New (poor quality) Plusnet Email Scam!

[#1]

Oh, this one is laughable..
-- HEADERS --
Envelope-to: my@email.address
Delivery-date: Tue, 14 Aug 2007 07:53:32 +0000
Received:  by pih-sunmxcore16.plus.net with spam-scanned (PlusNet MXCore v2.00) id 1IKrDX-0005hx-Ic
  for my@email.address; Tue, 14 Aug 2007 07:53:32 +0000
X-Daemon-Classification: INNOCENT
Received: from 201-11-166-143.cpece705.e.brasiltelecom.net.br ([201.11.166.143])
  by pih-sunmxcore16.plus.net with esmtp (PlusNet MXCore v2.00) id 1IKrDW-0004pr-9F
  for my@email.address; Tue, 14 Aug 2007 07:53:30 +0000
Received: from [201.11.166.143] by emailscan6a.mci.com; Tue, 14 Aug 2007 07:51:55 +0400
From: "Lea Bartley"@pih-sunmxcore16.plus.net
To: <my@email.address>
Subject: Update on processing
Date: Tue, 14 Aug 2007 07:51:55 +0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01C7DE26.74DE55C0"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
Thread-Index: Aca6QEH5QZFKD7NSI4HY0LGN2Z315G==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Message-ID: <01c7de47$fbeff5c0$8fa60bc9@khjc>
x-open-relay: 201.11.166.143 is in a black list at bl.spamcop.net
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Tue Aug 14 08:53:31 2007
X-DSPAM-Confidence: 0.5310
X-DSPAM-Improbability: 1 in 114 chance of being spam
X-DSPAM-Probability: 0.0000
X-DSPAM-Factors: 27,
processed+<font, 0.01000,
color="#FF0000"+size=", 0.99000,
color="#FF0000"+size=", 0.99000,
Subject*processing, 0.99000,
Received*166, 0.99000,
From*Bartley", 0.99000,
processed+Thank, 0.01000,
Received*55+0400, 0.01618,
Received*0400, 0.01631,
Received*51+55, 0.01936,
Received*from+201, 0.97505,
you+again, 0.02659,
you+again, 0.02659,
regards+<font, 0.03122,
Support+team, 0.03185,
Subject*Update+on, 0.03569,
to+process, 0.03576,
to+process, 0.03576,
Date*Tue+14, 0.04153,
team+This, 0.04304,
team+This, 0.04304,
x-open-relay*is+in, 0.94422,
x-open-relay*list+at, 0.94422,
x-open-relay*a+black, 0.94422,
x-open-relay*in+a, 0.94422,
x-open-relay*in, 0.94422,
x-open-relay*black, 0.94422
-- END HEADERS --

[#2]

Have you had more than one of these? Is the URL always the same? I'm wondering if there's any worth in us blocking it?

[#3]

Just had the one so far, so I doubt it's worth blocking it, but I'll keep my eyes peeled
Barry

[#4]

And as I posted the last one, a new one came in.
First post url is rosetone.cn
Second post url is sureteam.cn  - this one got flagged as spam
Barry

[#5]

If we get many more reports then we'll consider posting something like this that went out a month or two ago.

[#6]

Two more received, both tagged as spam so I guess DSpam is now recognising them.
URLS in these cases were: saltwindow.cn and moresection.com
All "originating" from:
"random user"@xxx-sunmxcoreYY.plus.net
I guess the spam-sender is just using the recipient relay server as the originating domain..
Barry

[#7]

Just received one myself.

Quote

Dear customer!       Last month due to technical problems we were unable to process the payment.       We have improved the processing system.       Now you can order and be sure that  your order will be processed.       Thank you for understanding and hope to see you again at URL       Best regards,     Support team

URL points to moresection.com which is a "Canadian Pharmacy" 😉
(NB. Do not visit the link above!)

[#8]

Good point, have edited it!

[#9]

Eh?
Ooh.. were you editing it at the same time as me?
Sorry...