Created
August 28, 2013 14:32
-
-
Save funkatron/6366668 to your computer and use it in GitHub Desktop.
Source of a really good phishing email I received. Screenshots: http://img.spz.im/g6VYo.png http://img.spz.im/yezPc.png
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Delivered-To: REDACTED | |
| Received: by 10.216.66.137 with SMTP id h9csp244750wed; | |
| Wed, 28 Aug 2013 07:25:59 -0700 (PDT) | |
| X-Received: by 10.68.236.168 with SMTP id uv8mr27888683pbc.124.1377699958214; | |
| Wed, 28 Aug 2013 07:25:58 -0700 (PDT) | |
| Return-Path: <REDACTED> | |
| Received: from mail-pd0-x234.google.com (mail-pd0-x234.google.com [2607:f8b0:400e:c02::234]) | |
| by mx.google.com with ESMTPS id zo4si20272538pbc.342.1969.12.31.16.00.00 | |
| (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); | |
| Wed, 28 Aug 2013 07:25:58 -0700 (PDT) | |
| Received-SPF: pass (google.com: domain of REDACTED designates 2607:f8b0:400e:c02::234 as permitted sender) client-ip=2607:f8b0:400e:c02::234; | |
| Authentication-Results: mx.google.com; | |
| spf=pass (google.com: domain of REDACTED designates 2607:f8b0:400e:c02::234 as permitted sender) smtp.mail=REDACTED; | |
| dmarc=fail (p=NONE dis=NONE) d=apple.com | |
| Received: by mail-pd0-x234.google.com with SMTP id y10so6358600pdj.11 | |
| for <funkREDACTED>; Wed, 28 Aug 2013 07:25:57 -0700 (PDT) | |
| X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; | |
| d=google.com; s=20120113; | |
| h=x-original-authentication-results:x-gm-message-state:delivered-to | |
| :to:subject:mime-version:content-type:from:message-id:date; | |
| bh=/h7BXJmzhyIgvl4r27nmQxOqqt53S7BhpScIKs2NT7s=; | |
| b=Bfv42lCVNSrpcfbCo374vyT0VF9y0m31Zj9PTtbYv3SowUHvkROuYzNRqgFMNdf76E | |
| zx1Fci6YMKSWa97M1xyye3TzvdtHDyV43wyF8291PTRp1XlcsbF6OZHu3s7CGSzCvqh5 | |
| uE0Vm9C1CtaPsog86l8WO5mC9vjTHOaSer5FPcSfqmZ3OlwrEzTScKka6PX4oBiQ9rs4 | |
| M8ySfEVEWjEsnXKgIcWaPBTDvL9VlePTJKme9NLg8HLmWsLTUO6SHWsFcY/sQc/zGQDw | |
| vU9bQ0piMMYuPgUcWnCgI7WsoA1F5CD+Op4MOQZZOC4wzNYLXJ0oR+sqWLHLXoD3OR7W | |
| SRDQ== | |
| X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of wichita@epica.websitewelcome.com designates 174.120.129.34 as permitted sender) smtp.mail=wichita@epica.websitewelcome.com; dmarc=fail (p=NONE dis=NONE) d=apple.com | |
| X-Gm-Message-State: ALoCoQmd9ZkuMjH85iSliG/+RxnP5v5Fb46+DR2900PhveWeIatNC63Y3K1gf2NnrdNDoahaP1Aw | |
| X-Received: by 10.68.36.38 with SMTP id n6mr28076999pbj.15.1377699957241; | |
| Wed, 28 Aug 2013 07:25:57 -0700 (PDT) | |
| X-Forwarded-To: funkREDACTED | |
| X-Forwarded-For: REDACTED funkREDACTED | |
| Delivered-To: REDACTED | |
| Received: by 10.70.45.35 with SMTP id j3csp106191pdm; | |
| Wed, 28 Aug 2013 07:25:56 -0700 (PDT) | |
| X-Received: by 10.182.205.194 with SMTP id li2mr6603882obc.97.1377699956169; | |
| Wed, 28 Aug 2013 07:25:56 -0700 (PDT) | |
| Return-Path: <wichita@epica.websitewelcome.com> | |
| Received: from epica.websitewelcome.com (epica.websitewelcome.com. [174.120.129.34]) | |
| by mx.google.com with ESMTPS id i3si8058896obz.146.1969.12.31.16.00.00 | |
| (version=TLSv1 cipher=RC4-SHA bits=128/128); | |
| Wed, 28 Aug 2013 07:25:56 -0700 (PDT) | |
| Received-SPF: pass (google.com: domain of wichita@epica.websitewelcome.com designates 174.120.129.34 as permitted sender) client-ip=174.120.129.34; | |
| Received: from wichita by epica.websitewelcome.com with local (Exim 4.80) | |
| (envelope-from <wichita@epica.websitewelcome.com>) | |
| id 1VEgh0-0008KN-P4 | |
| for REDACTED; Wed, 28 Aug 2013 09:25:54 -0500 | |
| To: REDACTED | |
| Subject: Warning! your apple ID has been frozen temporarily | |
| X-PHP-Script: 174.120.129.60/~wichita/css/index..php for 41.131.250.123 | |
| MIME-Version: 1.0 | |
| Content-type: text/html; charset=iso-8859-1 | |
| From: apple <no-reply@apple.com> | |
| Message-Id: <E1VEgh0-0008KN-P4@epica.websitewelcome.com> | |
| Date: Wed, 28 Aug 2013 09:25:54 -0500 | |
| X-AntiAbuse: This header was added to track abuse, please include it with any abuse report | |
| X-AntiAbuse: Primary Hostname - epica.websitewelcome.com | |
| X-AntiAbuse: Original Domain - funkatron.com | |
| X-AntiAbuse: Originator/Caller UID/GID - [3752 32003] / [47 12] | |
| X-AntiAbuse: Sender Address Domain - epica.websitewelcome.com | |
