Hello All,
Please be aware of this Air canada spam message circulating around the internet
Type of message : Phising
Senders IP : 217.73.236.9
Location of IP 217.73.236.9 located in Italy
Link in email points to http://absabeauty.com/wordpress/pdf_ticket_copy.zip
When a user clicks on the link malware is installed on the host computer
Begin of email text
Dear Customer,
Your credit card has been successfully processed.
FLIGHT NUMBER ET62082CA
ELECTRONIC 63916372
DATE & TIME / FEB 20, 2013, 08:15 AM
ARRIVING / TORONTO
TOTAL PRICE / CAD 419.33
Please download and print your ticket from the following URL :
For more information regarding your order, contact us by visiting : http://www.aircanada.com/en/customercare/index.html
Thank you
America Airlines.
See below for the full message headers
Delivered-To:
Received: by 10.58.212.169 with SMTP id nl9csp5253vec;
Wed, 20 Feb 2013 15:55:20 -0800 (PST)
X-Received: by 10.14.173.67 with SMTP id u43mr74530413eel.22.1361404519863;
Wed, 20 Feb 2013 15:55:19 -0800 (PST)
Return-Path:
Received: from mail.plesk-win9.test-area.it (plesk-win9.tol.it. [217.73.236.90])
by mx.google.com with ESMTP id i43si49415012eem.66.2013.02.20.15.55.19;
Wed, 20 Feb 2013 15:55:19 -0800 (PST)
Received-SPF: neutral (google.com: 217.73.236.90 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=217.73.236.90;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 217.73.236.90 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Message-Id: <[email protected]>
Received: from plesk-win9 ([127.0.0.1]) by plesk-win9.test-area.it with MailEnable ESMTP; Thu, 21 Feb 2013 00:55:20 +0100
Date: Thu, 21 Feb 2013 00:55:20 0100
Subject: Your Order#63916372 – APPROVED
To:
From: Air Canada
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit