[nsp-sec] yahoo (ymail) phishing dropbox

[Marius Urkis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

One more dropbox on ymail.com:
accountsupdaters at ymail.com


- --
Marius

=============================
 Marius Urkis
 LITNET CERT
 http://cert.litnet.lt
 Tel: +370 37 300645
 GSM: +370 687 79059


Message-ID: <1866.62.56.132.25.1257538281.squirrel at mail.lp.upb.edu>
Reply-To: accountsupdaters at ymail.com
Content-Type: text/plain; charset="utf-8"
X-Virus-Scanned: Debian amavisd-new at mx-1.ktu.lt
X-Antivirus-Lp.upb.edu-Mail-From: accountsu at ymail.com via mail.lp.upb.edu
X-RT-Original-Encoding: utf-8
X-Spam-Score: 1.806
Received: from mx-1.ktu.lt (mx-1.ktu.lt [IPv6:2001:778::100])
	by luodis.sc-uni.ktu.lt (Postfix) with ESMTP id 7EDAF4A879	for
<XXXXXXX at ktu.lt>; Sat, 07 Nov 2009 06:02:10 +0200 (EET)
Received: from localhost (localhost [127.0.0.1])	by mx-1.ktu.lt
(Postfix) with ESMTP id 6C20037AC8	for <XXXXXXX at ktu.lt>; Sat,
 07 Nov 2009 06:02:10 +0200 (EET)
Received: from mx-1.ktu.lt ([127.0.0.1])	by localhost (mx-1.ktu.lt
[127.0.0.1]) (amavisd-new, port 10024)	with ESMTP id Fhg0X2AkfXOg for
<XXXXXXX at ktu.lt>; Sat, 07 Nov 2009 06:02:06 +0200 (EET)
Received: from mail.lp.upb.edu (mail.lp.upb.edu [200.87.132.5])
	by mx-1.ktu.lt (Postfix) with ESMTP id 8BF2437AC9	for
 <XXXXXXX at ktu.lt>; Sat, 07 Nov 2009 06:02:05 +0200 (EET)
Received: (qmail 8424 invoked by uid 509); Fri, 06 Nov 2009 16:11:21 -0400
Received: from 127.0.0.1 by mail.lp.upb.edu
 (envelope-from <accountsu at ymail.com>, uid 507) with
mail-scanner-1.25-st-qms (clamdscan: 0.83/705. spamassassin: 3.0.2.
perlscan: 1.25-st-qms. Clear:RC:1 (127.0.0.1):. Processed in 0.12613
secs); Fri, 06 Nov 2009 20:11:21 +0000
Received: from unknown (HELO mail.lp.upb.edu) (josevega at 127.0.0.1)
 by mail.lp.upb.edu with SMTP; Fri, 06 Nov 2009 16:11:21 -0400
Received: from 62.56.132.25 (SquirrelMail authenticated user josevega)
 ; by mail.lp.upb.edu with HTTP; Fri, 06 Nov 2009 16:11:21 -0400 (BOT)
Delivered-To: xxxxxxx at ktu.lt
Old-X-Esetid: CBBEC525038D833A91FE
Old-X-Esetid: CBBEC525038D833A91FE
Subject: LAST WARNING UPDATE YOUR ACCOUNT
User-Agent: SquirrelMail/1.4.3a-9.EL4
Return-Path: <accountsu at ymail.com>
X-Antivirus-Lp.upb.edu: 1.25-st-qms (Clear:RC:1(127.0.0.1):. Processed
in 0.12613 secs Process 8415)
X-Priority: 3 (Normal)
X-Original-To: XXXXXXX at ktu.lt
Date: Fri, 06 Nov 2009 16:11:21 -0400 (BOT)
X-Spam-Level: *
X-Greylist: delayed 11649 seconds by postgrey-1.31 at margis; Sat,
 07 Nov 2009 06:02:05 EET
To: undisclosed-recipients: ;
Content-Transfer-Encoding: 7BIT
From: Site Maintains <accountsu at ymail.com>
Content-Length: 1494

Dear Ktuwebpost Customer...

This Email is from Ktuwebpost Customer Care and we are sending it to every
Ktuwebpost Email User Accounts Owner for safety. we are having
congestion's due to the anonymous registration of web mail accounts so we
are shutting down some Ktuwebpost accounts and your account was among
those to be deleted. We are sending you this email so that you can verify
and let us know if you still want to use this account.

If you are still interested please confirm your account by filling the space
below. Your User name,password,date of birth and your country information
would be needed to verify your account. Due to the congestion in all mail
users and removal of all unused Ktuwebpost Accounts, Ktuwebpost would be
shutting down all unused Accounts, You will have to confirm your E-mail by
filling out your Log in Information below after clicking the reply button,
or your account will be suspended within 24 hours for security reasons.

*Email Username :..............
*Email Password :..............
*Date of Birth :..................
*Country or Territory: ........
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkr34c4ACgkQHS98nbdNAJyoVgCeJp8Q3ChdfHcER1KZWi70S/DK
b9kAn2B4paBux+0IpRRrJSaRfS0BUUee
=94bQ
-----END PGP SIGNATURE-----