An
Email with the Subject "FW: Abbey account Security Update needed (June 20, 2008)" was
received in one of Scamdex's honeypot email accounts on Fri, 20 Jun 2008 10:56:08 -0700
and has been classified as a Generic Scam Email.
The sender shows as "Holzhauer, John" <John.Holzhauer@gdc4s.com>.
The email address was probably spoofed. Do not reply to or contact any persons or organizations referenced in
this email, or follow any URLs as you may expose yourself to scammers and, at the very least, you will be
added to their email address lists for spam purposes.
Scam TagCloud
bankmicrosoftebaywinaccountcustomerserviceinternetcustomsentmailbank abbey bank userabbeyspamsecurityach(june 20, 2008)([10.240.16.50])(6.0.3790.3959)([10.240.16.60])(6.0.3790.1830)([10.245.246.60]) by gdds...(trend imss smtp service 7.0)[127.0.0.1]) by az25...(mst)([127.0.0.1])(az25egs02.gdc4s.com [127...(espion-interceptor, port...(unknown [213.247.55.33])(postfix)(exim 4.60)(envelope-from <beads@...(utc) filetime=[b7d773b0:...[mailto:cust.support@abbe...dearfinancial services
NO CHART DATA - EMAIL HAS NOT YET BEEN ANALYSED
Scam Email Headers
This a (redacted) view of the raw email headers of this scam email.
Personally Identifiable Information (PII) has been suppressed, but can be
supplied as received to appropriate investigating or law enforcement agencies on request.
EEEEEstdClass Object
(
[return-path:] =>
[envelope-to:] => scams@scamdex.com
[delivery-date:] => Fri, 20 Jun 2008 10:56:08 -0700
[received:] => Array
(
[0] => from ndhmc4sege02.gdc4s.com ([192.206.187.68])by gogol.o7e.net with esmtps (TLSv1:AES256-SHA:256)(Exim 4.69)(envelope-from )id 1K9kq0-0005GJ-H7for scams@scamdex.com; Fri, 20 Jun 2008 10:56:08 -0700
[1] => from ndhmc4segi02.gdc4s.com ([10.230.4.11]) by gdc4s.com ([10.230.100.68]) with ESMTP (TREND IMSS SMTP Service 7.0) id 1aa348a200006383 for ; Fri, 20 Jun 2008 13:55:49 -0500
[2] => from NDHMC4SXCH.gdc4s.com ([10.230.6.25]) by gdc4s.com ([10.230.4.11]) with ESMTP (TREND IMSS SMTP Service 7.0) id 1b023f6c0001ece1 for ; Fri, 20 Jun 2008 13:55:47 -0500
)
[x-tm-imss-message-id:] => Array
(
[0] => <1aa348a200006383@gdc4s.com>
[1] => <1b023f6c0001ece1@gdc4s.com>
)
[x-mimeole:] => Produced By Microsoft Exchange V6.5
[content-class:] => urn:content-classes:message
[return-receipt-to:] => "Holzhauer, John"
[mime-version:] => 1.0
[content-type:] => multipart/alternative;boundary="----_=_NextPart_001_01C8D2FE.DE6524B3"
[disposition-notification-to:] => "Holzhauer, John"
[subject:] => FW: Abbey account Security Update needed (June 20, 2008)
[date:] => Fri, 20 Jun 2008 13:55:47 -0400
[x-ms-has-attach:] =>
[x-ms-tnef-correlator:] =>
[thread-topic:] => Abbey account Security Update needed (June 20, 2008)
[thread-index:] => AcjS9bfeyQQct6sERJiC3TH2ebWY8gAAnrGQ
[from:] => "Holzhauer, John"
[to:] => ,,,,,
[cc:] => ,,,,
[x-spam-status:] => No, score=-0.9
[x-spam-score:] => -8
[x-spam-bar:] => /
[x-spam-flag:] => NO
[message-id:] => REIDs3x1239839793.M361884P32690V-S3X
[x-scamdex-scores:] => S:47 P:46 A:61 L:41 E:50 G:39
[x-scamdex-classtype:] => A
[x-scamdex-classscore:] => 61
[x-scamdex-totscore:] => 284
[x-scamdex-kw:] => account,bank,customer,ebay,internet,login,national,notification,plc,resident,sent,service
[x-scamdex-em:] => 195c44530001d0a4@gddsi.com,E1K9joJ-0002jf-BX@da2.jero,beads@beadsupplies.nl,beads@beadsupplies.nlX,holzhauer@gdc4s.com,support@abbey.co.uk
[x-scamdex-dir:] => C
[x-scamdex-id:] => C1240615308.M725469P8072V
[x-scamdex-copyright:] => This Email is Copyright Scamdex.com 2009, Reproduction Prohibited
)
Domain Names used for collecting scam email ("Honeypot email accounts") have been obscured and replaced with the token 'HUN1P0T'
Community Action - SPAM/non-Scam Report
Occasionally, incorrectly categorized emails get into the Scamdex Scam Email Database and need to be removed. If this
email has Personally Identifiable Information (PII), or is, in your opinion, from a bona-fide entity, let us know.
