    OrgAbusePhone:  +1-877-393-7878
    OrgAbuseEmail:  abuse@savvis.net
    
    OrgNOCHandle: NOC99-ARIN
    OrgNOCName:   Network Operations Center 
    OrgNOCPhone:  +1-800-213-5127
    OrgNOCEmail:  ipnoc@savvis.net
    
    OrgTechHandle: UIAA-ARIN
    OrgTechName:   US IP Address Administration 
    OrgTechPhone:  +1-800-213-5127
    OrgTechEmail:  ipadmin@savvis.net
    
    # ARIN WHOIS database, last updated 2006-05-07 19:10
    # Enter ? for additional hints on searching ARIN's WHOIS database.
    www.vonage.com

    Code:
    OrgName:    Vonage Holdings, Inc. 
    OrgID:      VONAG
    Address:    23 Main St
    City:       Holmdel
    StateProv:  NJ
    PostalCode: 07733
    Country:    US
    
    NetRange:   216.115.16.0 - 216.115.31.255 
    CIDR:       216.115.16.0/20 
    NetName:    DATACENTER
    NetHandle:  NET-216-115-16-0-1
    Parent:     NET-216-0-0-0-0
    NetType:    Direct Assignment
    NameServer: AUTH00.KEWR0.S.VONAGENETWORKS.NET
    NameServer: AUTH01.KEWR0.S.VONAGENETWORKS.NET
    Comment:    
    RegDate:    2003-07-18
    Updated:    2006-04-19
    
    RTechHandle: ARINC18-ARIN
    RTechName:   ARIN Contact 
    RTechPhone:  +1-732-365-2698
    RTechEmail:  arin-contact@vonage.com 
    
    OrgTechHandle: ARINC18-ARIN
    OrgTechName:   ARIN Contact 
    OrgTechPhone:  +1-732-365-2698
    OrgTechEmail:  arin-contact@vonage.com
    
    # ARIN WHOIS database, last updated 2006-05-07 19:10
    # Enter ? for additional hints on searching ARIN's WHOIS database.
     
  22. Transeau macrumors 6502a

    Transeau

    Joined:
    Jan 18, 2005
    Location:
    Alta Loma, CA
    #23
  23. plinden macrumors 68040

    plinden

    Joined:
    Apr 8, 2004
    #24
    Ok, just to maintain the paranoia of you Vonage customers ... so it does appear that Vonage are offering IPO shares, but considering how difficult it is to determine from this email if it's legitimate, how do you know that a phisher hasn't been quick off the mark and crafted his/her own version?
     
  24. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR

Share This Page