Fake PG&E email

by **HillBilly** » Mon Jan 13, 2014 4:23 pm

[XXXXXX]If you have a Pacific Gas & Electric account, this email just might take money from your account and into the hands of criminals....[/size] Don't ever click on links in emails, use your bookmarks instead, or a reliable search engine provided you have up to date anti-virus and malware protection on your PC.

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=none (sender IP is 91.206.148.160) smtp.mailfrom=robot@deltatelekom.ru; dkim=none header.d=boevoe-bratstvo-astrakhan.ru; x-hmca=none header.id=do_not_reply@boevoe-bratstvo-astrakhan.ru
X-SID-PRA: do_not_reply@boevoe-bratstvo-astrakhan.ru
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: M98loaK0Lo27IVRxloyPIRbTfDbJj5wgwn+8skf38d94Sz91L0zMEGhbngqCNnKEHZBmVBhO7aoyJGVXYwjCwb3BAdrDXLF8lKMhNPW81dYNiJ6OPntoaPmVQx0M9PQsEmyWSbxKxyfIA7WkIvGCOw4kgmq+LPGH4tN/YPNZG5mYfYyKE1f44nM3ONvPF/Xd+v0FHVqHswjMkW2C41sUBsMC7qZG3bmB
Received: from mail.deltatelekom.ru ([91.206.148.160]) by COL0-MC4-F4.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Mon, 13 Jan 2014 07:05:42 -0800
Received: by mail.deltatelekom.ru (Postfix, from userid 528)
id 319A8127F223; Mon, 13 Jan 2014 19:05:39 +0400 (MSK)
To: xxx
Subject: Energy Statement
From: "PG&E" <do_not_reply@boevoe-bratstvo-astrakhan.ru>
X-Mailer: AOL9.0forWindowsUSsub541
Reply-To: "PG&E" <do_not_reply@boevoe-bratstvo-astrakhan.ru>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------138962554052D400C42F6BF"
Message-Id: <20140113150540.319A8127F223@mail.deltatelekom.ru>
Date: Mon, 13 Jan 2014 19:05:40 +0400 (MSK)
Return-Path: robot@deltatelekom.ru
X-OriginalArrivalTime: 13 Jan 2014 15:05:42.0991 (UTC) FILETIME=[EDDA1DF0:01CF1070]

------------138962554052D400C42F6BF
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

PG
&
E
ENERGY STATEMENT

Account No: 298767402-5
Statement Date: 01/10/2014
Due Date: 02/01/2014

 

Your Account Summary
Amount Due on Previous Statement
Payment(s) Recieved Since Last Statement
Previous Unpaid Balance
Current Electric Charges
Current Gas Charges

 
$344.70
0.0
$344.70
$165.80
49.20

To view your most recent statement, please

click here

You must log-in to your account or register for an online account to
view your statement.

Total Amount Due BY 02/01/2014 $559.7

------------138962554052D400C42F6BF
Content-Type: text/html; charset="ISO-8859-1";
Content-Transfer-Encoding: 7bit

<html>
<body>
<table border="0" width="861" height="344"
style="border-collapse: collapse;font-family:Arial">
<tr>
<td height="56" width="337" bgcolor="#E7F6FD" colspan="2">


>>>">PG
&
>>>">E
ENERGY STATEMENT


</td>
<td height="56" width="77" bgcolor="#E7F6FD"></td>
<td height="56" width="259" bgcolor="#E7F6FD"></td>
<td height="56" width="182" bgcolor="#E7F6FD">
Account No: 298767402-5 
Statement Date: 01/10/2014 
Due Date: 02/01/2014
</td>
</tr>
<tr>
<td colspan="5" height="32" width="416"> </td>
</tr>
<tr>
<td height="172" width="337" colspan="2" rowspan="2">
Your Account Summary 
Amount Due on Previous Statement 
Payment(s) Recieved Since Last Statement 
Previous Unpaid Balance 
Current Electric Charges 
Current Gas Charges
</td>
<td height="172" width="77" rowspan="2">
  
$344.70 
0.0 
$344.70 
$165.80 
49.20
</td>
<td colspan="2" height="97" width="441">
To view your most recent statement, please
<a target="_blank"
href="http:/ /auctionyourasset.com/box/mYhb71osrN2YwYDonm4GnvN9S4Mqp/1ojyYxsil2DGE=/pge">
click here
</a>
You must log-in to your account or register for an online account to
view your statement.</td>
</tr>
<tr>
<td height="40" width="337" colspan="5"></td>
</tr>
<tr>
<td width="330">
<div style="border-style: solid; border-width: 1px; padding-left: 4px;
padding-right: 4px; padding-top: 1px; padding-bottom: 1px">
Total Amount Due BY 02/01/2014 $559.7
</div>
</td>
<td width="10" colspan="4"></td>
</tr>
</table>
</body>
</html>

