Phishing Mail!

[Thuglife]

Dear: tellas.gr Users,

We are currently carrying-out a maintenance process to your tellas.gr account. To complete this process you must reply to this email immediately by entering your User Name here (*********),and password here (*********) if you are the rightful owner of this account.

This process we help us to fight against spam mails.Failure to summit your password will render your email address in-active from our database.

You can also confirm your email address by logging into your account at:http://webmail.tellas.gr/

NOTE: You will be send a password reset message in next seven (7) working days after undergoing this process for security reasons.

Thank you for using tellas.gr!

TELLAS.GR SUPPORT TEAM.

Email header:

Spoiler:

Return-Path: <support-team@tellas.gr>
Received: from memova1.tellas.gr (62.169.194.60) by besscrpm1.evergy.local (7.3.117)
id 482858C100895177; Fri, 25 Jul 2008 17:03:37 +0300
Received: from persefone.opengate.com.br (201.47.175.144) by memova1.tellas.gr (7.3.118.8)
id 487E1A2E00E8A334; Fri, 25 Jul 2008 16:03:36 +0200
Received: by persefone.opengate.com.br (Postfix, from userid 1005)
id 1B214399DE; Fri, 25 Jul 2008 10:52:03 -0300 (BRT)
Received: from webmail.aneor.com.br (localhost.com.br [127.0.0.1])
by persefone.opengate.com.br (Postfix) with ESMTP id E4D54399D0;
Fri, 25 Jul 2008 10:52:01 -0300 (BRT)
Received: from 213.185.118.199
(SquirrelMail authenticated user aneorrj@aneor.com.br)
by webmail.aneor.com.br with HTTP;
Fri, 25 Jul 2008 13:52:02 -0000 (UTC)
Message-ID: <1337.213.185.118.199.1216993922.squirrel@webmail.aneor.com.br>
Date: Fri, 25 Jul 2008 13:52:02 -0000 (UTC)
Subject: Confirm Your E-mail Address
From: "TELLAS.GR SUPPORT TEAM" <support-team@tellas.gr>
Reply-To: support-team001@live.com
User-Agent: SquirrelMail/1.4.4
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
To: undisclosed-recipients:;

Προσοχή μην την πατήσει κανείς, μήπως μπάζει απο πουθενά η Tellas και έχουνε σηκώσει όλα τα usernames? Το πήρε κανείς άλλος?

[villasg]

Στειλε το ΑΜΕΣΑ και στη τελλας να παρουν τα μετρα τους

[crypter]

This process we help us to fight against spam mails.Failure to summit your password will render your email address in-active from our database.

τι λενε ωρε; τι δικαιολογια ειναι αυτη; στελνουν σπαμ για να καταπολεμησουν το σπαμ;

[dhatz]

Δεν το πιστεύω ότι ο mail server της TELLAS δεν κάνει reject μήνυμα στο οποίο άσχετος τρίτος server, (εν προκειμένω στην Βραζιλία persefone.opengate.com.br 201.47.175.144), τους στέλνει μήνυμα με δικό τους From address στον header (άρα προφανώς spoofed). Αδικαιολόγητοι...

Αυτά είναι στο mail server setup 101.

Τουλάχιστον στα μαζικά phishing scams (υποτίθεται από ΕΤΕ, ALPHA Bank κλπ) πριν μερικά χρόνια, το From field ήταν κάποιου τρίτου που επιπλέον τότε δεν είχε SPF...