chang_lee@libero.it Subject: Payment Copy

[SlapHappy]

212.52.84.103 Italia Online S.p.a Milan Italy
*Probable originating IP address

Return-Path: <chang_lee@libero.it>
Received: from outrelay03.libero.it (outrelay03.libero.it. [212.52.84.103])
by mx.google.com with ESMTP id q38si25299244wen.148.2012.10.17.13.47.26;
Wed, 17 Oct 2012 13:47:29 -0700 (PDT)
Received-SPF: pass (google.com: domain of chang_lee@libero.it designates 212.52.84.103 as permitted sender) client-ip=212.52.84.103;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of chang_lee@libero.it designates 212.52.84.103 as permitted sender) smtp.mail=chang_lee@libero.it
X-CTCH-Spam: Bulk
X-CTCH-RefID: str=0001.0A0B0201.507F071D.008E,ss=3,sh,re=0.000,fgs=16
X-libjamoibt: 1821
Received: from wmail38 (172.31.0.227) by outrelay03.libero.it (8.5.140.03)
id 506C837E0208F5FE; Wed, 17 Oct 2012 22:47:25 +0200
Message-ID: <13303868.3114071350506845157.JavaMail.defaultUser@defaultHost>
Date: Wed, 17 Oct 2012 22:47:25 +0200 (CEST)
From: "chang_lee@libero.it" <chang_lee@libero.it>
Reply-To: "chang_lee@libero.it" <chang_lee@libero.it>
Subject: Payment Copy


Dear Sir

find attached T/T copy of payment made to your account,
on behalf of our client kindly view for your reference.

Thanks
Mrs Chang Lee

TT 90,000 usd.html <<Phishing form, looking to phish gmail account.
64K

contents:

Phishing form!

Sign in
Username
Password
Stay signed in
Can't access your account?
Gmail
A Google approach to email.

Gmail is built on the idea that email can be more intuitive, efficient, and useful. And maybe even fun. After all, Gmail has:


Lots of space

Over 10240.000001 megabytes (and counting) of free storage.


Less spam

Keep unwanted messages out of your inbox.


Mobile access

Get Gmail on your mobile phone. Learn more
About Gmail
New features!
Switch to Gmail
Create an account

Take Gmail to work with Google Apps for Business

Love Gmail, but looking for a custom email address for your company?
Get business email, calendar, and online docs @your_company.com. Learn more
© 2012 Google
Gmail for Work
Terms & Privacy
Help

[Devil_woman]

chang_lee@libero.it

Received: from outrelay03.libero.it (outrelay03.libero.it. [212.52.84.103])
by mx.google.com with ESMTP id o3si25988615wej.39.2012.10.17.18.16.08;
Wed, 17 Oct 2012 18:16:11 -0700 (PDT)
Received-SPF: pass (google.com: domain of chang_lee@libero.it designates 212.52.84.103 as permitted sender) client-ip=212.52.84.103;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of chang_lee@libero.it designates 212.52.84.103 as permitted sender) smtp.mail=chang_lee@libero.it
X-CTCH-Spam: Bulk
X-CTCH-RefID: str=0001.0A0B0201.507F071D.008E,ss=3,sh,re=0.000,fgs=16
X-libjamoibt: 1821
Received: from wmail38 (172.31.0.227) by outrelay03.libero.it (8.5.140.03)
id 506C837E020CAB1E; Thu, 18 Oct 2012 03:16:07 +0200
Message-ID: <19267276.3148491350522967248.JavaMail.defaultUser@defaultHost>
Date: Thu, 18 Oct 2012 03:16:07 +0200 (CEST)
From: "chang_lee@libero.it" <chang_lee@libero.it>
Reply-To: "chang_lee@libero.it" <chang_lee@libero.it>
Subject: Payment Copy
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_261213_26392061.1350522967247"
X-SenderIP: 176.221.169.161
X-libjamv: YSDWC+TYzMM=
X-libjamsun: YvaRtLYdIFaR7I471utyZjdOMJrRgu1r

Header Analysis Quick Report<br>Originating IP: 176.221.169.161<br>Originating ISP: Silknet Broadband<br> City: Tbilisi<br>Country of Origin: Georgia<br>* For a complete report on this email header goto ipTRACKERonline

From:chang_lee@libero.it chang_lee@libero.it
reply to:chang_lee@libero.it chang_lee@libero.it
Wed, Oct 17, 2012 at 9:43 PM
Payment Copy


Dear Sir

find attached T/T copy of payment made to your account,
on behalf of our client kindly view for your reference.

Thanks
Mrs Chang Lee

Attachment led here! Pshing site!!

[SlapHappy]

* 176.73.168.159 Caucasus Online Llc Tbilisi Georgia


Received: by 10.217.61.7 with SMTP id h7csp205688wex;
Fri, 19 Oct 2012 07:29:08 -0700 (PDT)
Received: by 10.180.105.168 with SMTP id gn8mr3666796wib.10.1350656947595;
Fri, 19 Oct 2012 07:29:07 -0700 (PDT)
Return-Path: <changlee100@libero.it>
Received: from outrelay03.libero.it (outrelay03.libero.it. [212.52.84.103])
by mx.google.com with ESMTP id gg1si3735839wib.38.2012.10.19.07.29.05;
Fri, 19 Oct 2012 07:29:07 -0700 (PDT)
Received-SPF: pass (google.com: domain of changlee100@libero.it designates 212.52.84.103 as permitted sender) client-ip=212.52.84.103;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of changlee100@libero.it designates 212.52.84.103 as permitted sender) smtp.mail=changlee100@libero.it
X-CTCH-Spam: Bulk
X-CTCH-RefID: str=0001.0A0B0208.50814E03.0115,ss=3,sh,re=0.000,fgs=16
X-libjamoibt: 1821
Received: from wmail10.libero.it (172.31.0.79) by outrelay03.libero.it (8.5.140.03)
id 506C837E02512395; Fri, 19 Oct 2012 16:29:03 +0200
Message-ID: <10169236.4175021350656943405.JavaMail.defaultUser@defaultHost>
Date: Fri, 19 Oct 2012 16:29:03 +0200 (CEST)
From: "changlee100@libero.it" <changlee100@libero.it>
Reply-To: "changlee100@libero.it" <changlee100@libero.it>
Subject: Payment Copy
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_341182_25866685.1350656943404"
X-SenderIP: 176.73.168.159
X-libjamv: P5Mf7apqAEQ=
X-libjamsun: iwVmysL37/+A4WVibhqCHr0Ukwt7p/Ly

------=_Part_341182_25866685.1350656943404
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Dear Sir

find attached T/T copy of payment made to your account,
on behalf of our client kindly view for your reference.

Thanks
Mrs Chang Lee.

TT 90,000 usd.html 64K << Google Document Phishing scam.