dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
585

DrStrange
Technically feasible
Premium Member
join:2001-07-23
Bristol, CT

DrStrange

Premium Member

[General] Heads-up: ELNK phish

Looks like it came from a cell phone in Lagos, Nigeria.

What a surprise.


-------- Forwarded Message --------
From: - Fri Dec 05 10:55:01 2014
X-Account-Key: account7
X-UIDL: 11e4-7c96-88e39f50-ac1c-00144fe1beaa
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Status: RO
Return-Path:
Received: from gideon.mail.atl.earthlink.net ([207.69.200.80]) by mdl-pollute.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1xWV9Y1M93Nl37b0; Fri, 5 Dec 2014 10:51:10 -0500 (EST)
Received: from elasmtp-dupuy.atl.sa.earthlink.net ([207.69.200.6]) by gideon.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id 1xWV9D2RL3Nl3pK1; Fri, 5 Dec 2014 10:50:49 -0500 (EST)
Received: from [154.120.87.195] (helo=User) by elasmtp-dupuy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1Xwv9c-0006K4-RR; Fri, 05 Dec 2014 10:50:49 -0500
From: Earthlink Inc
Subject: Incoming mails
Date: Fri, 5 Dec 2014 16:50:48 +0100
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
X-ELNK-Trace: 27565cba938e465f58ec1987556279df40683398e744b8a416271c0d6e319ad43477acdec221c613a7 ce0e8f8d31aa3f350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 154.120.87.195
X-ELNK-Received-Info: spv=0;
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=00; sbw=010;
X-Antivirus: avast! (VPS 141205-1, 12/05/2014), Inbound message
X-Antivirus-Status: Clean

Dear EarthLink User

Your two incoming mails were placed on pending status due to the recent upgrade to our database,
In order to recieve the messages Click here to login and wait for responds from EarthLink.

2014 EarthLink. All Rights Reserved.

skj
Welcome to the far side of reality
Mod
join:2002-04-04
Gone South

skj

Mod

If they are going to seem credible they should at least be able to properly write in English: "wait for responds from EarthLink."

DrStrange
Technically feasible
Premium Member
join:2001-07-23
Bristol, CT

DrStrange

Premium Member

Don't give away any secrets of proper American English vocabulary, grammar and usage. Their laughably poor English is still our most effective method of detecting Nigerian scammers.

There are a number of other things they should do as well. At the top of the list is not using a Nigerian IP address.

That netblock should be added to the 41.xxx.xxx.xxx ranges that should be quietly dropped off of the Internet.