[nsp-sec] ATTN Google, another docs phish

[Peter Moody]

ack.

On Thu, Dec 15, 2011 at 11:52 AM, RuthAnne Bevier <ruthanne at caltech.edu>wrote:

> ----------- nsp-security Confidential --------
>
> Site is at
> https://docs.google.com/spreadsheet/viewform?formkey=dDdoWnByUVBfTkgyS21xRUthaU9MdXc6MQ
>
> Sample with full headers below.  Report Abuse already submitted.
>
> Return-Path: <k.sess at unf.edu>
> X-Original-To: greg.grasmehr at caltech.edu
> Received: from imap-server.its.caltech.edu [131.215.239.27]
>        by dakine with IMAP (fetchmail-6.3.20)
>        for <greg at localhost> (single-drop); Thu, 15 Dec 2011 07:24:26
> -0800 (PST)
> Received: from fire-doxen.imss.caltech.edu (localhost [127.0.0.1])
>        by fire-doxen-postvirus (Postfix) with ESMTP id 7B8B032803E;
>        Thu, 15 Dec 2011 07:23:44 -0800 (PST)
> X-Spam-Scanned: at Caltech-IMSS on fire-doxen by amavisd-new
> X-Spam-Flag: NO
> X-Spam-Score: -2.298
> X-Spam-Level:
> X-Spam-Status: No, score=-2.298 tagged_above=-10000 required=5
>        tests=[HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001,
>        RCVD_IN_DNSWL_MED=-2.3] autolearn=unavailable
> Received: from mx1.unf.edu (mx1.unf.edu [139.62.234.31])
>        by fire-doxen-external (Postfix) with ESMTP id ACC3B2E50CFE;
>        Thu, 15 Dec 2011 07:22:45 -0800 (PST)
> X-IronPort-Anti-Spam-Filtered: true
> X-IronPort-Anti-Spam-Result:
> AnuKABUP6k6LPsCL/2dsb2JhbABEm1KBOQGNEoEUgQWBZQEDAQQBBQUHFRRbAQsBHgYYB1cBCgEKCoVAAQErgXwBECKYNY4oiD6Ed4QKBIhQAQmBL4EYYwSIATMKAYw3jhqDJB5tHw
> Received: from callisto2.unfcsd.unf.edu ([139.62.192.139])
>        by smarthost1.unf.edu with ESMTP; 15 Dec 2011 10:19:26 -0500
> Received: from ZINC1.unfcsd.unf.edu (139.62.192.61) by
>        callisto2.unfcsd.unf.edu (139.62.192.139) with Microsoft SMTP
> Server id
>        8.3.213.0; Thu, 15 Dec 2011 10:19:22 -0500
> X-MimeOLE: Produced By Microsoft Exchange V6.5
> Content-Class: urn:content-classes:message
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>        boundary="----_=_NextPart_001_01CCBB3C.EB034BEB"
> Subject: Reactivate Your Mailbox??
> Date: Thu, 15 Dec 2011 10:19:20 -0500
> Message-ID: <2CDE1EA456F47442A89A9CA8863C5CA50CABB120 at ZINC1.unfcsd.unf.edu
> >
> X-MS-Has-Attach:
> X-MS-TNEF-Correlator:
> Thread-Topic: Reactivate Your Mailbox??
> Thread-Index: Acy7POaBKBrbPefTSziusulDfLfPKA==
> From: "Sess, Kimberly" <k.sess at unf.edu>
> To: Undisclosed recipients: ;
>
> Dear User,
>
> Your mailbox have been compromised and also have exceeded its storage
> limit set by the administrator, you may not be able to send or receive new
> mail until you Re-activate your mailbox. To Re-activate your mailbox please
> ClickHere <
> https://docs.google.com/spreadsheet/viewform?formkey=dDdoWnByUVBfTkgyS21xRUthaU9MdXc6MQ
> >
>
> Thanks
> System Administrator
>
>
>
>
>
>
> --
> RuthAnne Bevier
> Director, Information Security
> California Institute of Technology
> ruthanne at caltech.edu
> 626-395-2671
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security
> counter-measures.
> _______________________________________________
>



-- 
Peter Moody      Google    1.650.253.7306
Security Engineer  pgp:0xC3410038