You have a new direct message from Facebook Support

fraudulent facebook notification

_____________________________

Email Header Analysis

IP Address:  46.105.28.148 (archimede.origina.it)
IP Address Country:  Italy
IP Continent:  Europe
IP Address City Location:
IP Address Region:
IP Address Latitude:  42.8333,
IP Address Longtitude:  12.8333
Organization:  OVH Srl

____________________________

From Facebook Support Wed Mar 13 19:13:25 2013
X-Apparently-To: scamFRAUDalert via 98.138.213.212; Wed, 13 Mar 2013 20:26:34 +0000
Return-Path: <hector@archimede.origina.it>
X-YahooFilteredBulk: 46.105.28.148
Received-SPF: none (domain of archimede.origina.it does not designate permitted sender hosts)
X-YMailISG: DQ0uE1EWLDsvrPk3O_5wRh3UdI7.xnOy8TitX4.KlUlPtEzK
LMC7Smd6s2IKMH3SV8b4_bWliN8WtGfs1w.K85PtNjHODCWJDASIpjIvJEX_
5AW.1iDFzkNmYFOqX5HV6AcTz_Xip_Wh9lxnCj044_kahFRGV9AdTbjH54ep
wAfnsKvOG9s1bvkixoKHIql_oG1I7p3U6YVyKK5NlVBK5oJy4nQiB5ndo12I
fVFnpmFt84.7gytW5BB8qYbPtkrop1kuP1BhdeIx6pM9XO8O53nmcRd4SiO.
Xyb3jWpvPNvKGNKIazrQSGGCzMuNiWX6_y0P8MzMKrEq2jB2bX_WOd5N7R0j
m7MGZIOCrt4uXHp_AZgLVsU4ZgIsaZpELGaCz7ZRCxK6gxR2CGkEVwLnt5_3
JUmhX_aMaRpVqIS64sqwckcTYDbwOrkxeNmPbCzIYhb3NhjpdmT64RCoWYzW
X3SEDq3CWM5DjFxZTDvVQG2CuvtH9ropO0KYzXZjkJSBOECZYS_ojTLp0xW9
hveE8T0bn.id6VcgO1T0x30AADrC2ln2L_XplGxXt2hRR76.yV0ztT2X9RXS
gEBGSiFJvlwvbWETLPmtWEA8ZJRUIB.b.NTw0l0ORfx9mSz5WI_S.GyTL1kO
ss5x8XIHunQJpmH1sFqerGKaZOXHoineiPWK4oO7sdnajSJefOcqr2edurMV
B0qrqGp.X4GpzA.66HXEgJ4sji4EQFJkMx_plDc3Fk2NLHoCCnkG.pCV25l5
ukEyGS71.VFIuhsMS__Yx1Jjbu50vJyi8HUvH1gplCWX1uKxmaiESgiJwNKE
Z8g6Nfd7apW5KFTCY2XdhbcYsYOI7Mn1sUnr1reo1vzBILiJ3twsmVTgpJJI
ZcWOuR.WCB3R1FcPPe6F1Ioij4oVBZAS1N99jG4nuHj9HnSgHMC7iwz_EeCH
xl5wT1CKdCz_IOhIjLstEk4sAnfk6H2aMzS2jIgpuHQwghK.bLYwusUqWEPA
XixMziV0XS29LX6hKT8maN0Yddnk0nB71d5EN.OmGoQRGeurHyslqVzVBRzm
whbbS3jUU3AjcYXUfW.twK9DhEN1Fp0PLZcqM90HK2JftnR3hwEpbrho0rmZ
dzXCSgF5T2iZO9zdYVCB1S6ES5KZoWPYb4nKne9x3edJ6QabnqTiDcnOsIpf
pd9Wkbs4730ttTrmsn598ufJme.TFSq9E47UuLCQGSl55d0f2OyvyJfcNBJN
p1e3nagmJ4pv9P5VjPMnUl30XcsomNKnvGt5y5koQnfUIVt9VYA4AS6nxGKA
MHZOwgPoWCpd2KBMGT5ZWyw-
X-Originating-IP: [46.105.28.148]
Authentication-Results: mta1001.sbc.mail.ne1.yahoo.com from=archimede.origina.it; domainkeys=neutral (no sig); from=archimede.origina.it; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO archimede.origina.it) (46.105.28.148)
by mta1001.sbc.mail.ne1.yahoo.com with SMTP; Wed, 13 Mar 2013 20:26:34 +0000
Date: 13 Mar 2013 21:13:25 -0500
To: scamFRAUDalert
From: Facebook Support <hector@archimede.origina.it>
Subject: You have a new direct message from Facebook Support
Message-ID: <d5d1a_c16a_75c9ebc665@hector.archimede.origina.it>
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Length: 5273

This slideshow requires JavaScript.

