You have a new direct message from Facebook IT Department

fake facebook notification ~ fraud

Email Header Analysis

IP Address:  187.103.104.254 (187.103.104.254)
IP Address Country:  Brazil
IP Continent:  South America
IP Address City Location:  Navegantes
IP Address Region:  Santa Catarina
IP Address Latitude:  -26.9,
IP Address Longtitude:  -48.65
Organization:  Commcorp Comunicacoes Ltda

___________________________

From Facebook IT Department Mon Mar 11 00:44:09 2013
X-Apparently-To: scamFRAUDalert via 98.138.213.184; Sun, 10 Mar 2013 22:44:12 -0700
Return-Path: <hedlund@linux.cz>
X-YahooFilteredBulk: 187.103.104.254
Received-SPF: none (domain of linux.cz does not designate permitted sender hosts)
X-YMailISG: 2gfIn4sWLDuS_5jqOcsJkxiVs.oTEemBY4IK1ZIxhjCITznV
ggnnRJ_zY6eYQJsysWcxphRsw9bWwbZqonmmUKpsWYb.Y8oA8P8hBXkJ0knK
_4T3IaN9Q_0hzsDIqGvafQ9WuGTEp7QCOFa_qZxdcEtXpsomnkeSdAGM6mYT
qetn91eGFmRM36RGirq6lcs_OaZz9snHK0yyH1p0b1j3N9suBf0iaMpBNTl3
43P_ZrN7lUYeiSFoueS7wAZ73KDSQ2skGy7Bwe9jvTpsOXMXt3a6b9HwPhdE
j..xt8PD0iEedfaU.FgAApnmMrKXhejtNReBa.veBWYnVhRPHZ32QjrfR1gp
WhFWSNhxObOpLU78Kvn2PSD6KLEl9ICuIMhY5r6C83PMOZENsKs.zEHeN46g
pcGjG2gF2C59jsOqbtqjPEdWd5DUU_TX2Abf6o7AMhVlbxxx4pBJWC7TR8bl
41CYa7WpVuuxQcukfwveLoX9dY_kLoCmdykvOKw_DBWrU4HjfHNuQoa0k5o7
TFwmnQ9maJOGwn7y3Ck3nT3ERJ0MSx7XrPvdhnOghFaGXchpUqBcWblbsBc5
ZsBHp1edmra_M4YbfzJ8HTvpYC2U3o4UFt6PGoSLs1BKyyFrqzb7QAifbcsx
JoPVwJTKRVz.xOGJUnHruxpbx9.DKdraBPat99NB0druRwM5VUwdx8PFF5qw
CGELZAYZMKuz38oYINwrN.PsRbFByg3myot4KNH9PacXX7qu0.92MfNP1ZXj
xS2Q30q_4DLNA5vB6aUj1tWXAlWgJCzSXiKeO8aczPHtoH8ypktKYO7ogk0Q
cDKQ_aBTDypJrX.E0mdLQxbxpqeH1ezBqqgmqp3ouBuDbVDDsdpEVRYn.eBL
WYpeR8_g58NKAsNk_95pHF.THIz0RB5JDe3x_tIqQtJaXx6LdCkGQUYxVhb7
qFtrgwXg5ntfXoYQ1ZGzW3IFcdTatW1hc_MbRBmq7B5JgdJRHpkmUJpQlmP_
u.gI5aFkbD0gRTCliCQGiBacfNqfKYXP.7IbqnRxL5KIW0jyZoKRokBBkYD9
eFkh_poNg_syHgPwd4OF.rIYq0mNrZU0Xwq3Jel8E9s7p2zpJA3nHwbmhshZ
vcLO69bAjl7c98cR0wt2UnoekTn0Hh4aVdo.WdOxWYohBchT.g2YF_F0A_.r
e9NuQLt4hho0SexyJ9uhRlfPpJ33uaD72XIkf0v7bs7KWCNhOFlht8Cm_PPf
ZYxZuOC9saN1Ag_9BZswah2xuOYP.1K0nM_GYx1DjnofMBcFC_cMAuRukMG3
JXOryWe5xLaniE4EBxtbK9lf2zBOvlA-
X-Originating-IP: [187.103.104.254]
Authentication-Results: mta1229.sbc.mail.gq1.yahoo.com from=linux.cz; domainkeys=neutral (no sig); from=linux.cz; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO localhost) (187.103.104.254)
by mta1229.sbc.mail.gq1.yahoo.com with SMTP; Sun, 10 Mar 2013 22:44:10 -0700
Date: 11 Mar 2013 02:44:09 -0500
To: scamFRAUDalert
From: Facebook IT Department <hedlund@linux.cz>
Subject: You have a new direct message from Facebook IT Department
Message-ID: <e55415-1ee1_4a66e6@hedlund.localhost>
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Length: 5281

