Attached are the headers to an e-mail I am suspecting as a clever phising
that has me worried.
It looks like a legit message sent on behalf of Paypal, however, it is sent
from an IP address not owned by Paypal BUT which has a REVDNS that ends in
paypal.com.
The message is full of links to images.postdirect.com but does have legit
links to paypal.com.
John T
eServices For You
"Seek, and ye shall find!"
Received: from srv5.eservicesforyou.net [67.94.227.40] by
mail.eservicesforyou.net (SMTPD-8.20) id A02A059C;
Tue, 23 May 2006 12:19:06 -0700
Received: from email-83.paypal.com ([206.165.246.83]) by
srv5.eservicesforyou.net with Microsoft SMTPSVC(6.0.3790.1830);
Tue, 23 May 2006 12:19:04 -0700
DomainKey-Signature: a=rsa-sha1;
h=Date:From:Subject:To:X-Header-CompanyDBUserName:Errors-To:List-Unsubscribe:Reply-To:X-Header-MasterId:X-Header-Versions:Message-ID:MIME-Version:Content-Type;
b=WlXEq1pDWhpajVdRtFzPcMshLTMrz08l/ijYdx+vckIXWxVdYeyr5NIpJxQeNPWyUCarrOPq21w4dRyp2X6KbCRrHgHIfPkX2eXvho3C4KwridkCfzshGGflsDPpkiHE;
c=nofws; d=email.paypal.com;
q=dns; s=yesmail1
Date: Tue, 23 May 2006 12:11:03 PDT
From: PayPal <[EMAIL PROTECTED]>
Subject: New: Tips, ID Theft Q&A, and more
To: "Srikanth Gudapati" <[EMAIL PROTECTED]>
X-Header-CompanyDBUserName: paypal
Errors-To: [EMAIL PROTECTED]
List-Unsubscribe: <mailto:[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
X-Header-MasterId: 905605
X-Header-Versions: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/html;
charset=us-ascii
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 23 May 2006 19:19:04.0536 (UTC)
FILETIME=[C157CD80:01C67E9D]
X-RBL-Warning: SPAMCHECK: Message failed SPAMCHECK: 10.
X-RBL-Warning: WHITEFILTER3: Message failed WHITEFILTER3 test (line 28, weight
-25)
X-RBL-Warning: GRAYFILTER1: Message failed GRAYFILTER1 test (line 145, weight 5)
X-RBL-Warning: GRAYFILTER2: Message failed GRAYFILTER2 test (line 5, weight 5)
X-RBL-Warning: SUBJECTSTART_IS: Message failed SUBJECTSTART_IS test (line 52,
weight 15) (weight capped at 15)
X-RBL-Warning: KEYSUBJECT: Message failed KEYSUBJECT test (line 85, weight 15)
X-Note: ###################################################################
X-Note: #### This message scanned by eServices For You for viruses and junkmail.
X-Note: #### Scan time start at 12:20:50 on 23 May 2006.
X-Note: #### Total weight of message as a result of tests: 28
X-Note: #### TESTS FAILED: NOABUSE, IPNOTINMX, NOLEGITCONTENT, SPAMCHECK,
SUBJECTSTART_IS, KEYSUBJECT
X-Note: #### Sender is [EMAIL PROTECTED] and spool file is D602a007c00003bbd.smd
X-Note: #### This E-mail was received from RevDNS: [email-83.paypal.com]
X-Note: #### This e-mail was received from IP: [206.165.246.83]
X-Note: #### To report any issues,
please contact [EMAIL PROTECTED]
X-Note: ################################################################################################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
