phishing: PosteItaliane – Informazioni di sicurezza 38WTGHJ
mi è arrivata questa email di phishing ai danni di PosteItaliane… in pratica cercano di imbrogliare gli utenti di PostePay sperando che impauriti da questa email (scritta in un ottimo italiano e per questo più pericolosa) ad inserire informazioni sensibili inerenti all’account PostePay.
ecco gli header
Delivered-To: macorte@gmail.com
Received: by 10.49.49.71 with SMTP id s7csp140704qen;
Wed, 24 Jul 2013 22:20:58 -0700 (PDT)
X-Received: by 10.15.52.5 with SMTP id o5mr41111774eew.58.1374729658076;
Wed, 24 Jul 2013 22:20:58 -0700 (PDT)
Return-Path: <78345@poste.it.wprguwhg.com>
Received: from mxavas1.aruba.it (mxavas1.aruba.it. [62.149.157.11])
by mx.google.com with SMTP id l46si9675707een.288.2013.07.24.22.20.57
for <macorte@gmail.com>;
Wed, 24 Jul 2013 22:20:58 -0700 (PDT)
Received-SPF: neutral (google.com: 62.149.157.11 is neither permitted nor denied by best guess record for domain of 78345@poste.it.wprguwhg.com) client-ip=62.149.157.11;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 62.149.157.11 is neither permitted nor denied by best guess record for domain of 78345@poste.it.wprguwhg.com) smtp.mail=78345@poste.it.wprguwhg.com
Received: (qmail 27755 invoked by uid 89); 25 Jul 2013 05:20:56 -0000
Delivered-To: marco@acor3.it
Received: (qmail 27748 invoked by uid 89); 25 Jul 2013 05:20:56 -0000
Received: from unknown (HELO mxcmd05.ad.aruba.it) (10.10.10.72)
by mxavas1.ad.aruba.it with SMTP; 25 Jul 2013 05:20:56 -0000
Received: from matrix.superdomainzone.com ([184.154.44.246])
by mxcmd05.ad.aruba.it with bizsmtp
id 4VLu1m05P5Jgv5U01VLv66; Thu, 25 Jul 2013 07:20:56 +0200
Received: from gray.dynamicwebs.co.uk ([195.177.193.235]:33711 helo=localhost.localdomain)
by matrix.superdomainzone.com with esmtpa (Exim 4.80)
(envelope-from <78345@poste.it.wprguwhg.com>)
id 1V2Dyw-0003Q7-B9
for marco@acor3.it; Thu, 25 Jul 2013 00:20:54 -0500
Date: Thu, 25 Jul 2013 06:20:52 +0100
To: marco@acor3.it
From: Poste Italiane <78345@poste.it.wprguwhg.com>
Subject: Informazioni di sicurezza 38WTGHJ
Message-ID: <df2b3680a448711299c6953690e97cff@localhost.localdomain>
X-Priority: 1
X-Mailer: PHPMailer 5.2.6
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_df2b3680a448711299c6953690e97cff"
Content-Transfer-Encoding: base64
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - matrix.superdomainzone.com
X-AntiAbuse: Original Domain - acor3.it
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - poste.it.wprguwhg.com
X-Get-Message-Sender-Via: matrix.superdomainzone.com: authenticated_id: admin@lojaprasom.com.br
X-Spam-Rating: mxavas1.ad.aruba.it 1.6.2 0/1000/N