RE: [Declude.JunkMail] New Phishing Scam

Kevin Bilbee Fri, 13 Feb 2004 15:30:52 -0800

Ok so I have no brain today. Here are the real headers.



To: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
Subject: [ SPAM 9 ]Account verification.
Content-Type: text/html; charset=ISO-8859-1
Message-Id: <[EMAIL PROTECTED]>
Date: Fri, 13 Feb 2004 14:38:25 -0800
with no reverse DNS entry.
X-Declude-Sender: [EMAIL PROTECTED] [209.189.127.231]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: NOABUSE, IPNOTINMX, REVDNS, SPAM-LOW [9]
X-Note: This E-mail was sent from [No Reverse DNS] ([209.189.127.231]).
X-RemoteIp: [209.189.127.231]
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 373607791


> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan
> Sent: Friday, February 13, 2004 3:12 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] New Phishing Scam
>
>
> This is strange Kevin...
>
> http://www.senderbase.org/search?searchString=64.4.240.74
>
> That is a PayPal IP address.. It is also coming from a PayPal
> reverse dns..
>
> Am I not seeing this right?
>
> Regards,
> Kami
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
> Sent: Friday, February 13, 2004 6:06 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] New Phishing Scam
>
> Here is the header and source information.
>
> Kevin
>
> Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
>   (SMTPD32-8.05) id A6F11B600C2; Fri, 13 Feb 2004 15:00:01 -0800
> Received: from smtp1.nix.paypal.com ([64.4.240.74])  by ns1.ssc-isp.net
> (SAVSMTP 3.1.3.37) with SMTP id M2004021314523504871  for
> <[EMAIL PROTECTED]>; Fri, 13 Feb 2004 14:52:35 -0800
> Received: from oma-krapp02.corp.ebay.com (oma-krapp02.corp.ebay.com
> [10.248.50.2])
>  by smtp1.nix.paypal.com (Postfix) with SMTP id 9672D3F7D2  for
> <[EMAIL PROTECTED]>; Fri, 13 Feb 2004 14:48:17 -0800 (PST)
> Precedence: bulk
> Auto-Submitted: auto-replied
> Date: Fri, 13 Feb 2004 16:55:20 -0600
> To: Kevin Bilbee <[EMAIL PROTECTED]>
> Subject: AutoResponse - Email Returned SAXK  (KMM42611038V12917L0KM)
> From: PayPal Customer Service 2 <[EMAIL PROTECTED]>
> Reply-To: PayPal Customer Service 2 <[EMAIL PROTECTED]>
> MIME-Version: 1.0
> Content-Type: text/plain; charset = "us-ascii"
> Content-Transfer-Encoding: quoted-printable
> X-Mailer: KANA Response 7.01.102
> Message-Id: <[EMAIL PROTECTED]>
> X-RBL-Warning: AHBLEXEMPT: Paypal
> X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
> X-Declude-Sender: [EMAIL PROTECTED] [64.4.240.74]
> X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
> spam.
> X-Spam-Tests-Failed: AHBLEXEMPT, BONDEDSENDER, NOABUSE [-18]
> X-Note: This E-mail was sent from smtp1.nix.paypal.com ([64.4.240.74]).
> X-RemoteIp: [64.4.240.74]
> X-RCPT-TO: <[EMAIL PROTECTED]>
> Status: U
> X-UIDL: 373607793
>
> Dear PayPal user,<br>
> As part of our continuing commitment to protect your account <br>and to
> reduce the instance of fraud on our website, we are undertaking a
> <br>period
> review of our member accounts.<p> You are requested to visit our site by
> following the link given below.<br> <a href="http://216.55.162.5/";>
> http://www.paypal.com/verification/%?6488820019=20</a><p>
> Please fill in the required information.
> This is required for us to continue to offer <br>you a safe and risk free
> environment to send and receive money online, <br>and maintain the PayPal
> Experience.<br> Thank you.<p> Accounts Management As outlined in our User
> Agreement, PayPal will periodically <br>send you information about site
> changes and enhancements. <br>Visit our Privacy Policy and User
> Agreement if
> you have any questions.
> <p>Copyright 2003 PayPal.<br> All Rights Reserved.
> Designated trademarks and brands are the property of their respective
> owners.</html>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] New Phishing Scam

Reply via email to