Gmail Hacked

Mr_Oink

I'd be very keen to see a sample of the offending sent mail if any of your contacts still have it.

Firefly

Mr_Oink wrote: »

I'd be very keen to see a sample of the offending sent mail if any of your contacts still have it.

Hello,
How you doing? i made a trip to Scotland unannounced some days back,Unfortunately i got mugged at gun point last night! All cash, Credit card and phone were stolen,i got messed up in another country, stranded in Scotland, fortunately passport was back in my hotel room.It was a bitter experience and i was hurt on my right hand, but would be fine.I am sending you this message because i don't want anyone to panic,i want you to keep it that way for now!

I need to leave here in few hours from now but I’m having troubles sorting out the hotel bills, wondering if you could loan me some money to sort out the hotel bills and also take a cab to the airport about 650 pounds. I have been to the police and embassy here, but they aren't helping issues, I have limited means of getting out of here,we canceled our cards already and made a police report, I won’t get a new card number till I get back home! So I really need your help... you can have it wired to my name via Western Union I'll have to show my passport as ID to pick it up here..
You could wire the money to my name and hotel address via Western union:
FireflyXXXXX {changed]
ADDRESS:18 Pulteney St, Ross-Shire, Highland IV26 2UP Scotland
Get back to me with the western union details which includes MTCN# and sender's name to pick up the money, would definitely refund it to you once i arrive! Hopefully tomorrow.
I await your prompt response.

Mr_Oink

Thanks for that. Really I would need to see the full headers, in particular the originator. I appreciate you may not want to post that here, but if you to munge the identifiable parts and paste the source of the message to http://pastebin.com/ your efforts won't be wasted. While Google may not move on it, it would be useful to identify the posting IP from the X-Originator type header. I've passed this body over to some of the guys that write spam and virus signatures and thank you for taking the time to paste it here.

Firefly

Mr_Oink wrote: »

Thanks for that. Really I would need to see the full headers, in particular the originator. I appreciate you may not want to post that here, but if you to munge the identifiable parts and paste the source of the message to http://pastebin.com/ your efforts won't be wasted. While Google may not move on it, it would be useful to identify the posting IP from the X-Originator type header. I've passed this body over to some of the guys that write spam and virus signatures and thank you for taking the time to paste it here.

I'm not quite sure what bit you want; as I said before my IT skills are not on the techie scale to say the least. I can't even find a way to pm you! However, pm me your email address and I'll forward the whole message to you. It looks to me like it came from my email and is of course in my sent items.

Mr_Oink

No problem - I've passed the body onto the great guys at Sanesecurity.