Scamdex will, as soon as is practicable, take-down any emails that in our opinion should not
be in our database. Note that ALL emails in the Scamdex Scam Email Database were received as Unsolicited Commercial Email, aka UCE or
SPAM, via unpublished 'Honeypot' email addresses.
Microsoft Mail
Internet Headers Version 2.0 Received: from az25exf04.gddsi.com
([10.240.16.50]) by NDHMC4SXCH.gdc4s.com with Microsoft
SMTPSVC(6.0.3790.3959); Fri, 20 Jun 2008 12:50:17 -0400 Received:
from az25egi02 ([10.240.16.60]) by az25exf04.gddsi.com with Microsoft
SMTPSVC(6.0.3790.1830); Fri, 20 Jun 2008 09:50:17
-0700 X-TM-IMSS-Message-ID:<195c44530001d0a4@gddsi.com> Received:
from az25egs02.gdc4s.com ([10.245.246.60]) by gddsi.com ([10.240.16.60]) with
ESMTP (TREND IMSS SMTP Service 7.0) id 195c44530001d0a4 for <beads@beadsupplies.nl>; Fri, 20 Jun
2008 09:49:57 -0700 Received: from localhost (localhost
[127.0.0.1]) by az25egs02.gdc4s.com (Postfix) with ESMTP id
F0AEEA98FC for <john.holzhauer@gdc4s.com>; Fri, 20
Jun 2008 09:50:25 -0700 (MST) Received: from az25egs02.gdc4s.com
([127.0.0.1]) by localhost (az25egs02.gdc4s.com [127.0.0.1])
(Espion-Interceptor, port port 10024) with ESMTP id 69413-01 for <john.holzhauer@gdc4s.com>; Fri,
20 Jun 2008 09:50:16 -0700 (MST) Received: from da2.jeroenwinters.com
(unknown [213.247.55.33]) by az25egs02.gdc4s.com (Postfix) with ESMTP
id B775CA9912 for <john.holzhauer@gdc4s.com>; Fri, 20
Jun 2008 09:50:16 -0700 (MST) Received: from apache by da2.jeroenwinters.com
with local (Exim 4.60) (envelope-from <beads@beadsupplies.nl>) id
1K9joJ-0002jf-BX for john.holzhauer@gdc4s.com; Fri, 20 Jun
2008 18:50:03 +0200 To: john.holzhauer@gdc4s.com Subject:
Abbey account Security Update needed (June 20, 2008) X-PHP-Script: www.beadsupplies.nl/index.php
for 88.162.76.107 From: <cust.support@abbey.co.uk> Reply-To:
cust.support@abbey.co.uk MIME-Version:
1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Message-Id:
<E1K9joJ-0002jf-BX@da2.jeroenwinters.com> Date:
Fri, 20 Jun 2008 18:50:03 +0200 X-Spam-Status: No, hits=2.541 tagged_above=1
required=5.0 tests=[HTML_40_50=0.496, HTML_MESSAGE=0.001,
HTML_MIME_NO_HTML_TAG=1.082, MIME_HTML_ONLY=0.001, NO_REAL_NAME=0.961,
SPF_PASS=-0.001 EBAYES_50] X-Spam-Level: ** Return-Path: beads@beadsupplies.nl X-OriginalArrivalTime:
20 Jun 2008 16:50:17.0323 (UTC) FILETIME=[B7D773B0:01C8D2F5]
From: cust.support@abbey.co.uk
[mailto:cust.support@abbey.co.uk] Sent: Friday, June 20, 2008 12:50
PM To: Holzhauer, John Subject: Abbey account Security
Update needed (June 20, 2008)
Dear Abbey Customer,
As a part of our efforts to meet the requirements
of the Financial Services Authority we now ask all Abbey Bank users to update
their account information. It's a smart and simple way to add an additional
layer of protection to your account.
