Got bounced from the list because the DNS pointing to my phorce1.net mail servers went "away". When it didn't come back after 18 hours of me raising he** I got the DNS admin at the company I work for to set me up on out name servers so I'd have more control in the future. <sigh>
Got a VERY clever phishing scam message to one of the support addresses where I contract. Using Outlook for that mail so It was a bit difficult to get the "real message back but... Below is what I could figure out how to retrieve from Outlook -- I hate Outlook. I've never figured out how to get a real 'exact' copy of what was delivered back out of it the way you can when using any MUA that stores in mbox or maildir format. Gerald ------ Forwarded message ------ From: Support Date: Sun, 22 Feb 2004 11:30:42 -0600 Subject: phishing scam To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> The message has an obfuscated link that takes you here: 219.117.201.106:2017/f/index.htm The IP in Japan -- good luck making a phone call to get this one taken down. Here are the headers that I could copy/paste and the html text of the message that I managed to get out of outlook using the "File --> Save As..." function (HTML broken intentionally with hash marks -- email addresses on my server munged out of habit). Received: from 200.175.137.22.dialup.gvt.net.br [200.175.137.22] by mymail.server (SMTPD32-8.00) id A32C47A0040; Sun, 22 Feb 2004 07:48:28 -0600 Received: from wwbi.zoyta (yqcqjw.fccihnm.hxgsodq [181.90.102.144]) Date: Sun, 22 Feb 2004 16:44:46 +0300 From: "Fleet Bank" <[EMAIL PROTECTED]> X-Mailer: The Bat! (v2.00.6) Business Reply-To: "Fleet Bank" <[EMAIL PROTECTED]> X-Priority: 3 (Normal) Message-ID: <[EMAIL PROTECTED] ail.com> To: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: To aII Fleet bank users! MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------1624795932930A9" X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-Declude-Sender: [EMAIL PROTECTED] [200.175.137.22] X-Note: (mymail.server) This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, IPNOTINMX, ROUTING [8] X-Note: This E-mail was sent from 200.175.137.22.dialup.gvt.net.br ([200.175.137.22]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 347717810 #<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> #<HTML><HEAD> #<META http-equiv=Content-Type content="text/html; #charset=windows-1252"> #<META content="MSHTML 6.00.2800.1276" name=GENERATOR></HEAD> #<BODY><B>From:</B> Fleet Bank [EMAIL PROTECTED]<BR><B>Sent:</B> Sunday, #February 22, 2004 7:45 AM<BR><B>To:</B> [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]<BR><B>Subject:</B> To aII Fleet bank users!<BR> #<P><FONT color=#fffff2>Las Vegas Celebrity</FONT></P> #<P><A #href="http://[EMAIL PROTECTED] #2%31%39%2E%31%31%37%2E%32%30%31%2E%31%30%36:%32%30%31%37/%66/%69%6E%64%6 #5%78%2E%68%74%6D"><IMG #alt="" src="cid:0382C24A.D3EBA005.B8B55848.8A62B6AC_csseditor"; #border=0></A> #</P> #<P><FONT color=#fffff6>Entertainment in 1869 I'll take this one Which one? It's #just </FONT></P><BR> #<P><FONT size=2>---<BR>Incoming mail is certified Virus #Free.<BR>Checked by AVG #anti-virus system (http://www.grisoft.com).<BR>Version: 6.0.580 / Virus #Database: 367 - Release Date: 2/6/2004<BR></FONT></P> #<P><FONT face=Arial size=2></FONT></P></BODY></HTML> -------- End of message ------- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
