[nsp-sec] attn Google, gmail drop box in .edu phish

[RuthAnne Bevier]

Unfortunately I don't have full headers for this one yet, but the
reply-to may be the same as the sender address:

> From: systeman agentemails <systemanagentemails01 at googlemail.com>
> Date: June 16, 2009 4:10:59 AM PDT
> To: undisclosed-recipients:;
> Subject: E-Mail Account Maintenance
>
> Dear webmail.User,
>
> We would like to inform you that we are currently carrying out =20
> schwebmailled
> maintenance and upgrade of our webmail service and as a result of
> this; our.webmail client has been changed and your original
password =20=

> will
> reset. We are sorry for any inconvenience caused.
>
> To maintain your webmail account, you must reply to this email =20
> immediately
> and enter your current password here (********)Failure to do this
=20
> within 48
> hours will immediately render your webmail account deactivated
from =20=

> our
> database.
>
> Thank you for using the webmail account!
>
> "webmail ACCOUNT SUPPORT TEAM".
> =A9webmail ACCOUNT ABN 31 088 377 860 All Rights Reserved.


-- 
RuthAnne Bevier
Information Security
California Institute of Technology   
626-395-2671
ruthanne at caltech.edu
www.imss.caltech.edu