____________________________________

notification3

facebook
You have a new message from Facebook IT Department.
Your profile contains an invalid address.
View Notifications

Go to Facebook
This message was sent to scamFRAUDalert. If you don’t want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303

Related Article:

About these ads

One thought on “You have a new direct message from Facebook IT Department

  1. SFA Reporter March 12, 2013 at 12:33 am Reply

    Below is a TRUE FACEBOOK MESSAGE

    facebook notification alert: YOU NEED TO DO A EMAIL HEADER CHECK BEFORE CLICKING ON ONE OF THESE FAKE EMAILS.

    email header tool – ipaddresslocation.com

    notification-REAL
    Email Header Analysis
    IP Address: 66.220.144.166 (outcampmail007.snc4.facebook.com)

    IP Address Country: United States
    IP Continent: North America
    IP Address City Location: San Francisco
    IP Address Region: California
    IP Address Latitude: 37.7749,
    IP Address Longtitude: -122.4194
    Organization: Facebook
    ______________________

    Delivered-To: scamfraudalert@gmail.com
    Received: by 10.204.81.74 with SMTP id w10csp124150bkk;
    Tue, 12 Mar 2013 00:03:20 -0700 (PDT)
    X-Received: by 10.68.189.137 with SMTP id gi9mr4823361pbc.118.1363071799322;
    Tue, 12 Mar 2013 00:03:19 -0700 (PDT)
    Return-Path:
    Received: from mx-out.facebook.com (outcampmail007.snc4.facebook.com. [66.220.144.166])
    by mx.google.com with ESMTP id zz9si27632143pbc.329.2013.03.12.00.03.18;
    Tue, 12 Mar 2013 00:03:19 -0700 (PDT)
    Received-SPF: pass (google.com: domain of update+hlz=pvvf@facebookmail.com designates 66.220.144.166 as permitted sender) client-ip=66.220.144.166;
    Authentication-Results: mx.google.com;
    spf=pass (google.com: domain of update+hlz=pvvf@facebookmail.com designates 66.220.144.166 as permitted sender) smtp.mail=update+hlz=pvvf@facebookmail.com;
    dkim=pass header.i=@facebookmail.com
    Return-Path:
    DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
    q=dns/txt; i=@facebookmail.com; t=1363071797;
    h=From:Subject:Date:To:MIME-Version:Content-Type;
    bh=hdXDOK8tI4ZUVZilKWPHMuDrgG7PKdg7P5mRJgYtLuw=;
    b=KdokOP9KQWxDMHshbnYnB/fQWnkcxUKJsaM97Imll43aRyWoqsSoWGGRbv/k2xVK
    hE8gseBTQ0eP32HFpMlf+ScpNyAE/GtvipelCfcesu1KJ6TYYB7XnA5OSX4/PXcL
    xbXT3RsLmz+I0KtteVPzPiHfjJF+CcMSyQvYkRNhneo=;
    Received: from [10.66.176.56] ([10.66.176.56:65316])
    by smout021.snc6.facebook.com (envelope-from )
    (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
    id 85/7B-17210-533DE315; Tue, 12 Mar 2013 00:03:17 -0700
    X-Facebook: from zuckmail ([MTI3LjAuMC4x])
    by async.facebook.com with HTTP (ZuckMail);
    Date: Tue, 12 Mar 2013 00:03:17 -0700
    To: scamFRAUDalert
    From: “Facebook”
    Reply-to: noreply
    Subject: scamFRAUDalert, you have 1 friend request and 2 messages
    Message-ID:
    X-Priority: 3
    X-Mailer: ZuckMail [version 1.00]
    Errors-To: update+hlz=pvvf@facebookmail.com
    X-Facebook-Camp: stale_email
    X-Facebook-Notify: stale_email; mailid=7a8d063G30855ac9G0G2b
    X-FACEBOOK-PRIORITY: 1
    X-Auto-Response-Suppress: All
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    boundary=”b1_d3ebcb00f41c46720360224fc7f78ead”

Leave A Comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s