LS1.com.au email requesting password?

[AndyP]

I received a SPAM email just this morning, apparently from ls1.com.au but looks fake
Links in the email point to http://ladXXign.com/index2.html


Tried to forward it to ***********ls1.com.au but was bounced back.


Content is below;



--------------------------------------------------------------------------
From: ls1.com.au [mailto:support@ls1.com.au]
Sent: Wednesday, 30 June 2010 4:45 AM
To: andyp@ls1.com.au
Subject: Reset your ls1.com.au password

Hello, andyp@ls1.com.au.

We received your request to reset your ls1.com.au password. To confirm your request and reset your password, follow the instructions below. Confirming your request helps prevent unauthorized access to your account.

If you didn't request that your password be reset, please follow the instructions below to cancel your request.
CONFIRM REQUEST AND RESET PASSWORD
Click on the following web address:

https://ls1.com.au/EmailPage.srf?emailid=mail/?shva=1#inbox/12983ccaa8732d93

CANCEL PASSWORD RESET

Click on the following web address:

https://ls1.com.au/EmailPage.srf?emailid=mail/?shva=1#inbox/12983ccaa8732d944

Thank you,

ls1.com.au

NOTE: Please do not reply to this message, which was sent from an unmonitored e-mail address. Mail sent to this address cannot be answered.

[Ryzz]

Looks like spam to me, do you know how to post the headers?

[XLR8 V8]

Definitely fake. Our actual password reset email says:


Dear **username**,

You have requested to reset your password on Australian LS1 and Holden Forums because you have forgotten your password. If you did not request this, please ignore it. It will expire and become useless in 24 hours time.

To reset your password, please visit the following page:
http://www.ls1.com.au/forum/login.php?a=pwd&u=9999&i=c44d4dshj7f8s9f7dfd897f44e20a8837278ad1

When you visit that page, your password will be reset, and the new password will be emailed to you.

Your username is: **username**

To edit your profile, go to this page:
http://www.ls1.com.au/forum/profile.php?do=editprofile

All the best,
Australian LS1 and Holden Forums


The headers would be an interesting read for us to compare IP's etc.

[VT_SS_II]

I started getting the same emails today at work but with my work email address/domain name so may not just be ls1.com.au targeted. However the the work email address that these are being recieved on (I have a few email aliases) is the same email address I used to sign up to the forum.

[VX2VESS]

they are getting very sneaky now.

using valid web sites and business names

had one the other day at work, was from UPS about an unpaid invoice, but it wasn't an invoice but some hidden virus. looked just like UPS emails do had ups in the email addy.

[Sidewindr]

They get the e-mail addresses from viral worms that infect users pc's and then harvest all of the contact lists by relaying them back to the spammer .. it is amazing how much information a viral worm can obtain from cookies, contact lists, bookmarks etc. They can then generate many many different combinations and spew them out to the e-mail addresses they have farmed already .. I get ones from "ANZ" "Bendigo Bank" "Westpac" etc. etc. and I'm not even a customer ;) I can assure you that the e-mail address are not coming from the forum servers .. :)