Credit Card Phish
Posted by Dave Yadallee on
From - Mon Sep 08 13:52:44 2008
X-Account-Key: account2
X-UIDL: >~/"!:p@"!ohn!!`;m"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Mozilla-Keys:
Return-Path:
Received: from adke172.neoplus.adsl.tpnet.pl
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m886SRDc017063
for; Mon, 8 Sep 2008 00:28:37 -0600 (MDT)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from [79.184.238.172] by mail.eqm.com; Mon, 8 Sep 2008 07:28:38 +0100
From: "Darrell Acosta"
To:
Subject: {?} {Filename?} Credit card transaction report
Date: Mon, 8 Sep 2008 07:28:38 +0100
Message-ID: <01c91184$8286d700$aceeb84f@tengel>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_000E_01C91184.8286D700"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2741.2600
Importance: Normal
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m886SRDc017063
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be infected
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, spamhaus-ZEN,
spamhaus-PBL, SpamAssassin (not cached, score=11.81, required 5,
BAYES_99 3.50, BOTNET 5.00, RCVD_IN_PBL 3.20, RDNS_NONE 0.10,
RELAY_CHECKER 0.00, RELAY_CHECKER_KEYWORDS 0.01)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: tengel@eqm.com
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark: 1221287338.51498@KCinV+xji7IY9jgFVcYlQQ
X-Spam-Status: Yes
X-UIDL: >~/"!:p@"!ohn!!`;m"!
This is a multi-part message in MIME format.
------=_NextPart_000_000E_01C91184.8286D700
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Warning: This message has had one or more attachments removed
Warning: (report.doc.exe, Report.zip).
Warning: Please read the "NetKnow-InComing-4-71-10-1-Attachment-Warning.txt" attachment(s) for more information.
Credit card transaction report (Visa, MC)
Dear Valued Customer:
As requested, we are sending you this report on transactions with your credit card completed between 1/1/2008 and 9/1/2008.
The report containing your account details is attached to this message. Please download the attached document to view or print it.
Respectfully,
Darrell Acosta
Manager of Visa / MasterCard
Credit Card Services
________________________________
If you believe this message has reached you by mistake, please forward the document identification number provided on the enclosed report to our customer service department.
------=_NextPart_000_000E_01C91184.8286D700
Content-Type: text/plain;
charset="ISO-8859-1";
name="NetKnow-InComing-4-71-10-1-Attachment-Warning.txt"
Content-Disposition: attachment;
filename="NetKnow-InComing-4-71-10-1-Attachment-Warning.txt"
Content-Transfer-Encoding: quoted-printable
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "Report.zip"
is on the list of unacceptable attachments for this site and has been
replaced by this warning message.
If you wish to receive a copy of the original attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.
At Mon Sep 8 00:28:58 2008 the virus scanner said:
MailScanner: Windows/DOS Executable (report.doc.exe)
No programs allowed (report.doc.exe)
Note to Help Desk: Look on the NetKnow-InComing-4-71-10-1 (doctor.nl2k.ab.c=
a) MailScanner in /var/spool/MailScanner/quarantine/20080908 (message m886S=
RDc017063).
--=20
Postmaster
NetKnow
www.nk.ca
For all your IT requirements visit: http://www.transtec.co.uk
------=_NextPart_000_000E_01C91184.8286D700--
X-Account-Key: account2
X-UIDL: >~/"!:p@"!ohn!!`;m"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Mozilla-Keys:
Return-Path:
Received: from adke172.neoplus.adsl.tpnet.pl
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m886SRDc017063
for
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from [79.184.238.172] by mail.eqm.com; Mon, 8 Sep 2008 07:28:38 +0100
From: "Darrell Acosta"
To:
Subject: {?} {Filename?} Credit card transaction report
Date: Mon, 8 Sep 2008 07:28:38 +0100
Message-ID: <01c91184$8286d700$aceeb84f@tengel>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_000E_01C91184.8286D700"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2741.2600
Importance: Normal
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m886SRDc017063
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be infected
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, spamhaus-ZEN,
spamhaus-PBL, SpamAssassin (not cached, score=11.81, required 5,
BAYES_99 3.50, BOTNET 5.00, RCVD_IN_PBL 3.20, RDNS_NONE 0.10,
RELAY_CHECKER 0.00, RELAY_CHECKER_KEYWORDS 0.01)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: tengel@eqm.com
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark: 1221287338.51498@KCinV+xji7IY9jgFVcYlQQ
X-Spam-Status: Yes
X-UIDL: >~/"!:p@"!ohn!!`;m"!
This is a multi-part message in MIME format.
------=_NextPart_000_000E_01C91184.8286D700
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Warning: This message has had one or more attachments removed
Warning: (report.doc.exe, Report.zip).
Warning: Please read the "NetKnow-InComing-4-71-10-1-Attachment-Warning.txt" attachment(s) for more information.
Credit card transaction report (Visa, MC)
Dear Valued Customer:
As requested, we are sending you this report on transactions with your credit card completed between 1/1/2008 and 9/1/2008.
The report containing your account details is attached to this message. Please download the attached document to view or print it.
Respectfully,
Darrell Acosta
Manager of Visa / MasterCard
Credit Card Services
________________________________
If you believe this message has reached you by mistake, please forward the document identification number provided on the enclosed report to our customer service department.
------=_NextPart_000_000E_01C91184.8286D700
Content-Type: text/plain;
charset="ISO-8859-1";
name="NetKnow-InComing-4-71-10-1-Attachment-Warning.txt"
Content-Disposition: attachment;
filename="NetKnow-InComing-4-71-10-1-Attachment-Warning.txt"
Content-Transfer-Encoding: quoted-printable
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "Report.zip"
is on the list of unacceptable attachments for this site and has been
replaced by this warning message.
If you wish to receive a copy of the original attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.
At Mon Sep 8 00:28:58 2008 the virus scanner said:
MailScanner: Windows/DOS Executable (report.doc.exe)
No programs allowed (report.doc.exe)
Note to Help Desk: Look on the NetKnow-InComing-4-71-10-1 (doctor.nl2k.ab.c=
a) MailScanner in /var/spool/MailScanner/quarantine/20080908 (message m886S=
RDc017063).
--=20
Postmaster
NetKnow
www.nk.ca
For all your IT requirements visit: http://www.transtec.co.uk
------=_NextPart_000_000E_01C91184.8286D700--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments