Also the Apple iTunes Store Receipt Scam that went around Oct. 2010 is doing
the rounds again, I received one the other day.
This one is much easier to pick up as ‘Fake’ as it contains an attachment, the
true Apple iTunes Store receipt is in the body of the email (No Attachment).
Also the Long Headers are a quick give-away also.
The Incorrect iTunes Store Receipt email:
From: iTunes Store <do_not_re...@itunes.com>
Subject: Your receipt #137740190070
Date: 17 September 2011 11:02:20 PM AWST
To: Your Name <y...@email.address.com>
Reply-To: > <do_not_re...@itunes.com>
This has an attachment titled - iTunesStore_Receipt.zip which contains a
.exe file 50.5 KB
Part of the ‘Long Header’ of the Incorrect SCAM email looks like this:
X-Ironport-Incoming: 1
X-Ironport-Av: E=Sophos;i="4.68,398,1312128000";
d="exe'96,83?zip'96,83,48?scan'96,83,48,208,217,83,96,48";a="428087874"
Message-Id: <000601cc754a$cc8019de$8301a8c0@DD4P7961>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_01CC7520.E3A7A5C0"
X-Priority: 3
X-Msmail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2180
Delete this email immediately … DON’T click on the attachment.
================
The Correct iTunes Store Receipt email:
From: iTunes Store <do_not_re...@itunes.com>
Subject: Your receipt #113008164872
Date: 7 May 2010 7:08:09 PM AWST
To: Your Name <y...@email.address.com>
There is NO Attachment, the Receipt is in the body of the email
Part of the ‘Long Header’ of the Correct email from iTunes Store looks like
this:
Received: from a17-34-144-116.apple.com (HELO partners.apple.com)
([17.34.144.116]) by badger-txnvip.apple.com with SMTP; Fri, 07 May 2010
04:08:09 -0700
X-Ironport-Incoming: 1
X-Ironport-Av: E=Sophos;i="4.52,347,1270396800";
d="scan'208,217";a="160197429"
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="Boundary_(ID_6GDS9JQhrePewXZ4/y2zQw)"
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0
spamscore=0 ipscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam
adjust=0 reason=mlx engine=5.0.0-0908210000 definitions=main-1005070039
Message-Id: <8nu4m1$h...@badger-txnvip.apple.com>
X-Broadcast-Id: 77677
X-Dkim_Sign_Required: YES
X-Btph: CM
Cheers,
Ronni
On 18/09/2011, at 11:59 PM, Peter Hinchliffe wrote:
>
> On 17/09/2011, at 8:06 AM, Adrian Skehan wrote:
>
>> Good morning all,
>>
>> I didn't have to think about this much as I haven't made any such
>> transactions in a very long time.
>>
>>
>> Regards,
>>
>>
>> Adrian
>>
>> adrianske...@me.com
>>
>
>
> This one has been doing the rounds for weeks. To be treated with the disdain
> it deserves.
>
> Peter Hinchliffe Apwin Computer Services
> FileMaker Pro Solutions Developer
> Perth, Western Australia
> Phone (618) 9332 6482 Mob 0403 046 948
> --------------------------------------------------------------------
> Mac because I prefer it -- Windows because I have to.
-- The WA Macintosh User Group Mailing List --
Archives - <http://www.wamug.org.au/mailinglist/archives.shtml>
Guidelines - <http://www.wamug.org.au/mailinglist/guidelines.shtml>
Settings & Unsubscribe - <http://lists.wamug.org.au/listinfo/wamug.org.au-wamug>
