[nsp-sec] ATTN Google, spreadsheet phish

Tue Sep 27 10:45:35 EDT 2011

Also clicked report abuse for 

https://docs.google.com/spreadsheet/viewform?formkey=dGoxRTd0YkhEM1l3c3hQRWR0MVZvdVE6MQ

Sample with full headers:

>From pagoramu at purdue.edu  Tue Sep 27 07:04:08 2011
Return-Path: <pagoramu at purdue.edu>
X-Original-To: help at treqs.caltech.edu
Delivered-To: help at treqs.caltech.edu
Received: from outgoing-mail.its.caltech.edu (outgoing-mail.its.caltech.edu
[131.215.239.19])
	by jonola.caltech.edu (Postfix) with ESMTP id 31AFF1713A
	for <help at treqs.caltech.edu>; Tue, 27 Sep 2011 07:04:08 -0700 (PDT)
Received: from treqs-delivery.caltech.edu (localhost [127.0.0.1])
	by earth-doxen-postvirus (Postfix) with ESMTP id 01EAF66E03EE
	for <help at treqs.caltech.edu>; Tue, 27 Sep 2011 07:04:07 -0700 (PDT)
X-Mailbox-Line: From pagoramu at purdue.edu  Tue Sep 27 07: 04:07 2011
X-Original-To: help at its.caltech.edu
Delivered-To: help at its.caltech.edu
Received: from earth-doxen.imss.caltech.edu (localhost [127.0.0.1])
	by earth-doxen-postvirus (Postfix) with ESMTP id 9E83566E03F5;
	Tue, 27 Sep 2011 07:04:07 -0700 (PDT)
X-Spam-Scanned: at Caltech-IMSS on earth-doxen by amavisd-new
X-Spam-Flag: NO
X-Spam-Score: 0.807
X-Spam-Level: 
X-Spam-Status: No, score=0.807 tagged_above=-10000 required=5
	tests=[HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, SUBJ_ALL_CAPS=1.806]
	autolearn=disabled
Received: from mailhub130.itcs.purdue.edu (mailhub130.itcs.purdue.edu
[128.210.5.130])
	by earth-doxen-external (Postfix) with ESMTP id 393FD66E03EE;
	Tue, 27 Sep 2011 07:04:03 -0700 (PDT)
Received: from WPPEXHUB02F.purdue.lcl (wppexhub02f.itap.purdue.edu
[172.21.6.91])
	by mailhub130.itcs.purdue.edu (8.14.4/8.14.4/mta-nopmx.smtp.purdue.edu)
with ESMTP id p8RE2JSZ001556;
	Tue, 27 Sep 2011 10:02:45 -0400
Received: from vpexch07.purdue.lcl ([169.254.1.207]) by
WPPEXHUB02F.purdue.lcl
 ([::1]) with mapi; Tue, 27 Sep 2011 10:02:28 -0400
From: "Agoramurthy, Poornima" <pagoramu at purdue.edu>
To: "Agoramurthy, Poornima" <pagoramu at purdue.edu>
Date: Tue, 27 Sep 2011 09:58:16 -0400
Subject: RE: YOU HAVE EXCEED YOUR STORAGE LIMIT
Thread-Topic: YOU HAVE EXCEED YOUR STORAGE LIMIT
Thread-Index: AQHMfRyQyWzDnZ43vEm+vRrvM7HV55VhPvbHgAABFZuAAAC/VQ==
Message-ID:
<9CB29B76E50D7F4DA541B794F18039C501799271CC27 at VPEXCH07.purdue.lcl>
References:
<9CB29B76E50D7F4DA541B794F18039C501799271CC08 at VPEXCH07.purdue.lcl>,<9CB29B76E50D7F4DA541B794F18039C501799271CC0E at VPEXCH07.purdue.lcl>,<9CB29B76E50D7F4DA541B794F18039C501799271CC20 at VPEXCH07.purdue.lcl>
In-Reply-To:
<9CB29B76E50D7F4DA541B794F18039C501799271CC20 at VPEXCH07.purdue.lcl>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: multipart/alternative;
	boundary="_000_9CB29B76E50D7F4DA541B794F18039C501799271CC27VPEXCH07pur_"
MIME-Version: 1.0
X-PMX-Version: 5.5.9.388399
X-PerlMx-Virus-Scanned: Yes
X-TBCK-ID: b573cfd69a7c20387895bfc71f65a124
X-TBCK-Status: First;AllClear;0

--_000_9CB29B76E50D7F4DA541B794F18039C501799271CC27VPEXCH07pur_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

20GB 23GB
Current size Maximum size
Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB. You Are
=
Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.Pl=
ease
Click<https://docs.google.com/spreadsheet/viewform?formkey=3DdGoxRTd0Y=
khEM1l3c3hQRWR0MVZvdVE6MQ> the Link Below To Validate Your Mailbox And
Incr=
ease Your storage limit

--_000_9CB29B76E50D7F4DA541B794F18039C501799271CC27VPEXCH07pur_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html dir=3D"ltr"><head>
<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Diso-8859-=
1">
<style id=3D"owaTempEditStyle"></style><style title=3D"owaParaStyle"><!--P
=
{
	MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
--></style>
<meta name=3D"GENERATOR" content=3D"MSHTML 8.00.6001.23216">
</head>
<body ocsi=3D"x">
<div style=3D"FONT-FAMILY: Times New Roman; DIRECTION: ltr; COLOR:
#000000;=
 FONT-SIZE: 16px">
<div style=3D"FONT-FAMILY: Times New Roman; DIRECTION: ltr; COLOR:
#000000;=
 FONT-SIZE: 16px">
20GB 23GB<br>
Current size Maximum size<br>
Your Webmail Quota Has Exceeded The Set Quota/Limit Which Is 20GB. You Are
=
Currently Running On 23GB Due To Hidden Files And Folder On Your
Mailbox.Pl=
ease
<u><a
href=3D"https://docs.google.com/spreadsheet/viewform?formkey=3DdGoxRT=
d0YkhEM1l3c3hQRWR0MVZvdVE6MQ" target=3D"_blank">Click</a></u> the Link
Belo=
w To Validate Your Mailbox And Increase Your storage limit</div>
</div>
</body>
</html>

--_000_9CB29B76E50D7F4DA541B794F18039C501799271CC27VPEXCH07pur_--
---------------------------------------------------------------------------

-- 
RuthAnne Bevier
Director, Information Security
California Institute of Technology
ruthanne at caltech.edu
626-395-2671