This one almost caught us out!
It claims to be from British Gas, and as we have a gas bill due, we were expecting the usual email letting us know our bill was available to view online. However, this email is not from British Gas at all! The originating IP address traces back to the Bahamas, and the email has a link to a site which we didn't visit but which URLQuery tells us is located in France.
There is probably either a malware payload or a phishing page on the site.
There is an error in the From and Return Path addresses: <services@britishgas.co.u> missing the final k from the address.
Return-Path: <services@britishgas.co.u>
Delivered-To: <removed for privacy>
Received: (qmail 5973 invoked by uid 1024); 17 Jun 2014 11:24:17 -0000
Received: from services@britishgas.co.u by server33.donhost.co.uk by uid 1002 with qmail-scanner-1.22
( Clear:RC:0(204.236.72.17):.
Processed in 0.397187 secs); 17 Jun 2014 11:24:17 -0000
Received: from unknown (HELO ?204.236.72.17?) (204.236.72.17)
by server33.lb.donhost.co.uk with SMTP; 17 Jun 2014 11:24:17 -0000
From: British Gas <services@britishgas.co.u>
Message-ID: <77730900.0779943825.3500791288344.JavaMail.app@yobunny.co.uk>
Subject: Help & Advice - British Gas
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_32006216_2688780723.4736289107795"
To: <removed for privacy>
Date: Tue, 17 Jun 2014 07:24:16 -0400
X-EsetId: 37303A29A346426B627067
------=_Part_32006216_2688780723.4736289107795
Content-Type: text/plain;charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-ID: text-body
http://www.google.ru/imgres?imgurl=http%3A%2F%2Fgoodlogo.com%2Fimages%2Flogos%2Fbritish_gas_logo_2613.gif&imgrefurl=http%3A%2F%2Fgoodlogo.com%2Fextended.info%2Fbritish-gas-logo-2613&h=178&w=500&tbnid=iCuLsWkgALhrAM%3A&zoom=1&docid=MuGxkAAHro8s-M&ei=ux2gU_3iLM6D8gXh94LQCA&tbm=isch&client=firefox-a&ved=0CDIQMygDMAM&iact=rc&uact=3&dur=2777&page=1&start=0&ndsp=9 ________________________________________________________________________
You can find you invoice for June 2014 by click on link below
June_invoice.pdf http:// qo1dn4h4gj . ku6fvbi . net / k5u2emsdhc ________________________________________________________________________
We may want to contact you by mail, phone, visit or e-mail about other products and services provided by us, or our partners. By providing your information you will be indicating your consent to us keeping you informed in this way but please tick the box if you DO NOT wish to hear about such products and services.
? British Gas 2014
------=_Part_32006216_2688780723.4736289107795
Content-Type: text/html;charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-ID: html-body
<p><a class="rg_l" href="http://www.google.ru/imgres?imgurl=http%3A%2F%2Fgoodlogo.com%2Fimages%2Flogos%2Fbritish_gas_logo_2613.gif&imgrefurl=http%3A%2F%2Fgoodlogo.com%2Fextended.info%2Fbritish-gas-logo-2613&h=178&w=500&tbnid=iCuLsWkgALhrAM%3A&zoom=1&docid=MuGxkAAHro8s-M&ei=ux2gU_3iLM6D8gXh94LQCA&tbm=isch&client=firefox-a&ved=0CDIQMygDMAM&iact=rc&uact=3&dur=2777&page=1&start=0&ndsp=9" style="width:316px;height:112px;left:0px;right:" target="_blank"><img class="rg_i" data-sz="f" name="iCuLsWkgALhrAM:" src="https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcSq6CFsMwMMPIaMQmKpwrnfnpx5uhfEcr9bNALLYzZuxy0lZFQ_" style="height:112px;margin-left:0px;margin-right:0px;margin-top:0px" width="316"></a></p>
<hr>
<p><b>You can find you invoice for June 2014 by click on link below</b></p>
<p><a href="http:// qo1dn4h4gj .ku6fvbi . net / k5u2emsdhc"><b>June_invoice.pdf</b></a></p>
<hr>
<div class="text parbase section">
<p><font size="2">We may want to contact you by mail, phone, visit or e-mail about other products and services provided by us, or our partners. By providing your information you will be indicating your consent to us keeping you informed in this way but please tick the box if you DO NOT wish to hear about such products and services.</font></p>
<p><span class="small"> © British Gas 2014</span></p>
</div>
<p> </p>
------=_Part_32006216_2688780723.4736289107795--
