I just received this phony phone bill.
The headers:
Return-Path:
Delivery-Date: Thu, 29 Mar 2012 13:03:44 -0400
Received: from [49.1.5.95] ([49.1.5.95])
by mx.perfora.net (node=mxus4) with ESMTP (Nemesis)
id 0MfW4p-1RuOAP2mmB-00Ol9C for jim@[deleted].com; Thu, 29 Mar 2012 13:03:43 -0400
Received: from [22.85.97.42] (helo=gtfklxzewgafhjy.vonqzc.info)
by with esmtpa (Exim 4.69)
(envelope-from )
id 1MMZVY-9609dr-XM
for jim@[deleted].com; Fri, 30 Mar 2012 02:03:22 +0900
Date: Fri, 30 Mar 2012 02:03:22 +0900
From: "AccountNotify@verizonwireless.com"
X-Mailer: The Bat! (v2.00.3) Business
X-Priority: 3 (Normal)
Message-id:
To:
Cc:
Subject: Your Bill Is Now Available
MIME-Version: 1.0
Content-type: text/html; charset=utf-8
Content-transfer-encoding: 7BIT
X-UI-Loop: V01:pILW6HkmhVk=:X1UBHVzCXXIFGVywaLKFLxFxUPVtVjr6po/UA9ld86k=
X-UI-Junk: AutoMaybeJunk +38 (SPA);
V01:N+iDzYdQ:uDpQViCX1EiaU0LIyFVa/q1a0vKoanjwaSq8hadHpeUQR/R3728
i5adGy/Qgat1hPoxePxWS4RSdEUkFnehwjWJdr9gEx4sxIKqA2ypV5kKHMWysK+e
oaOK6WiTC3AgaEO/zzN874V6ZFFyLc9wF/h6fV3vYk/rJXmNKGLHuWwTxbOCkicr
8gfDmCRSt7snVPAteUaYF8VqxdVbndgwZ4AhWNse/VlJzfLnFsye6CQ5ZLmjpqUH
c3ZskaH/Lt2CaOtgYtcayYWFJoj2VXO6bjSAyvKPM9FrBUmX1FSPdHJI=
Envelope-To: jim@[deleted].com
The embedded http links point to:
agricolasandonato.it/hnTkQu4T/index.html
fdu.com.ve/hnTkQu4T/index.html
www.floriculturakativa.com.br/WR7whto8/index.html
s180356263.onlinehome.us/y2yMPUY4/index.html
