FYI
Phishing attempt.
Notice the real domain name (mmsu.us).
http://mmsu.us/huron.chemistry.msu.edu/owa/auth/logon662a6ek.html
-AH
> ________________________________________
>
> Return-path: <[log in to unmask]>
> Envelope-to: [log in to unmask]
> Delivery-date: Mon, 03 Oct 2011 02:52:42 -0400
> Received: from baghdad.ucc.usyd.edu.au ([129.78.64.146])
> by mx60.mail.msu.edu with esmtp (Exim 4.75 #3)
> id 1RAcNb-00028x-2o; Mon, 03 Oct 2011 02:52:00 -0400
> Received: from baghdad.ucc.usyd.edu.au (localhost [127.0.0.1])
> by localhost (Postfix) with SMTP id C736C10482C;
> Mon, 3 Oct 2011 17:51:56 +1100 (EST)
> Received: from wmfe3.ucc.usyd.edu.au (wmfe3.ucc.usyd.edu.au [129.78.64.77])
> by baghdad.ucc.usyd.edu.au (Postfix) with ESMTP id 1A7F8103EE8;
> Mon, 3 Oct 2011 17:51:55 +1100 (EST)
> Received: from 40-66-73-109.rackcentre.redstation.net.uk
> (40-66-73-109.rackcentre.redstation.net.uk [109.73.66.40]) by
> www-mail.usyd.edu.au (Horde Framework) with HTTP; Mon, 03 Oct 2011 17:51:56
> +1100
> Message-ID: <[log in to unmask]>
> Date: Mon, 03 Oct 2011 17:51:56 +1100
> From: Michigan State University Information Technology
> <[log in to unmask]>
> Reply-to: [log in to unmask]
> To: undisclosed-recipients:;
> Subject: Important Notice! Your Michigan State University
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="=_2mrtrs2ii084"
> Content-Transfer-Encoding: 7bit
> User-Agent: Internet Messaging Program (IMP) 4.3.3
> X-Virus: None found by Clam AV
> X-Spam-Level: -
> X-Spam-Report: All incoming messages to mail.msu.edu are analyzed for typical spam
> characteristics. See http://techbase.msu.edu/article.asp?id=11475 for
> additional report information.
>
> Content preview: Please click HERE[1] to access your MSU ITS Exchange Service
> account. You must complete the migration steps through the login before your
> MSU ITS Exchange Service account will be fully available. Links: ------ [1]
> http://mmsu.us/huron.chemistry.msu.edu/owa/auth/logon662a6ek.html [...]
>
> Content analysis details: (-1.1 points, 5.0 required)
>
> pts rule name description
> ---- ---------------------- --------------------------------------------------
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (helpdsk[at]consultant.com)
> -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium
> trust
> [129.78.64.146 listed in list.dnswl.org]
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 1.2 SARE_UNA RAW: SARE_UNA
> 0.0 T_TO_NO_BRKTS_FREEMAIL To: misformatted and free email service
> X-Spam-Score: -1.1
>
> This message is in MIME format.
>
> --=_2mrtrs2ii084
> Content-Type: text/plain;
> charset=ISO-8859-1
> Content-Description: Plaintext Version of Message
> Content-Disposition: inline
> Content-Transfer-Encoding: 7bit
>
>
>
> Please click HERE[1] to access your MSU ITS Exchange Service account.
> You must complete the migration steps through the login
> before your MSU ITS Exchange Service account will be fully available.
>
> Links:
> ------
> [1] http://mmsu.us/huron.chemistry.msu.edu/owa/auth/logon662a6ek.html
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
> --=_2mrtrs2ii084
> Content-Type: text/html;
> charset=ISO-8859-1
> Content-Description: HTML Version of Message
> Content-Disposition: inline
> Content-Transfer-Encoding: 7bit
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
> "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
> <html xmlns="http://www.w3.org/1999/xhtml">
> <head>
> <title></title>
> </head>
> <body>
> <p class="imp-signature" style="margin: auto 0in">
> <span style="font-family:" font-size:="">Please click <a href="http://mmsu.us/huron.chemistry.msu.edu/owa/auth/logon662a6ek.html">HERE</a> to access your MSU ITS Exchange Service account.<br />
> You must complete the migration steps through the login<br />
> before your MSU ITS Exchange Service account will be fully available. </span>
> </p>
> <p>
> <br />
> <br />
> ----------------------------------------------------------------<br />
> This message was sent using IMP, the Internet Messaging Program.<br />
> </p>
> </body>
>
> </html>
> --=_2mrtrs2ii084--
|