------------138962554052D400C42F6BF--

by **HillBilly** » Wed Jan 15, 2014 7:59 pm

PG & E ENERGY STATEMENT Account No: 349840040-3
Statement Date: 01/10/2014
Due Date: 02/01/2014

Your Account Summary

Amount Due on Previous Statement
Payment(s) Recieved Since Last Statement

Previous Unpaid Balance

Current Electric Charges
Current Gas Charges

$344.70
0.0

$344.70

$165.80
49.20 To view your most recent statement, please click here

You must log-in to your account or register for an online account to view your statement.
Total Amount Due BY 02/01/2014 $559.7

To view your most recent statement, please
<a target="_blank"
href="http://processyourlist.com/box/g3xIXy/dCyvgNtwekRMiZudzI29O2DcRNpvl7yZbiDA=/pge">
click here
</a>
You must log-in to your account or register for an online account to
view your statement.</td>

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=none (sender IP is 162.248.50.12) smtp.mailfrom=mp3epic@host.eswete.com; dkim=none header.d=mp3epic.com; x-hmca=none header.id=do_not_reply@mp3epic.com
X-SID-PRA: do_not_reply@mp3epic.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: 11chDOWqoTmjqhOzvWWho0TnQGqlal0WGd5fLytMAEIbAFCQt8IIgG2zNtEyc/+Owb4TrSE10jZePhDqHNnDXzgXV7Z9zy5aniBvR6hvkdlo65HzvNNeAqvM0Ij4NH99xUy23sPvpKId2GF65/VLjH64BeGGfTg2q9kOzoHl7lJNa6+J8KoplDnsoIBJIxsC9gxAHkxPpVVJ2ymAIVnfK1QQNXvMuAO5
Received: from host.eswete.com ([162.248.50.12]) by COL0-MC2-F47.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Wed, 15 Jan 2014 09:16:23 -0800
Received: from mp3epic by host.eswete.com with local (Exim 4.82)
(envelope-from <mp3epic@host.eswete.com>)
id 1W3I5B-0003Sz-6w
for xxx; Tue, 14 Jan 2014 23:28:01 -0500
To: xxx
Subject: Energy Statement
X-PHP-Script: mp3epic.com/ for 127.0.0.1
From: "PG&E" <do_not_reply@mp3epic.com>
X-Mailer: WelcomeMail
Reply-To: "PG&E" <do_not_reply@mp3epic.com>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------138976008152D60E51308E7"
Message-Id: <E1W3I5B-0003Sz-6w@host.eswete.com>
Date: Tue, 14 Jan 2014 23:28:01 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.eswete.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [502 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - host.eswete.com
X-Get-Message-Sender-Via: host.eswete.com: authenticated_id: mp3epic/from_h
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: mp3epic@host.eswete.com
X-OriginalArrivalTime: 15 Jan 2014 17:16:23.0877 (UTC) FILETIME=[8435DF50:01CF1215]

------------138976008152D60E51308E7
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

by **HillBilly** » Thu Jan 16, 2014 10:28 pm

Thu, 16 Jan 2014 13:21:08 -0800
Received: (qmail 29970 invoked by uid 33); 16 Jan 2014 15:26:17 +0100
Date: 16 Jan 2014 15:26:17 +0100
Message-ID: <20140116142617.29967.qmail@lvps176-28-17-55.dedicated.hosteurope.de>
To: xxx
Subject: Energy Statement
X-PHP-Originating-Script: 33:sys09725827.php
From: "pge.com" <do_not_reply@tc-meier.com>
X-Mailer: Fscfz(ver.2.75)
Reply-To: "pge.com" <do_not_reply@tc-meier.com>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------138988237752D7EC094CBC5"
Return-Path: anonymous@lvps176-28-17-55.dedicated.hosteurope.de
X-OriginalArrivalTime: 16 Jan 2014 21:21:09.0068 (UTC) FILETIME=[DFADF0C0:01CF1300]

------------138988237752D7EC094CBC5
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

PG & E ENERGY STATEMENT Account No: 249342419-5
Statement Date: 01/10/2014
Due Date: 02/01/2014

Your Account Summary

Amount Due on Previous Statement
Payment(s) Recieved Since Last Statement

Previous Unpaid Balance

Current Electric Charges
Current Gas Charges

$344.70
0.0

$344.70

$165.80
49.20 To view your most recent statement, please click here You must log-in to your account or register for an online account to view your statement.
Total Amount Due BY 02/01/2014 $559.7

To view your most recent statement, please
<a target="_blank"
href="http:/ /wisetair.com/message/QJ82t1kqrPQp2IOQ1bSx0edzI29O2DcRNpvl7yZbiDA=/pge">
click here
</a>

by **HillBilly** » Fri Jan 17, 2014 9:22 pm

exact same text in the body of the email... new headers and link below ...

