See details below... FYI: the Return-path: seems to be randomized and set for various high profile domains (Google/ibm...)

============== From - Sat Feb 26 23:10:17 2005 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: wdmayujifg@google.com Envelope-to: hanasaki@hanaden.com Delivery-date: Sat, 26 Feb 2005 23:10:15 -0600 Received: from user-12hci8q.cable.mindspring.com ([69.22.73.26] helo=google.com) by cognition.home.hanaden.com with smtp (Exim 4.44) id 1D5Ggj-0007Wk-9A for hanasaki@hanaden.com; Sat, 26 Feb 2005 23:10:14 -0600 From: WAMU Bank <alert@wamu.com yqtnsqvhvk@ebay.com To: hanasaki hanasaki@hanaden.com X-Priority: 3 X-MSMail-Priority: Normal Reply-To: WAMU Bank <alert@wamu.com yqtnsqvhvk@ebay.com mime-version: 1.0 content-type: multipart/mixed; boundary="qzsoft_directmail_seperator" X-SA-Exim-Connect-IP: 69.22.73.26 X-SA-Exim-Mail-From: wdmayujifg@google.com Subject: Important Security Issue: Bank Account Alert (details inside) X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on cognition.home.hanaden.com X-Spam-Level: *** X-Spam-Status: No, score=3.3 required=6.7 tests=ALL_TRUSTED,FAKEDWORD_ZERO, MIME_BASE64_TEXT,MISSING_DATE,MISSING_MIMEOLE,PRIORITY_NO_NAME, RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,RCVD_IN_XBL autolearn=no version=3.0.2 X-SA-Exim-Version: 4.2 (built Tue, 25 Jan 2005 19:36:50 +0100) X-SA-Exim-Scanned: Yes (on cognition.home.hanaden.com)

--qzsoft_directmail_seperator Content-Type: text/plain; charset="DEFAULT" Content-Transfer-Encoding: base64

SW1wb3J0YW50IFNlY3VyaXR5IElzc3VlIAoKRGVhciBXYW11IE1lbWJlciwgCgpXZSByZWNlbnRs eSBkZXRlcm1pbmVkIHRoYXQgYSBkaWZmZXJlbnQgY29tcHV0ZXIgaGFzIGxvZ2dlZCBpbnRvIHlv dXIgT25saW5lIEJhbmtpbmcgCmFjY291bnQsIGFuZCBtdWx0aXBsZSBwYXNzd29yZCBmYWlsdXJl cyB3ZXJlIHByZXNlbnQgYmVmb3JlIHRoZSBsb2dvbnMuIAoKCldlIG5vdyBuZWVkIHlvdSB0byBy ZS1jb25maXJtIHlvdXIgYWNjb3VudCBpbmZvcm1hdGlvbiB0byB1cy4gSWYgdGhpcyBpcyBub3Qg Y29tcGxldGVkIAp3aXRoaW4gMjRoICwgd2Ugd2lsbCBiZSBmb3JjZWQgdG8gc3VzcGVuZCB5b3Vy IGFjY291bnQgYXMgaXQgbWF5IGhhdmUgYmVlbiBjb21ycG9taXNlZC4gCgpXZSB0aGFuayB5b3Ug Zm9yIHlvdXIgY29vcGVyYXRpb24gaW4gdGhpcyBtYXR0ZXIuIAoKaHR0cDovL21lbWJlcnMuYW9s LmNvbS93YW11YmFua2FsZXJ0L3ZpZXdub3cuaHRtbAoKVGhhbmsgeW91IGZvciB5b3VyIHByb210 IGF0dGVudGlvbiB0byB0aGlzIG1hdHRlci4gUGxlYXNlIHVuZGVyc3RhbmQgdGhhdCB0aGlzIGlz IGEgc2VjdXJpdHkgCm1lYXN1cmUgbWVhbnQgdG8gaGVscCBwcm90ZWN0IHlvdSBhbmQgeW91ciBh Y2NvdW50LiAKCldlIGFwb2xvZ2l6ZSBmb3IgYW55IGluY29udmVuaWVuY2UuIAoKSWYgeW91IGNo b29zZSB0byBpZ25vcmUgb3VyIHJlcXVlc3QgeW91IGxlYXZlIHVzIG5vIGNob2ljZSBidXQgdG8g dGVtcG9yYXJpbHkgc3VzcGVuZCB5b3VyIAphY2NvdW50LiAKClRoYW5rIHlvdSBmb3IgdXNpbmcg V0FNVSEgVGhlIFdBTVUgVGVhbSAg

--qzsoft_directmail_seperator--

========== Important Security Issue

Dear Wamu Member,

We recently determined that a different computer has logged into your Online Banking account, and multiple password failures were present before the logons.

We now need you to re-confirm your account information to us. If this is not completed within 24h , we will be forced to suspend your account as it may have been comrpomised.

We thank you for your cooperation in this matter.

http://members.aol.com/wamubankalert/viewnow.html

Thank you for your promt attention to this matter. Please understand that this is a security measure meant to help protect you and your account.

We apologize for any inconvenience.

If you choose to ignore our request you leave us no choice but to temporarily suspend your account.

Thank you for using WAMU! The WAMU Team