Monday, March 24, 2014

An Interesting Email from an Imposter Source 

x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensydyekesGC2M=
Authentication-Results: hotmail.com; spf=none (sender IP is 212.54.34.165) smtp.mailfrom=notification-id@applestore.com; dkim=none header.d=applestore.com; x-hmca=none header.id=notification-id@applestore.com
X-SID-PRA: notification-id@applestore.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vTXhm8qeK2K5cMGgcxJU15jOm/pz3kHHa2cZu39/8f/cmkojhBUue+JvYxM/6M8MkDW6k57Jn1pphEuPE01cIBr7urntiHVzfaeZVaYq2lK2EAQmKjOfueUgBQG+cgROkPxrCpCtJapGp3Xuyh5l7J+W/4PoZTy6UAZR32meJ+onJR11LXtyPCdJOGilzrysIPcWxI7BrBlF8TkQjrTfF6R
Received: from smtpq2.gn.mail.iss.as9143.net ([212.54.34.165]) by SNT0-MC4-F46.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
  Mon, 24 Mar 2014 07:52:51 -0700
Received: from [212.54.34.137] (helo=smtp6.gn.mail.iss.as9143.net)
 by smtpq2.gn.mail.iss.as9143.net with esmtp (Exim 4.71)
 (envelope-from <notification-id@applestore.com>)
 id 1WS6F8-0004sz-E8
 for forwood@live.ca; Mon, 24 Mar 2014 15:52:50 +0100
Received: from 53553044.cm-6-6a.dynamic.ziggo.nl ([83.85.48.68] helo=GP1)
 by smtp6.gn.mail.iss.as9143.net with esmtp (Exim 4.71)
 (envelope-from <notification-id@applestore.com>)
 id 1WS6EL-0005df-EB
 for forwood@live.ca; Mon, 24 Mar 2014 15:52:01 +0100
From: "Canada Revenue" <notification-id@applestore.com>
Subject: Message sent to forwood@live.ca
To: forwood@live.ca
Content-Type: multipart/alternative; boundary="35OH22GMtR7STT=_PRNl1b9uzdre0yL6BB0"
MIME-Version: 1.0
Date: Mon, 24 Mar 2014 10:51:14 -0400
X-Ziggo-spambar: ---
X-Ziggo-spamscore: -3.2
X-Ziggo-spamreport: ALL_TRUSTED=-1,BAYES_00=-1.9,CHW1252=0.01,DYN_RDNS_SHORT_HELO_HTML=0.001,FSL_HELO_NON_FQDN_1=0.001,HELO_NO_DOMAIN=1.194,HTML_MESSAGE=0.001,MISSING_MID=0.497,PROLO_TRUST_RDNS=-3,RDNS_DYNAMIC=0.982
X-Ziggo-Spam-Status: No
X-Spam-Status: No
X-Spam-Flag: No
Return-Path: notification-id@applestore.com
Message-ID: <SNT0-MC4-F46lrIcKh8006d3c98@SNT0-MC4-F46.Snt0.hotmail.com>
X-OriginalArrivalTime: 24 Mar 2014 14:52:51.0295 (UTC) FILETIME=[BACD26F0:01CF4770]

This is a multi-part message in MIME format

--35OH22GMtR7STT=_PRNl1b9uzdre0yL6BB0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

 - This mail is in HTML. Some elements may be ommited in plain text. -

New Page 1
Dear Taxpayer,
After the last annual calculation of your fiscal activity we have dete=
rmined that you are eligible to receive a tax refund of : $521.51
Regarding this, please complete the Refund Form and mail it to one of =
the addresses from the second page.
&gt;&gt; Your *Refund Reference Number is: Ref/12213/2013 &lt;&lt;
*Refund Amount : 521.51 $.
To access the form for your tax refund, please
Click Here
NOTE!
For security reasons, remove the form from your computer after printing.
Thank you,
Canada Revenue Agency

--35OH22GMtR7STT=_PRNl1b9uzdre0yL6BB0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD><TITLE>New Page 1</TITLE>
<META http-equiv=3DContent-Language content=3Den-us>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dwindow=
s-1252"></HEAD>
<BODY>
<P>Dear Taxpayer,</P>
<P>After the last annual calculation of your fiscal activity we have d=
etermined that you are eligible to receive a tax refund of : $521.51<B=
R>Regarding this, please complete the Refund Form and mail it to one o=
f the addresses from the second page.<BR>&gt;&gt; Your *Refund Referen=
ce Number is: Ref/12213/2013 &lt;&lt;<BR>*Refund Amount : 521.51 $.</P>
<P>To access the form for your tax refund, please <A href=3D"http://ho=
nest007.com/webcalendar/includes/tools/index.php">Click Here</A></P>
<P>NOTE!<BR>For security reasons, remove the form from your computer a=
fter printing.</P>
<P>Thank you,<BR>Canada Revenue Agency</P></BODY></HTML>

--35OH22GMtR7STT=_PRNl1b9uzdre0yL6BB0--
Posted by at

1 comment:

  1. Anthony ForwoodMarch 24, 2014 at 1:39 PM

    I traced the sender address (notification-id@applestore.com) and found out that it's a scam.

    http://omgili.com/thread/.wHSUbtEfZR2zMstuG9ttOyIrTMUXtc32v_hVxoxe4doTdjaEFsuQXju0pZ_3fkJ9LkPJ__WmeU.oE8w0yu8_w--/

    ReplyDelete

Subscribe to: Post Comments (Atom)