Of course, it also had a link to a "PDF" file. Why do I put that in quotes? Because when I hovered my mouse over it, the link actually showed me that it went to some other website. Look at the picture to see the website. DO NOT go to the website.
I REPEAT THIS EMAIL IS SPAM AND A VIRUS. DO NOT FOLLOW ANY LINKS IF YOU RECEIVE A SIMILAR EMAIL.
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPPMCxtNr1B1L9kNdqr-dOk6NkYucPk5P1eofVofT9WUKQQyDDcY33hTdZbhrV4dZQghbSh0r92Rz_kTl59GPBWdzgZ6YTYaLlm6Lv4WBOUofsvQUN99BwVmkuNH0KTOEGlT0bh0aBlBk5/s400/irsvirus.png)
The HEADER
As a side note, I have no idea how it passed the Barracuda spam filter. The email says it is from Pam_Delany @irs .gov but the message-id is from 5624897102.4PPR0IZP169555 @ bwhsagtmxa.foczytgll.ru (Note the .ru TLD, that's Russia)
and the envelope from field is from helpfullyj @ pado.com.br (Brazil) The message passed through galati.astral.ro which is Romania.
No comments:
Post a Comment