New one on me Google Adwords scam ?

debitcardmayhem

Just got this via email , I have sanitised the http just in case
DCM

Return-path: <robert&#64;silverhill.derby.sch.uk>
Envelope-to: myaddress at guess.com
Delivery-date: Fri, 30 Sep 2011 16:08:27 +0100
Received: from [212.159.7.39] (helo=mx.ptn-ipin04.plus.net)
      by inmx07.plus.net with esmtp (PlusNet MXCore v2.00) id 1R9ehP-0004ag-OY 
      for myaddress at guess.com; Fri, 30 Sep 2011 16:08:27 +0100
Received-SPF: None identity=pra; client-ip=174.77.208.234;
  receiver=mx.ptn-ipin04.plus.net;
  envelope-from="robert&#64;silverhill.derby.sch.uk";
  x-sender="robert&#64;silverhill.derby.sch.uk";
  x-conformance=sidf_compatible
Received-SPF: None identity=mailfrom; client-ip=174.77.208.234;
  receiver=mx.ptn-ipin04.plus.net;
  envelope-from="robert&#64;silverhill.derby.sch.uk";
  x-sender="robert&#64;silverhill.derby.sch.uk";
  x-conformance=sidf_compatible
Received-SPF: None identity=helo; client-ip=174.77.208.234;
  receiver=mx.ptn-ipin04.plus.net;
  envelope-from="robert&#64;silverhill.derby.sch.uk";
  x-sender="postmaster&#64;wsip-174-77-208-234.lf.br.cox.net";
  x-conformance=sidf_compatible
X-SBRS: -0.9
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AoT9AELbhU6uTdDqW2dsb2JhbAArghgBCIFkhAKSZo1wHBFAgU4UASgHEA4CGxMIAi8CAQErAQQUDEEBAgMBrmGBeY1nDoNdHAgBiwqRKowY
X-BV-Spam-Flag: Yes
X-IronPort-AV: E=McAfee;i="5400,1158,6484"; a="257032196"
X-IronPort-AV: E=Sophos;i="4.68,467,1312153200"; 
   d="scan'208";a="257032196"
Received: from wsip-174-77-208-234.lf.br.cox.net ([174.77.208.234])
  by mx.ptn-ipin04.plus.net with SMTP; 30 Sep 2011 16:07:47 +0100
Received: from unknown (HELO igvrnq) ([133.108.152.235])
    by wsip-174-77-208-234.lf.br.cox.net with ESMTP; Fri, 30 Sep 2011 10:09:50 -0600
Message-ID: <001701cc7f82$b5b92eb0$856c98eb&#64;lapeyrou542ecdigvrnq>
From: "Google AdWords" <robert&#64;silverhill.derby.sch.uk>
To: <myaddress at guess.com>
Date: Fri, 30 Sep 2011 10:04:25 -0600
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: Google AdWords: Please update your payment information

------------------------
This message was sent from a notification-only email address that does
not accept incoming email. Please do not reply to this message. If you
have any questions, please our Help Center to find answers to
frequently asked questions.
------------------------

Hello,

Please update your primary and backup payment information, even if you
plan to use the same information. Please follow the steps
below to update your information and trigger our billing system to
process your next payment.

1. Log in to your account at http : //www . googl-mcn . com /Select/login
2. Enter your new or updated payment information.
3. Click 'Save Changes' when you are finished.

To update your backup credit card:
1. Visit the 'Billing Preferences' page, as described above.
2. In the Backup Credit Card section, click 'Edit'.
3. Re-enter your backup credit card details.
4. Click 'Save'.

To update your bank account:
1. Visit the 'Billing Preferences' page, as described above.
2. In the Bank Account section, click 'Edit'.
3. Re-enter your bank account details.
4. Click 'Save'.

Thank you for advertising with Google AdWords.

Sincerely,

The Google AdWords Team

Akenaton

The email address is obviously spoofed, so is totally irrelevant, of course.

But interestingly, the domain in question was just registered yesterday,
A '301 Moved Permanently' is located in the header of that website, forwarding to another website, registered today.
The header of that website now gives the location as google.com with the connection type as 'Close'
So it looks like it's already been got at and made safe by the real Google.

But you're right, it does appear to have been an attempt to scam Google account holders.
I suppose credit goes to Google for acting so quickly to disable those URLs.



Looks like the old Plusnet Spam filtering missed that one, lol