Microsoft Mail
Internet Headers Version 2.0 Received: from az25exf04.gddsi.com
([10.240.16.50]) by NDHMC4SXCH.gdc4s.com with Microsoft
SMTPSVC(6.0.3790.3959); Fri, 20 Jun 2008 12:50:17 -0400 Received:
from az25egi02 ([10.240.16.60]) by az25exf04.gddsi.com with Microsoft
SMTPSVC(6.0.3790.1830); Fri, 20 Jun 2008 09:50:17
-0700 X-TM-IMSS-Message-ID:<195c44530001d0a4@gddsi.com> Received:
from az25egs02.gdc4s.com ([10.245.246.60]) by gddsi.com ([10.240.16.60]) with
ESMTP (TREND IMSS SMTP Service 7.0) id 195c44530001d0a4 for <beads@beadsupplies.nl>; Fri, 20 Jun
2008 09:49:57 -0700 Received: from localhost (localhost
[127.0.0.1]) by az25egs02.gdc4s.com (Postfix) with ESMTP id
F0AEEA98FC for <john.holzhauer@gdc4s.com>; Fri, 20
Jun 2008 09:50:25 -0700 (MST) Received: from az25egs02.gdc4s.com
([127.0.0.1]) by localhost (az25egs02.gdc4s.com [127.0.0.1])
(Espion-Interceptor, port port 10024) with ESMTP id 69413-01 for <john.holzhauer@gdc4s.com>; Fri,
20 Jun 2008 09:50:16 -0700 (MST) Received: from da2.jeroenwinters.com
(unknown [213.247.55.33]) by az25egs02.gdc4s.com (Postfix) with ESMTP
id B775CA9912 for <john.holzhauer@gdc4s.com>; Fri, 20
Jun 2008 09:50:16 -0700 (MST) Received: from apache by da2.jeroenwinters.com
with local (Exim 4.60) (envelope-from <beads@beadsupplies.nl>) id
1K9joJ-0002jf-BX for john.holzhauer@gdc4s.com; Fri, 20 Jun
2008 18:50:03 +0200 To: john.holzhauer@gdc4s.com Subject:
Abbey account Security Update needed (June 20, 2008) X-PHP-Script: www.beadsupplies.nl/index.php
for 88.162.76.107 From: <cust.support@abbey.co.uk> Reply-To:
cust.support@abbey.co.uk MIME-Version:
1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Message-Id:
<E1K9joJ-0002jf-BX@da2.jeroenwinters.com> Date:
Fri, 20 Jun 2008 18:50:03 +0200 X-Spam-Status: No, hits=2.541 tagged_above=1
required=5.0 tests=[HTML_40_50=0.496, HTML_MESSAGE=0.001,
HTML_MIME_NO_HTML_TAG=1.082, MIME_HTML_ONLY=0.001, NO_REAL_NAME=0.961,
SPF_PASS=-0.001 EBAYES_50] X-Spam-Level: ** Return-Path: beads@beadsupplies.nl X-OriginalArrivalTime:
20 Jun 2008 16:50:17.0323 (UTC) FILETIME=[B7D773B0:01C8D2F5]
From: cust.support@abbey.co.uk
[mailto:cust.support@abbey.co.uk] Sent: Friday, June 20, 2008 12:50
PM To: Holzhauer, John Subject: Abbey account Security
Update needed (June 20, 2008)
Dear Abbey Customer,
As a part of our efforts to meet the requirements
of the Financial Services Authority we now ask all Abbey Bank users to update
their account information. It's a smart and simple way to add an additional
layer of protection to your account.