[LINK] Telstra scam notice

[Richard Chirgwin]

Thanks - yep, right there in the header, a return address to a 
Netherlands domain.

RC

On 13/12/11 1:42 PM, Peter Bowditch wrote:
>
>> Marghanita -
>>
>> Are you able to copy the email headers to me?
> No sooner said than done:
>
> Received: from mail.ratbags.com by b9 for info at online.telstra.com.au
> 	(applied security profile: Medium) at Tue, 13 Dec 2011 12:10:57 +1000
> Return-path:<swol1894 at digital-adventures.nl>
> Envelope-to: peter at ratbags.com
> Delivery-date: Tue, 13 Dec 2011 09:45:42 +1100
> Received: from relay0.transip.nl ([80.69.67.21])
> 	by athena.instanthosting.com.au with esmtp (Exim 4.69)
> 	(envelope-from<swol1894 at digital-adventures.nl>)
> 	id 1RaEcs-0003g9-FY
> 	for peter at ratbags.com; Tue, 13 Dec 2011 09:45:38 +1100
> Received: from da-vrt001.digital-adventures.nl (da-vrt001.digital-
> adventures.nl [87.253.135.181])
> 	by relay0.transip.nl (Postfix) with ESMTP id B095E1040EB
> 	for<peter at ratbags.com>; Mon, 12 Dec 2011 23:45:34 +0100 (CET)
> Received: by da-vrt001.digital-adventures.nl (Postfix, from userid 693)
> 	id 356BA27941; Mon, 12 Dec 2011 23:45:36 +0100 (CET)
> To: peter at ratbags.com
> Subject: {Spam?} Service Cancellation Notice.
> From: Telstra Bill<info at online.telstra.com.au>
> Reply-To:
> Message-Id:<20111212224536.356BA27941 at da-vrt001.digital-adventures.nl>
> Date: Mon, 12 Dec 2011 23:45:36 +0100
> X-Instanthosting-MailScanner-Information: Please contact the ISP for more
> information
> X-Instanthosting-MailScanner-ID: 1RaEcs-0003g9-FY
> X-Instanthosting-MailScanner: Found to be clean
> X-Instanthosting-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
> 	score=3.151, required 3, BAYES_50 0.80, HTML_IMAGE_ONLY_24 1.62,
> 	HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.72, RCVD_IN_DNSWL_NONE -0.00,
> 	SPF_PASS -0.00, T_REMOTE_IMAGE 0.01)
> X-Instanthosting-MailScanner-SpamScore: sss
> X-Instanthosting-MailScanner-From: swol1894 at digital-adventures.nl
> MIME-Version: 1.0
> Content-Type: text/html
> Content-Transfer-Encoding: quoted-printable
> Content-Disposition: inline
> X-PMFLAGS: 34095744 0 65537 P6ABF5V4.CNM
>
> The big hint for me is that Telstra only know me as peter at gebesse.com.au
>
> The link behind the words "BY CLICKING HERE" is
> http://www.branxholmimperialhotel.com.au/resize/telstra.com.au/members/myac
> count/LANGUAGE/ECareServ/ID12549JDk23/Online%20Billing.htm
>
>> Cheers
>> Richard Chirgwin