Re: Spam from "baosteel"

[John Peach <john-nanog () johnpeach com>]

Common phishing scam; we see them all the time, nearly always from
accounts which have been compromised by others who respond to the same
scam.


On Fri, 04 Mar 2011 10:30:53 -0600
imNet Administrator <admin+nanog () msk4 com> wrote:

> Is anyone else getting spam similar to this:
> I started getting this (albeit in English) a month or two ago, and it
> went away about the same time I turned on the CBL/XBL filters on
> postfix.  It appears it's back again.
> Note, I have absolutely zero connection with "baosteel.com" before
> these started showing up.
>
> Example:
> --------------------------------------------------------------------------------
> > From - Fri Mar 04 10:17:59 2011
> > X-Account-Key: account3
> > X-UIDL: 0000144b4b5bb8b1
> > X-Mozilla-Status: 0001
> > X-Mozilla-Status2: 00000000
> > X-Mozilla-Keys:                                                                                 
> > Return-Path: <yanxd () baosteel com>
> > X-Original-To: immute##THISWASADDED##@msk4.com
> > Delivered-To: immute##THISWASADDED##@msk4.com
> > Received: from smtps-2.sercomtel.com.br (smtps-2.sercomtel.com.br
> > [200.155.34.156]) by li01.msk4.com (Postfix) with ESMTP id E4ED34157
> >     for <immute##THISWASADDED##@msk4.com>; Fri,  4 Mar 2011
> > 01:20:13 -0600 (CST) Received: from User (unknown [95.59.199.4])
> >     by smtps-2.sercomtel.com.br (Postfix) with ESMTP id
> > 6E1D32F00C2; Fri,  4 Mar 2011 04:17:55 -0300 (BRT)
> > Reply-To: <mail.a3 () gmx us>
> > From: "Mail Administrator"<yanxd () baosteel com>
> > Subject: Email Quota Exceeded
> > Date: Fri, 4 Mar 2011 08:19:40 +0100
> > MIME-Version: 1.0
> > Content-Type: text/plain;
> >     charset="Windows-1251"
> > Content-Transfer-Encoding: 7bit
> > X-Priority: 3
> > X-MSMail-Priority: Normal
> > X-Mailer: Microsoft Outlook Express 6.00.2800.1081
> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
> > Message-Id: <20110304071756.6E1D32F00C2 () smtps-2 sercomtel com br>
> > To: undisclosed-recipients:;
> >
> > This is to inform you that you have exceeded your E-mail Quota
> > Limit and you need to increase your E-mail Quota Limit because in
> > less than 96 hours your E- mail Account will be disabled.Increase
> > your E-mail Quota Limit and continue to use your Webmail Account.
> >
> > To increase your E-mail Quota Limit to 2.7GB, Fill in your Details
> > as below and send to the E-mail Quota Webmaster by CLICKING REPLY:
> >
> > EMAIL ADDRESS:
> > USERNAME:
> > PASSWORD:
> > CONFIRM PASSWORD:
> > DATE OF BIRTH:
> >
> > Thank you for your understanding and corperation in helping us give
> > you the Best of E-mail Service.
> --------------------------------------------------------------------------------


-- 
John