| X-BWhitelist: no | |
| X-Source: /usr/bin/php | |
| X-Source-Args: /usr/bin/php /home/wichita/public_html/css/index..php | |
| X-Source-Dir: walkintubwichitafalls.com:/public_html/css | |
| X-Source-Sender: | |
| X-Source-Auth: wichita | |
| X-Email-Count: 192 | |
| X-Source-Cap: d2ljaGl0YTt0aHJlZTYwO2VwaWNhLndlYnNpdGV3ZWxjb21lLmNvbQ== | |
| <table style="margin:0 auto" align="center" bgcolor="#ffffff" border="0" cellpadding="0" cellspacing="0" width="648"> | |
| <tbody><tr><td><img src="http://images.apple.com/dm/misc/notification1/top.gif" alt="" style="display:block;margin:0" border="0" height="122" width="648"></td></tr> | |
| </tbody></table> | |
| <table style="margin:0 auto;background-color:#f1f1f1" align="center" border="0" cellpadding="0" cellspacing="0" width="630"> | |
| <tbody><tr> | |
| <td> | |
| <table style="margin:0 auto;background-color:#f1f1f1;border-top:1px solid #cccccc" align="center" border="0" cellpadding="0" cellspacing="0" width="490"> | |
| <tbody><tr> | |
| <td style="padding:0 0 22px 0" align="left" width="490"> | |
| <div style="font-family:Lucida Grande,Lucida Sans,Lucida Sans Unicode,Arial,Helvetica,Verdana,sans-serif;color:#333333;font-size:12px;line-height:1.25em"><br><br> | |
| Hello,<br><br> | |
| We have noticed that you tried to login to your account from a restricted country Thats why our security system froze your account, we apologize for any inconvenience but you have to verify your identity by updating your information,<br><br>Please click on the following link to update your information: <a href="http://www.akaraart.net/404.html" style="color:#0088cc" target="_blank">appleid.apple.com</a>.<br><br>This is an automated message. Please do not reply to this email. If you need additional help, visit <a href="http://www.apple.com/support/appleid" style="color:#0088cc" target="_blank">Apple Support</a>.<br><br> | |
| Thanks,<br> | |
| Apple Customer Support<br> | |
| </div> | |
| </td> | |
| </tr> | |
| </tbody></table> | |
| </td> | |
| </tr> | |
| <tr><td style="padding-top:40px"><img src="http://images.apple.com/dm/misc/notification1/btm.gif" alt="" style="display:block;margin:0" border="0" height="21" width="630"></td></tr> | |
| </tbody></table> | |
| <table style="margin:0 auto" align="center" border="0" cellpadding="0" cellspacing="0" width="490"> | |
| <tbody><tr><td style="padding:20px 20px 10px 0"> | |
| <div style="font-family:Geneva,Verdana,Arial,Helvetica,sans-serif;font-size:9px;line-height:1.34em;color:#999999">TM and copyright © 2013 Apple Inc. 1 Infinite Loop, MS 96-DM, Cupertino, CA 95014.</div> | |
| <div style="font-family:Geneva,Verdana,Arial,Helvetica,sans-serif;font-size:9px;line-height:1.34em;color:#999999"> | |
| <a href="http://www.apple.com/legal/default.html" style="font-family:Geneva,Verdana,Arial,Helvetica,sans-serif;font-size:9px;line-height:1.34em;color:#999999;text-decoration:underline" target="_blank">All Rights Reserved</a> | |
| / <a href="http://www.apple.com/enews/subscribe/" style="font-family:Geneva,Verdana,Arial,Helvetica,sans-serif;font-size:9px;line-height:1.34em;color:#999999;text-decoration:underline" target="_blank">Keep Informed</a> | |
| / <a href="http://www.apple.com/legal/privacy" style="font-family:Geneva,Verdana,Arial,Helvetica,sans-serif;font-size:9px;line-height:1.34em;color:#999999;text-decoration:underline" target="_blank">Privacy Policy</a> | |
| / <a href="https://appleid.apple.com/en_US" style="font-family:Geneva,Verdana,Arial,Helvetica,sans-serif;font-size:9px;line-height:1.34em;color:#999999;text-decoration:underline" target="_blank">My Apple ID</a> | |
| </div> | |
| </td></tr> | |
| <tr><td><img src="http://insideapple.apple.com/img/APPLE_EMAIL_LINK/spacer4.gif?v=2&a=k%2BmjWPCFEH1m5ry2zndhAqYXs0S%2Fg9CTMi5bvFMsZL%2FSwqTQ8qCg8C55Qf9RrDWZFc6dI5f9VPzlO2T59N58qBEX15rGvBGgpEaEeUrXGko6Zm29bnMEVGJSRtNzQmwGM04ly1NB88louAPI2l%2Biernd8nb9tiBJ5nM8jWODevkoiP%2B3GyUOA%2FsYcwaGjflbxSd3hO%2F4FtxNBkpp1t%2FbQxina4j6pvDd3nC9nKv0SC9cD5OCWiYVEtGAaTby5slMO9lMeGgl42W%2FtEfAwr8IJNP5LCHMpcj7DJc84lITJPkts7zffSdKapz9YKc%2BrhJcepMhz8ynYxh3q3DhEbgHZfrTxbiqhkubJOq%2BozSaosrKWxP960KRRPxbCQLiiL%2FLCrwGqipeOMVmdhTRMlLcNg%3D%3D"></td></tr> | |
| </tbody></table> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment