American Airlines E-Ticket Services Scam

The source host name is "70-90-139-67-BusName-Michigan.hfc.comcastbusiness.net" and the source IP address is 70.90.139.67.

Geo-Location Information

Country United States
State/Region MI
City Sterling Heights


Begin Scam Email:

This is your e-ticked receipt.

TICKET TYPE / E-TICKET NUMBER / EH946397307
SEAT / 75E/ZONE 1
DATE / TIME 12 JANUARY, 2014, 12:15 PM
ARRIVING / Kansas City
ST / OK
REF / EF.4513 BAG / 4PC

TOTAL PRICE / 587.26 USD
FORM OF PAYMENT / XXXXXX

Your bought ticket is attached.
You can print your e-ticket.


Yours sincerely,
American Airlines E-Ticket services.

End Scam Email

Attachment to Scam Email . Probable Malware

AAElectronic Ticket Delta N41332.zip . 73.6 KB



Header Details:

Return-Path: <[email protected]>
Received: from aa.com (70-90-139-67-BusName-Michigan.hfc.comcastbusiness.net [70.90.139.67])
by mtaig-mbb04.mx.aol.com (Internet Inbound) with SMTP id 9D31870000082
for <xxxxxx>; Mon, 9 Dec 2013 10:11:43 -0500 (EST)
Message-ID: <001a01cef4f0$bf87c3ea$6801a8c0@LMS-FRONT>
From: "American Airlines" <[email protected]>
To: <xxxxxx>
Subject: You can download your ticket #7018
Date: Mon, 09 Dec 2013 10:10:08 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0017_01CEF4C6.D6B0DC60"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: XimianEvolution1.4.6
X-MimeOLE: Produced By XimianEvolution1.4.6
x-aol-global-disposition: S
X-AOL-VSS-INFO: 5600.1067/95494
X-AOL-VSS-CODE: clean
Authentication-Results: mx.aol.com;
spf=none (aol.com: the domain aa.com appears to have no SPF Record.) smtp.mailfrom=aa.com;
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1afe6452a5ddaf2b9c
X-AOL-IP: 70.90.139.67
X-AOL-SPF: domain : aa.com SPF : none