[91attendees] Phishing on my IETF email address

Stephane Bortzmeyer <bortzmeyer+ietf@nic.fr> Sun, 09 November 2014 00:18 UTC

Return-Path: <bortzmeyer+ietf@nic.fr>
X-Original-To: 91attendees@ietfa.amsl.com
Delivered-To: 91attendees@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99A161A002C for <91attendees@ietfa.amsl.com>; Sat, 8 Nov 2014 16:18:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 2.314
X-Spam-Level: **
X-Spam-Status: No, score=2.314 tagged_above=-999 required=5 tests=[BAYES_50=0.8, URIBL_RHS_DOB=1.514] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X0jBS4OEim1Z for <91attendees@ietfa.amsl.com>; Sat, 8 Nov 2014 16:18:21 -0800 (PST)
Received: from mail.bortzmeyer.org (aetius.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fece:1902]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D061D1A0023 for <91attendees@ietf.org>; Sat, 8 Nov 2014 16:18:20 -0800 (PST)
Received: by mail.bortzmeyer.org (Postfix, from userid 10) id E1E103BBFB; Sun, 9 Nov 2014 01:18:18 +0100 (CET)
Received: by tyrion (Postfix, from userid 1000) id D23B1F00CDB; Sat, 8 Nov 2014 16:17:32 -0800 (PST)
Date: Sat, 8 Nov 2014 14:17:32 -1000
From: Stephane Bortzmeyer <bortzmeyer+ietf@nic.fr>
To: 91attendees@ietf.org
Message-ID: <20141109001732.GA24556@laperouse.bortzmeyer.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Transport: UUCP rules
X-Operating-System: Ubuntu 14.04 (trusty)
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: http://mailarchive.ietf.org/arch/msg/91attendees/kaSD1_Y4_ouhel38RFbY22j0wpI
Subject: [91attendees] Phishing on my IETF email address
X-BeenThere: 91attendees@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Mailing list of IETF 91 attendees that have opted in on this list." <91attendees.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/91attendees>, <mailto:91attendees-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/91attendees/>
List-Post: <mailto:91attendees@ietf.org>
List-Help: <mailto:91attendees-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/91attendees>, <mailto:91attendees-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Nov 2014 00:18:22 -0000

Funny, this address is used only for IETF matters and does not attract
a lot of spam/phishing. This phishing is better than most (spelling, credibility...):

Date: Sun, 09 Nov 2014 00:06:47 +0000 (UTC)
From: lTunes ID <app31419315@heroku.com>
To: bortzmeyer+ietf@nic.fr
Subject: Verify New....

( https://www.lTunes.com/au )
We need your help
-----------------
Dear Customer,

We need your help resolving an issue with your account. To give us time to work together on this. We've
+temporarily limited what you can do with your account until the issue is resolved.

We understand it may be frustrating not to have full access to your Apple  account. We want to work with you to
+get your account back to normal as quickly as possible.


What's the problem?
We need a little bit more information about you to help confirm your identity
Case ID Number: PP-001-487-280-335
Click To Confirm ( http://appworld.ru/volv/Updateto0/index/web/Login/ )

...