One thought on “You have a new direct message from Facebook Support

  1. SFA Reporter March 16, 2013 at 3:05 PM Reply

    Below is a TRUE FACEBOOK MESSAGE

    facebook notification alert: YOU NEED TO DO A EMAIL HEADER CHECK BEFORE CLICKING ON ONE OF THESE FAKE EMAILS.

    email header tool – ipaddresslocation.com


    Email Header Analysis
    IP Address: 66.220.144.166 (outcampmail007.snc4.facebook.com)

    IP Address Country: United States
    IP Continent: North America
    IP Address City Location: San Francisco
    IP Address Region: California
    IP Address Latitude: 37.7749,
    IP Address Longtitude: -122.4194
    Organization: Facebook
    ______________________

    Delivered-To: scamfraudalert@gmail.com
    Received: by 10.204.81.74 with SMTP id w10csp124150bkk;
    Tue, 12 Mar 2013 00:03:20 -0700 (PDT)
    X-Received: by 10.68.189.137 with SMTP id gi9mr4823361pbc.118.1363071799322;
    Tue, 12 Mar 2013 00:03:19 -0700 (PDT)
    Return-Path:
    Received: from mx-out.facebook.com (outcampmail007.snc4.facebook.com. [66.220.144.166])
    by mx.google.com with ESMTP id zz9si27632143pbc.329.2013.03.12.00.03.18;
    Tue, 12 Mar 2013 00:03:19 -0700 (PDT)
    Received-SPF: pass (google.com: domain of update+hlz=pvvf@facebookmail.com designates 66.220.144.166 as permitted sender) client-ip=66.220.144.166;
    Authentication-Results: mx.google.com;
    spf=pass (google.com: domain of update+hlz=pvvf@facebookmail.com designates 66.220.144.166 as permitted sender) smtp.mail=update+hlz=pvvf@facebookmail.com;
    dkim=pass header.i=@facebookmail.com
    Return-Path:
    DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
    q=dns/txt; i=@facebookmail.com; t=1363071797;
    h=From:Subject:Date:To:MIME-Version:Content-Type;
    bh=hdXDOK8tI4ZUVZilKWPHMuDrgG7PKdg7P5mRJgYtLuw=;
    b=KdokOP9KQWxDMHshbnYnB/fQWnkcxUKJsaM97Imll43aRyWoqsSoWGGRbv/k2xVK
    hE8gseBTQ0eP32HFpMlf+ScpNyAE/GtvipelCfcesu1KJ6TYYB7XnA5OSX4/PXcL
    xbXT3RsLmz+I0KtteVPzPiHfjJF+CcMSyQvYkRNhneo=;
    Received: from [10.66.176.56] ([10.66.176.56:65316])
    by smout021.snc6.facebook.com (envelope-from )
    (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
    id 85/7B-17210-533DE315; Tue, 12 Mar 2013 00:03:17 -0700
    X-Facebook: from zuckmail ([MTI3LjAuMC4x])
    by async.facebook.com with HTTP (ZuckMail);
    Date: Tue, 12 Mar 2013 00:03:17 -0700
    To: Archie Garga-Richardson
    From: “Facebook”
    Reply-to: noreply
    Subject: scamFRAUDalert, you have 1 friend request and 2 messages
    Message-ID:
    X-Priority: 3
    X-Mailer: ZuckMail [version 1.00]
    Errors-To: update+hlz=pvvf@facebookmail.com
    X-Facebook-Camp: stale_email
    X-Facebook-Notify: stale_email; mailid=7a8d063G30855ac9G0G2b
    X-FACEBOOK-PRIORITY: 1
    X-Auto-Response-Suppress: All
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    boundary=”b1_d3ebcb00f41c46720360224fc7f78ead”

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: