[nsp-sec] Yahoo! mail to the WCP

[Daniel Robert Adinolfi]

Yahoofolk,

This wasn't directed at my dear institution of higher learning, but it is, nonetheless, a phishing attempt.  It appears that <stiematain at ymail.com> is being used as a phishing dropbox.  Please destroy.

Also, suggest they use a different template.  This one has gotten boring to receive.

Thanks.

-Dan


Received: from soapstone1.mail.cornell.edu (128.253.83.143) by
CASHUB04.exchange.cornell.edu (10.16.197.23) with Microsoft SMTP Server id
8.1.393.1; Mon, 31 May 2010 05:30:01 -0400
Received: from adminapp.mail.cornell.edu (adminapp.mail.cornell.edu
[132.236.56.29])	by soapstone1.mail.cornell.edu (8.13.6/8.13.6) with ESMTP id
o4V9U99U024314	for <dra1 at exchange.mail.cornell.edu>; Mon, 31 May 2010
05:30:09 -0400 (EDT)
Received: (from daemon at localhost)	by adminapp.mail.cornell.edu (8.13.6/8.12.6)
id o4V9U1a2017787	for dra1 at exchange.mail.cornell.edu; Mon, 31 May 2010
05:30:01 -0400 (EDT)
Received: from localhost.localdomain (thornapple.mail.cornell.edu
[128.253.83.169])	by adminapp.mail.cornell.edu (8.13.6/8.12.6) with ESMTP id
o4V9U0pk017783	for <dra1 at cornell.edu>; Mon, 31 May 2010 05:30:00 -0400 (EDT)
Received: from thornapple.mail.cornell.edu	by thornapple.mail.cornell.edu with
queue id 65506257-7	for dra1 at cornell.edu; Mon, 31 May 2010 09:29:44 GMT
Received: from umail.ru (cgp-fe01.mtu.ru [62.5.255.15])	by
thornapple.mail.cornell.edu with SMTP id o4V9TUfV013668;	Mon, 31 May 2010
09:29:44 GMT	(envelope-from 26626626 at mailfrom.ru)
Received: from [41.217.66.4] (account 26626626 at mailfrom.ru)  by
be02-umail.umail.ru (CommuniGate Pro WEBUSER 5.2.12)  with HTTP id 41286761;
Mon, 31 May 2010 13:29:32 +0400
From: mssm.edu <stiematain at ymail.com>
Content-Class: urn:content-classes:message
Date: Mon, 31 May 2010 05:29:32 -0400
Subject: Dear mssm.edu Customer
Thread-Topic: Dear mssm.edu Customer
Thread-Index: AcsAo9h0hnZ/K6ERRZyDEb5aTYMwwA==
Message-ID: <web-41286803 at be02-umail.umail.ru>
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-AuthSource: CASHUB04.exchange.cornell.edu
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ph: V4.1 at adminapp
x-pmx-cornell-spam-checked: poppy
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Dear  Customer,


This Email is from  mssm.edu and we are sending it to every  Email
User Accounts Owner for safety. we are having congestion's due to the
anonymous registration of web mail accounts so we are shutting down some
accounts and your account was among those to be deleted. We are sending
you this email so that you can verify and let us know if you still want to
use this account.

If you are still interested please confirm your account by filling the
space below. Your User name,password,date of birth and your country
information would be needed to verify your account. Due to the congestion
in all mail users and removal of all unused  Accounts,  would be shutting
down all unused Accounts, You will have to confirm your E-mail by filling
out your Log in Information below after clicking the reply button, or your
account will be suspended within 24 hours for security reasons.

*Email NetID :..............
*Email Password :..............
*Date of Birth :..................
*Country or Territory: ........


After following the instructions in the sheet, your account will not be
interrupted and will continue as normal. Thanks for your attention to this
request. We apologize for any inconveniences.

Warning!!! Account owner that refuses to update his/her account after 48
Hours of receiving this warning will lose his or her account permanently.

Thanks
mssm.edu