[nsp-sec] ATTN Google, phish dropbox at caltechalerts at gmail.com

[RuthAnne Bevier]

This one is targeted specifically at Caltech recipients.  Sample with full headers below:


 From caltechalerts at gmail.com Sat Aug 20 11:45:48 2011
Return-Path: <caltechalerts at gmail.com>
X-Original-To: ruthanne at caltech.edu
Received: from fire-doxen.imss.caltech.edu (localhost [127.0.0.1])
	by fire-doxen-postvirus (Postfix) with ESMTP id 7028C328174
	for <ruthanne at caltech.edu>; Sat, 20 Aug 2011 11:45:48 -0700 (PDT)
X-Spam-Scanned: at Caltech-IMSS on fire-doxen by amavisd-new
X-Spam-Flag: NO
X-Spam-Score: -2.654
X-Spam-Level: 
X-Spam-Status: No, score=-2.654 tagged_above=-10000 required=5
	tests=[DKIM_SIGNED=0.001, DKIM_VERIFIED=-0.001, RCVD_IN_DNSWL_LOW=-1,
	SNF4SA=-1.653, SPF_PASS=-0.001] autolearn=unavailable
Received: from mail-wy0-f193.google.com (mail-wy0-f193.google.com [74.125.82.193])
	by fire-doxen-external (Postfix) with ESMTP id 0AFA43284AB
	for <ruthanne at caltech.edu>; Sat, 20 Aug 2011 11:45:46 -0700 (PDT)
Received: by mail-wy0-f193.google.com with SMTP id 34so598232wyg.0
         for <ruthanne at caltech.edu>; Sat, 20 Aug 2011 11:45:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
         d=gmail.com; s=gamma;
         h=mime-version:date:message-id:subject:from:to:content-type;
         bh=ZKipkqBVrOVwdKQyrLL9erKvr/Hc0B9Gb7VAeLqRaQI=;
         b=YahO4Tl5ji4xcry9U1ewwYZkz8c/cVA6Ag5dnZrb/toXYMSUTlrqlVN2YpVcMkXqql
          qqnqlMxqrGvNsNl0bwZYuCTkkAiqPbNjfLEkzF3fBnb04/4XpLUmgLCYr4uxGhSyX5We
          dPNyOhsDoCGHLIIppd80DRwB+o3EgxwG+Z4bE=
MIME-Version: 1.0
Received: by 10.216.85.137 with SMTP id u9mr102270wee.49.1313865946588; Sat,
  20 Aug 2011 11:45:46 -0700 (PDT)
Received: by 10.216.153.104 with HTTP; Sat, 20 Aug 2011 11:45:46 -0700 (PDT)
Date: Sat, 20 Aug 2011 11:45:46 -0700
Message-ID: <CAAHnqTrDM-9OUycFDxuYJffMtkUctQFyz7UCuo6wCZp8R8BRag at mail.gmail.com>
Subject: Dear Caltech Subscriber
From: Webmail Account Alert <caltechalerts at gmail.com>
To: undisclosed-recipients:;
Content-Type: text/plain; charset=ISO-8859-1

Dear WebMail Subscriber,

We would like to inform you that we are currently carrying out
scheduled maintenance and upgrade of our webmail service and as a
result our email client has been changed and your original password
will be reset. We are sorry for any inconvenience caused.

To complete your webmail account, you must reply to this email
immediately and enter your

Username here (         )
password here (         )

Failure to do this will immediately render your email address deactivated from
our database.

Thank you for using our webmail !
Sincerely,
WebMail Support




-- 
RuthAnne Bevier
Director, Information Security
California Institute of Technology
ruthanne at caltech.edu
626-395-2671