Bitcoin Forum
December 10, 2016, 01:16:34 AM *
News: Latest stable version of Bitcoin Core: 0.13.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: Just got this E-mail from OKPAY, I think it's phishing  (Read 1493 times)
Remember remember the 5th of November
Legendary
*
Offline Offline

Activity: 1526

Reverse engineer from time to time


View Profile
April 13, 2012, 10:18:19 PM
 #1

Quote
Dear partners,

Due to legal issues OKPay will close all operations by May 1. 2012.

Please use this time to withdraw your available balance.

Sincerely yours,
Konstantin Romanovsky
OKPay CEO
http://www. okpay .com
r z e

What do you think? I've never registered to this site, but I got the mail.

Headers
Quote
                                                                                                                                                                                                                                                               
Delivered-To: xxxxxxx
Received: by 10.112.27.135 with SMTP id t7csp15106lbg;
        Fri, 13 Apr 2012 09:02:51 -0700 (PDT)
Received: by 10.204.156.12 with SMTP id u12mr691269bkw.33.1334332970837;
        Fri, 13 Apr 2012 09:02:50 -0700 (PDT)
Return-Path: <support@okpay.com>
Received: from 173.194.69.27 (cairo.perfect-privacy.com. [41.215.241.234])
        by mx.google.com with SMTP id t8si3645873bkd.28.2012.04.13.09.02.48;
        Fri, 13 Apr 2012 09:02:50 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning support@okpay.com does not designate 41.215.241.234 as permitted sender) client-ip=41.215.241.234;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning support@okpay.com does not designate 41.215.241.234 as permitted sender) smtp.mail=support@okpay.com
Received: from 112.2.44.70 by ; Fri, 13 Apr 2012 19:55:47 +0300
Message-ID: <RPOFLGCWBXOHPJYIWJGKZ@msn.com>
From: "OKPAY" <support@okpay.com>
Reply-To: "OKPAY" <support@okpay.com>
To: xxxx, xxxx
Subject: OKPAY Closing
Date: Fri, 13 Apr 2012 15:01:47 -0200
X-Mailer: AOL 7.0 for Windows US sub 118
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary="--15733187150045582"
X-Priority: 3
X-MSMail-Priority: Normal

----15733187150045582
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable

BTC:1AiCRMxgf1ptVQwx6hDuKMu4f7F27QmJC2
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481332594
Hero Member
*
Offline Offline

Posts: 1481332594

View Profile Personal Message (Offline)

Ignore
1481332594
Reply with quote  #2

1481332594
Report to moderator
Red Emerald
Hero Member
*****
Offline Offline

Activity: 742



View Profile WWW
April 13, 2012, 10:20:28 PM
 #2

Quote
Dear partners,

Due to legal issues OKPay will close all operations by May 1. 2012.

Please use this time to withdraw your available balance.

Sincerely yours,
Konstantin Romanovsky
OKPay CEO
http://www. okpay .com
r z e

What do you think? I've never registered to this site, but I got the mail.
I got the same email, and it had some where "to" fields to some AOL emails. I didn't really bother inspecting the headers, but they are probably faked.

Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
April 13, 2012, 10:43:22 PM
 #3

Yup, someone hates OKPay for whatever reason and is sending out messages to the list of e-mail addresses that was obtained last June when Mt. Gox got hacked.

Here's a prior spam campaign, possibly by the same perpetrator:
 - https://bitcointalk.org/index.php?topic=76270.0

Red Emerald
Hero Member
*****
Offline Offline

Activity: 742



View Profile WWW
April 13, 2012, 11:22:40 PM
 #4

cairo.perfect-privacy.com sure sounds legit lol

apetersson
Hero Member
*****
Offline Offline

Activity: 666


mycelium.com


View Profile WWW
April 14, 2012, 09:28:03 AM
 #5

excerpt from my headers:
Quote
X-Spam-Status: Yes, score=17.6 required=4.0
X-Spam-Report:
   *  0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
   *      [41.215.241.234 listed in zen.spamhaus.org]
   *  1.4 FSL_HELO_BARE_IP_1 FSL_HELO_BARE_IP_1
   *  0.3 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
   *  1.4 MSGID_YAHOO_CAPS Message-ID has ALLCAPS@yahoo.com
   *  2.0 MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant)
   *  1.5 TVD_RCVD_IP4 TVD_RCVD_IP4
   *  0.1 TVD_RCVD_IP TVD_RCVD_IP
   *  1.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
   *  0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
   *  0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
   *  0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this
   *  2.2 FORGED_MSGID_YAHOO Message-ID is forged, (yahoo.com)
   *  1.0 TWO_IPS_RCVD Received: Relay identifies itself as wrong IP
   *  1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
   *  2.5 FORGED_MUA_EUDORA Forged mail pretending to be from Eudora

this is about the worst possible spam-score. pretty weak attempt.
rjk
Sr. Member
****
Offline Offline

Activity: 420


1ngldh


View Profile
April 14, 2012, 01:25:12 PM
 #6

excerpt from my headers:
Quote
X-Spam-Status: Yes, score=17.6 required=4.0
X-Spam-Report:
   *  0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
   *      [41.215.241.234 listed in zen.spamhaus.org]
   *  1.4 FSL_HELO_BARE_IP_1 FSL_HELO_BARE_IP_1
   *  0.3 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
   *  1.4 MSGID_YAHOO_CAPS Message-ID has ALLCAPS@yahoo.com
   *  2.0 MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant)
   *  1.5 TVD_RCVD_IP4 TVD_RCVD_IP4
   *  0.1 TVD_RCVD_IP TVD_RCVD_IP
   *  1.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
   *  0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
   *  0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
   *  0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this
   *  2.2 FORGED_MSGID_YAHOO Message-ID is forged, (yahoo.com)
   *  1.0 TWO_IPS_RCVD Received: Relay identifies itself as wrong IP
   *  1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
   *  2.5 FORGED_MUA_EUDORA Forged mail pretending to be from Eudora

this is about the worst possible spam-score. pretty weak attempt.
Which spam classification tool is giving you those headers? It looks fairly intelligent.

Mining Rig Extraordinaire - the Trenton BPX6806 18-slot PCIe backplane [PICS] Dead project is dead, all hail the coming of the mighty ASIC!
apetersson
Hero Member
*****
Offline Offline

Activity: 666


mycelium.com


View Profile WWW
April 14, 2012, 01:47:57 PM
 #7

SpamAssasin
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!