[nsp-sec] Paging Google - Spreadsheet phish

Wed Aug 31 12:00:28 EDT 2011

ack.

if you click report abuse on the spreadsheet, that should get the
appropriate people jumping as well.

Cheers,
peter

On Wed, Aug 31, 2011 at 5:23 AM, Daniel Robert Adinolfi <dra1 at cornell.edu>wrote:

> ----------- nsp-security Confidential --------
>
> Googlings,
>
> Another spreadsheet looking for trouble.  Kick open its door and show it no
> mercy.
>
> <
> https://spreadsheets.google.com/spreadsheet/viewform?formkey=3DdElmZXRXd09La3A0YThpYkxRWllwVUE6MQ
> >
>
> Thanks.
>
> -Dan
> AS26
> __________
>
> Received: from CASHUB01.exchange.cornell.edu (10.16.197.20) by
> CASHUB12.exchange.cornell.edu (10.16.197.31) with Microsoft SMTP Server
> (TLS)
> id 14.1.323.3; Wed, 31 Aug 2011 08:03:37 -0400
> Received: from orchid.mail.cornell.edu (132.236.56.61) by
> CASHUB01.exchange.cornell.edu (10.16.197.20) with Microsoft SMTP Server id
> 8.3.159.3; Wed, 31 Aug 2011 08:03:28 -0400
> Received: from localhost.localdomain (walnut.mail.cornell.edu
> [128.253.83.153])       by orchid.mail.cornell.edu (8.14.4/8.14.4) with
> ESMTP id
> p7VC3Sv5023811  for <dra1 at cornell.edu>; Wed, 31 Aug 2011 08:03:29 -0400
> (EDT)
> Received: from walnut.mail.cornell.edu  by walnut.mail.cornell.edu with
> queue
> id 219652351-3     for dra1 at cornell.edu; Wed, 31 Aug 2011 12:03:18 GMT
> Received: from tc05.NBPS.NBPS.ORG (mail1.nbps.org [216.242.114.115])    by
> walnut.mail.cornell.edu with SMTP id p7VC3EOE029990;    Wed, 31 Aug 2011
> 12:03:18 GMT    (envelope-from MorrisonDa at NBPS.ORG)
> X-MimeOLE: Produced By Microsoft Exchange V6.5
> Content-Class: urn:content-classes:message
> Content-Type: multipart/alternative;
>        boundary="----_=_NextPart_001_01CC67D5.FCC9004C"
> Subject: Webmail Quota Has Exceeded The Set Limit
> Date: Wed, 31 Aug 2011 08:03:25 -0400
> Message-ID: <7623770C3A666B42818E84A8B2C5CCD26C356A at tc05.NBPS.NBPS.ORG>
> X-MS-Has-Attach:
> X-MS-TNEF-Correlator:
> Thread-Topic: Webmail Quota Has Exceeded The Set Limit
> Thread-Index: Acxn1fxr5aRIxk+NRS2Gd1DuqeCq/A==
> From: "Morrison, Daniel" <MorrisonDa at NBPS.ORG>
> X-PMX-CORNELL-SPAM-CHECKED: Walnut
> X-PMX-Version: 5.5.9.395186, Antispam-Engine: 2.7.2.376379, Antispam-Data:
> 2011.8.31.115414
> X-Original-Sender: MorrisonDa at NBPS.ORG - Wed Aug 31 08:03:19 2011
> X-PMX-CORNELL-REASON: CU_User_Override User Opted Out
> To: Undisclosed recipients:;
> Return-Path: MorrisonDa at NBPS.ORG
> X-Additional-Recipients-Added: 1
> X-MS-Exchange-Organization-AuthSource: CASHUB01.exchange.cornell.edu
> X-MS-Exchange-Organization-AuthAs: Anonymous
> X-Additional-Recipients-Added: 1
> X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;1;0;0 0 0
> MIME-Version: 1.0
>
> ------_=_NextPart_001_01CC67D5.FCC9004C
> Content-Type: text/plain; charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
>
> Your mailbox has exceeded the storage limit which is 20GB as set by your =
> administrator,you are currently running on 20.9GB,you may not be able to =
> send or receive new mail until you re-validate your mailbox. To =
> re-validate your mailbox please.Click Here: =
> <https://spreadsheets.google.com/spreadsheet/viewform?formkey=3DdElmZXRXd=
> 09La3A0YThpYkxRWllwVUE6MQ>=20
>
> ------_=_NextPart_001_01CC67D5.FCC9004C
> Content-Type: text/html; charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
>
> <html dir=3D"ltr"><head>
> <meta http-equiv=3D"Content-Type" content=3D"text/html;
> charset=3Diso-8859-=
> 1">=0A=
> <meta name=3D"GENERATOR" content=3D"MSHTML 8.00.7600.16385"></head>=0A=
> <body>=0A=
> <div><font color=3D"#808000" face=3D"SEGA LOGO FONT"><font
> color=3D"#000000=
> ">Your mailbox has exceeded the storage limit which is 20GB as set by your
> =
> administrator,you are currently running on 20.9GB,you may not be able to
> se=
> nd or receive new mail until you re-validate your mailbox. To re-validate
> y=
> our mailbox please.</font><a href=3D"
> https://spreadsheets.google.com/spread=
> sheet/viewform?formkey=3DdElmZXRXd09La3A0YThpYkxRWllwVUE6MQ">Click
> Here:</a=
> > </font></div></body></html>=
>
> ------_=_NextPart_001_01CC67D5.FCC9004C--
>
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security
> counter-measures.
> _______________________________________________
>

-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038