[nsp-sec] Google to the WCP

Tue Jun 21 10:30:13 EDT 2011

Google,

Please remove the following spreadsheet.  It is being used in a phishing attempt.

<https://spreadsheets.google.com/spreadsheet/viewform?formkey=3DdGZlYW9hcTJudFpHb2NreEo5UnR5SGc6MQ>

Also, if anyone has any contacts in the West Virginia State Government, can you let them know that they have a compromised email account, "Haught, Daniel P" <Daniel.P.Haught at wv.gov>?

Thanks.

-Dan
AS 26

Received: from pawpaw.mail.cornell.edu (128.253.83.170) by
cashub05.exchange.cornell.edu (10.16.197.24) with Microsoft SMTP Server id
8.3.83.0; Tue, 21 Jun 2011 10:24:19 -0400
Received: from zixvpm02.wv.gov (zixvpm02.wv.gov [129.71.206.179])	by
pawpaw.mail.cornell.edu (8.14.4/8.14.4) with ESMTP id p5LEOFN6021577	for
<dra1 at cornell.edu>; Tue, 21 Jun 2011 10:24:19 -0400
Received: from zixvpm02.wv.gov (ZixVPM [127.0.0.1])	by Outbound.wv.gov
(Proprietary) with ESMTP id F12D339F871	for <dra1 at cornell.edu>; Tue, 21 Jun
2011 08:40:56 -0400 (EDT)
Received: from mail.wv.gov (otb6exchhub01.executive.stateofwv.gov
[10.200.36.35])	by zixvpm02.wv.gov (Proprietary) with ESMTP id 01C623D70A5;
	Tue, 21 Jun 2011 08:37:32 -0400 (EDT)
Received: from EXCHFE02.executive.stateofwv.gov (10.200.46.81) by
OTB6EXCHHUB01.executive.stateofwv.gov (10.200.36.35) with Microsoft SMTP
Server id 8.2.176.0; Tue, 21 Jun 2011 09:16:33 -0400
Received: from WVOTMAIL01.executive.stateofwv.gov ([10.200.36.139]) by
EXCHFE02.executive.stateofwv.gov with Microsoft SMTPSVC(6.0.3790.4675);	 Tue,
21 Jun 2011 09:16:32 -0400
From: "Haught, Daniel P" <Daniel.P.Haught at wv.gov>
Content-Class: urn:content-classes:message
Date: Tue, 21 Jun 2011 09:16:31 -0400
Subject:
Thread-Index: AcwwFW5Ue0/nHEOjRy2m18JeFXUA+w==
Message-ID:
<A651547ADCA05B449398550DCA5DE44A0704EB66 at WVOTMAIL01.executive.stateofwv.gov>
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-AuthSource: cashub05.exchange.cornell.edu
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-pmx-version: 5.5.9.395186, Antispam-Engine: 2.7.2.376379, Antispam-Data:
2011.6.21.141517
x-pmx-cornell-spam-checked: Pawpaw
x-originalarrivaltime: 21 Jun 2011 13:16:32.0671 (UTC)
FILETIME=[707EDAF0:01CC3015]
x-original-sender: daniel.p.haught at wv.gov - Tue Jun 21 10:24:19 2011
x-additional-recipients-added: 1
x-pmx-cornell-reason: CU_User_Override User Opted Out
Content-Type: multipart/alternative;
	boundary="_000_A651547ADCA05B449398550DCA5DE44A0704EB66WVOTMAIL01execu_"
MIME-Version: 1.0

--_000_A651547ADCA05B449398550DCA5DE44A0704EB66WVOTMAIL01execu_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

This is to inform you that Your mailbox has exceeded the storage limit whic=
h is 20GB as set up by our administrator service center, you are currently =
running on 20.9GB,To re-validate your mailbox  please Click here<https://sp=
readsheets.google.com/spreadsheet/viewform?formkey=3DdGZlYW9hcTJudFpHb2NreE=
o5UnR5SGc6MQ>  to verify.We apologize for any inconvenience. Thank you for =
your anticipated  co-operation.Note: Failure to comply may result lose of y=
our account within 24 hours.Thanks. System Administrator center

--_000_A651547ADCA05B449398550DCA5DE44A0704EB66WVOTMAIL01execu_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML dir=3Dltr><HEAD>=0A=
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dunicode">=
=0A=
<META content=3D"MSHTML 6.00.2900.2180" name=3DGENERATOR></HEAD>=0A=
<BODY>=0A=
<DIV><FONT face=3DArial color=3D#000000 size=3D2>=0A=
<DIV><FONT face=3DArial color=3D#000000 size=3D2>=0A=
<TABLE cellSpacing=3D0 cellPadding=3D0 border=3D0 _yuid=3D"yui_3_1_1_9_1308=
635030968164">=0A=
<TBODY _yuid=3D"yui_3_1_1_9_1308635030968163">=0A=
<TR _yuid=3D"yui_3_1_1_9_1308635030968162">=0A=
<TD vAlign=3Dtop _yuid=3D"yui_3_1_1_3_1308635030968131"><STRONG _yuid=3D"yu=
i_3_1_1_3_1308635030968167">This is to inform you that Your mailbox has exc=
eeded the storage limit which is 20GB as set up by our administrator servic=
e center, you are currently running on 20.9GB,To re-validate your mailbox&n=
bsp; please </STRONG><A href=3D"https://spreadsheets.google.com/spreadsheet=
/viewform?formkey=3DdGZlYW9hcTJudFpHb2NreEo5UnR5SGc6MQ" target=3D_blank rel=
=3Dnofollow><FONT color=3D#ff0000><STRONG>Click here</STRONG></FONT></A><ST=
RONG>  to verify.We apologize for any inconvenience. Thank you for you=
r anticipated  co-operation.Note: Failure to comply may result lose of=
your account within 24 hours.Thanks. <SPAN class=3Dyiv160227254yshortcuts =
id=3Dyiv160227254lw_1307728126_0 style=3D"BACKGROUND: none transparent scro=
ll repeat 0% 0%; BORDER-BOTTOM: rgb(54,99,136) 2px dotted"><SPAN class=3Dyi=
v160227254yshortcuts id=3Dyiv160227254lw_1307784185_0 style=3D"BACKGROUND: =
none transparent scroll repeat 0% 0%; BORDER-BOTTOM: rgb(54,99,136) 2px dot=
ted"><SPAN class=3Dyiv160227254yshortcuts id=3Dyiv160227254lw_1307827873_0 =
style=3D"BACKGROUND: none transparent scroll repeat 0% 0%; BORDER-BOTTOM: r=
gb(54,99,136) 2px dotted"><SPAN class=3Dyiv160227254yshortcuts id=3Dyiv1602=
27254lw_1307828131_0>System Administrator</SPAN></SPAN></SPAN></SPAN> cente=
r</STRONG></TD></TR></TBODY></TABLE></FONT></DIV></FONT></DIV></BODY></HTML=
> =

--_000_A651547ADCA05B449398550DCA5DE44A0704EB66WVOTMAIL01execu_--