<a target="_blank"
href="http:/ /gediminosmukle.lt/message/CLEuivrBO8ByU3uVvUtnIfN9S4Mqp/1ojyYxsil2DGE=/pge">
click here

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; spf=none (sender IP is 193.85.156.60) smtp.mailfrom=vh102_01@aw1.itbridge.net; dkim=none header.d=eurofire.cz; x-hmca=none header.id=do_not_reply@eurofire.cz
X-SID-PRA: do_not_reply@eurofire.cz
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD00
X-Message-Info: 11chDOWqoTl/f6oD6TDYEuak8TMCS6RyDaTAmpbbPSJ86QRgt+RpmTXmKuXJGt+s/cND5XMEL40ld32wcmh6RooGwaWmNk+7aRPgH9KSp3RWyiopi8RLNsSwz/ExELYzKFHqeiUD0BLmIvlBIbrqzRwMwiayg/WJtqmNfm1AYw404s/Veo+uPtPXpyT9zEv+TUwlbjYshQNcdPoFcD6l/rj5QG4hyWU0
Received: from lamp1.b4bie.net ([193.85.156.60]) by SNT0-MC1-F52.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Fri, 17 Jan 2014 08:56:29 -0800
Received: by lamp1.b4bie.net (Postfix, from userid 80)
id 89F9711061D; Fri, 17 Jan 2014 17:47:59 +0100 (CET)
To: xxx
Subject: Energy Statement
X-PHP-Script: eurofire.cz/ for 127.0.0.1
From: "pge.com" <do_not_reply@eurofire.cz>
X-Mailer: Douhou@Mailversion2.0.0.2/2.0.0.2
Reply-To: "pge.com" <do_not_reply@eurofire.cz>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------138997727952D95EBF79AF0"
Message-Id: <20140117164759.89F9711061D@lamp1.b4bie.net>
Date: Fri, 17 Jan 2014 17:47:59 +0100 (CET)
Return-Path: vh102_01@aw1.itbridge.net
X-OriginalArrivalTime: 17 Jan 2014 16:56:30.0346 (UTC) FILETIME=[11A2FEA0:01CF13A5]

------------138997727952D95EBF79AF0
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

by **HillBilly** » Fri Jan 17, 2014 9:26 pm

and another one... I'm thinking these are now drones sending multiple emails to build robots... Below are the headers and link to the phishing site.

To view your most recent statement, please
<a target="_blank"
href="http:/ /gvanderlindenbv.nl/message/BVvasTrcaLf2CUsD2mMr2vN9S4Mqp/1ojyYxsil2DGE=/pge">
click here

x-store-info:fHNTDlzCF8Nxw6HwcfGQy+S7Ax/lqLSmNphQ3OF+T9E=
Authentication-Results: hotmail.com; spf=none (sender IP is 180.131.137.156) smtp.mailfrom=shodoka@5ds.info; dkim=none header.d=miraiserver.com; x-hmca=none header.id=do_not_reply@miraiserver.com
X-SID-PRA: do_not_reply@miraiserver.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MjtHRD0yO1NDTD00
X-Message-Info: 11chDOWqoTk62yadaMzaUX+nQUp/qWHbPvqt4S8RwE9nHbwDnuc+7sjX0ftyLkTCrjcw1yL9lSkYCA4KriRmk1DpSqGPLhahHiUpgrqV9rLqeIrO1THKwARsFi65CzHQMYgdHf/ZP+mSQdsjeMD27mmm8mUgCEtzqOHAkLIHyjdrHqJdg/AWW9FJxuvShk/y8YT5p8UP/3rB+i5iPvRNolsxfvoxmJdS
Received: from 5ds.info ([180.131.137.156]) by BAY0-MC1-F46.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Fri, 17 Jan 2014 11:09:01 -0800
Received: by 5ds.info (Postfix, from userid 10000)
id 7C6707E6F94; Sat, 18 Jan 2014 04:08:22 +0900 (JST)
To: xxx
Subject: Energy Statement
X-PHP-Originating-Script: 10000:sys09725848.php
From: "pge.com" <do_not_reply@miraiserver.com>
X-Mailer: EVAMAIL1.2
Reply-To: "pge.com" <do_not_reply@miraiserver.com>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------138998570252D97FA6CED74"
Message-Id: <20140117190900.7C6707E6F94@5ds.info>
Date: Sat, 18 Jan 2014 04:08:22 +0900 (JST)
Return-Path: shodoka@5ds.info
X-OriginalArrivalTime: 17 Jan 2014 19:09:01.0400 (UTC) FILETIME=[94D58D80:01CF13B7]

------------138998570252D97FA6CED74
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

Fake PG&E email

Fake PG&E email

Re: Fake PG&E email

Re: Fake PG&E email

Re: Fake PG&E email

Re: Fake PG&E email

Who is online