Reference no: EM13528
Phising email
* It is multipart, what are the two parts?
* The HTML part, is it inviting the recepient to click somewhere?
* What is the email proporting to do when the link is clicked?
* Where will the browser actually go, when the link is clicked?
* From whom does the email proport to come from, and by what (at least) two ways does it say this?
* According to the headers, where does the email actually come from?
Format of Email
Return-Path: <[email protected]>
Received: from ironport.newpaltz.edu (ironport.newpaltz.edu [137.140.1.118])
by phantom.math.xxxx.edu (8.14.4/8.14.4) with ESMTP id r2KC7sZo057346;
Wed, 20 Mar 2013 08:07:54 -0400 (EDT)
(envelope-from [email protected])
X-Spam-Flag: YES
Received: from zmail.newpaltz.edu ([137.140.1.112])
by ironportout.newpaltz.edu with ESMTP; 20 Mar 2013 08:07:49 -0400
Received: from localhost (localhost.localdomain [127.0.0.1])
by zmail.newpaltz.edu (Postfix) with ESMTP id DB03C10DC00B;
Wed, 20 Mar 2013 08:07:47 -0400 (EDT)
X-Virus-Scanned: amavisd-new at zmail.newpaltz.edu
Received: from zmail.newpaltz.edu ([127.0.0.1])
bylocalhost (zmail.newpaltz.edu [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id jcghw0+YylvM; Wed, 20 Mar 2013 08:07:47 -0400 (EDT)
Received: from Unknown (unknown [213.123.123.13])
by zmail.newpaltz.edu (Postfix) with ESMTPSA id 9D99D10D400B;
Wed, 20 Mar 2013 08:02:29 -0400 (EDT)
Message-ID: <B81EF58EFA444973823E1A9399194842@bjrrebr>
From: "University of xxxx" <[email protected]>
Subject: Notice From University of xxxx
Date: Wed, 20 Mar 2013 08:33:40 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary="----=_20130324204259_94270"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
To: undisclosed-recipients:;
X-Math-Scanned: Phantom Zone Evaluation
------=_20130324204259_94270
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
---------------------------- Original Message ----------------------------
Subject: Notice From University of xxxx
From: "University of xxxx" <[email protected]>
Date: Wed, March 20, 2013 8:33 am
To: undisclosed-recipients:;
--------------------------------------------------------------------------
Dear User,
Your e-mail will expire soon.
For security reasons, please use our website below to update your personal
information.
https://www.xxxx.edu/
University of xxxx
------=_20130324204259_94270
Content-Type: text/html; name="untitled-[2].html"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="untitled-[2].html"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 6.00.6000.16674">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV id=yui_3_7_2_1_1363110797648_17022>
<DIV id=yiv1193796572yui_3_7_2_1_1363110797648_3280>
<DIV id=yiv1193796572>
<DIV id=yiv1193796572yui_3_7_2_1_1363110797648_2688>
<DIV id=yiv1193796572yui_3_7_2_1_1362975386038_2725>
<DIV id=yiv1193796572yui_3_7_2_1_1362975386038_2724 align=left><FONT
id=yiv1193796572yui_3_7_2_1_1362975386038_2723 size=2 face=Arial>
<DIV id=yiv1193796572yui_3_7_2_1_1362975386038_4825><FONT
style="FONT-SIZE: 10pt" id=yiv1193796572yui_3_7_2_1_1362975386038_4829
color=#808080 face=Arial>Dear User, <BR><BR>Your e-mail will expire
soon.</FONT></DIV>
<DIV id=yiv1193796572yui_3_7_2_1_1362975386038_4824> </DIV><FONT size=2
face=Verdana>
<DIV></DIV></FONT><FONT id=yiv1193796572yui_3_7_2_1_1362975386038_2722
face=Arial>
<DIV style="MIN-HEIGHT: 16px; WIDTH: 842px"
id=yiv1193796572yui_3_7_2_1_1362975386038_4823><FONT
id=yiv1193796572yui_3_7_2_1_1362975386038_4822 color=#808080><SPAN
style="FONT-SIZE: 10pt" id=yiv1193796572yui_3_7_2_1_1362975386038_4821>For
security reasons, please use our website below to update your personal
information.</SPAN></FONT></DIV>
<DIV id=yiv1193796572yui_3_7_2_1_1362975386038_2721><SPAN
style="FONT-SIZE: 10pt" id=yiv1193796572yui_3_7_2_1_1362975386038_2762><FONT
color=#808080><BR></FONT><FONT id=yiv1193796572yui_3_7_2_1_1363110797648_3494
color=#808080><A id=yiv1193796572yui_3_7_2_1_1363110797648_3493
href="https://users.atw.hu/pltest/images/css.php" rel=nofollow
target=_blank><SPAN id=yiv1193796572lw_1363136150_0
class=yiv1193796572yshortcuts>https://www.xxxx.edu/</SPAN></A></FONT><FONT
id=yiv1193796572yui_3_7_2_1_1362975386038_2788 color=#808080><BR><BR><SPAN
id=yiv1193796572lw_1362982925_1 class=yiv1193796572yshortcuts><SPAN
id=yiv1193796572lw_1363134212_0 class=yiv1193796572yshortcuts><SPAN
id=lw_1363138633_0 class=yshortcuts>University of
xxxx</SPAN></SPAN></SPAN></FONT></SPAN></DIV></FONT></FONT></DIV></DIV></DIV></DIV></DIV></DIV></BODY></HTML>
------=_20130324204259_94270--