Craigslist email scam

not sure where this one would go.. but this is the first time ive seen one of these come through(though it was blocked by gmail spam blocker).. i figured it was worth posting for those people that use email providers that suck at blocking spam..

from Craigslist.org <[email protected]>
reply-to [email protected]
to [email protected]
date Sun, Aug 29, 2010 at 5:49 PM
subject Requiring re-authentication of your Craiglist Account
mailed-by 4x4.cnchost.com

Please log in to authenticate your Craigslist account : http://www.craigslistacounts.tk/ Thank you for using Craigslist!

looks almost real doesnt it.. well minus the website address..

actual craigslist email header

from [email protected]
to sirmonkey*****@gmail.com
date Mon, Aug 16, 2010 at 7:51 PM
subject craigslist.org: Request to Reset Account Password for sirmonkey****@gmail.com
mailed-by craigslist.org

above header is the actual one used by craigslist for resetting/re-validating your password/account..

This is a phishing email--a simple attempt to hijack your account. Some of these are sent by the type of scammers we deal with, others are more professional and the stolen logins are bought and sold.

If you haven't already, you should forward this one to craigslist--as the affected party, they are best able to get the copycat domain shut down. Also, since the "from" address is undoubtedly spoofed, if you view full headers it may be possible to get a country of origin.

Please log in to authenticate your Craigslist account : http://www.craigslistacounts.tk/

Is that the address shown on the status line when you however your mouse pointer over it? I've looked at it on an Android phone (in case of malware). It's just a page full of links to advertising sites, rather than oneone asking users to log in.

^ It's a 'genuine' phishing site. I've had several warnings pop up when entering and found the login page. It's a fake, don't fill in your details there. If you have, change all your password settings immediately!

I'll report it asap.

...and it has been shut down