Littlewoods hacker?

[anniemac]

I got this email this morning. Now let me equivocably say that I have never signed up at Littlewoods. Where is this coming from?

Unusual Activity in your account:

Our Valued Customer,
You Have 1 New Security Message Alert !

Click here to resolve the problem

Sincerely,
Littlewoods
Security Department Team

Here's the header in full:

From LITTLEWOODS Thu Apr 5 03:28:30 2012
X-Apparently-To: [email protected] via (insert IP Addy); Thu, 05 Apr 2012 03:28:31 -0700
Return-Path: <[email protected]>
Received-SPF: none (domain of littlewoods.co.uk does not designate permitted sender hosts)
ZXcgU2VjdXJpdHkgTWVzc2FnZSBBbGVydCAhCgogICAgCiAgICAgICBDbGlj
ayBoZXJlIHRvIHJlc29sdmUgdGhlIHByb2JsZW0KCiAgICAgIApTaW5jZXJl
bHksCgogICAgICBMaXR0bGV3b29kcwoKICAgICAgU2VjdXJpdHkgRGVwYXJ0
bWVudCBUZWFtATABAQEB
X-YMailISG: aoMG3BEWLDsx7PaZWZg5gkB9sDQQYuS0iVxLA6yi7E2cam3j
ksAVvXIGi9gHAGBH900ytrkeYipCe6C0uVaNJKHv8lKMPS9jQjuNgjdkaGyM
S5arCnd3mkCYyjET.aq88pR6kKltGCbsSN57oUvCkSdL0YlTK6QvGJMgAne0
Hw3RCbSH8ZLFopmRZkGp6fGGIlIAFC7Yyi.XMnbPhyIz_.oN4opeF0j65Edo
O7vqCg.V7CiUWPzsMYfx2Xs7wTDZ7yPMWkDuqth94VBJXQOJV_RdBoS4_Uov
7K8q0rdq9yfcvHO4mBymqL_OM1TJQRwyPuFWDkwc3icxiAvSiBKBODSEViA5
2oTi6s6XI53FHx.0NTS9zSzWvbscdmoA.k_Vaca1y9XkGnyyxlj.fjDNoUHE
eo5tkZR6vkVWSi5ekpkBZGqhmBveLAd3tidNwazTGJnwDZTccv3YQDbGarI8
daIiwH39gahLb5HTbhWHqgnmx5r8c32EVbqg.fT1VQqU5p7sTOAvTHd8kEHp
tmOq_g871t_BZWrV0m4MxNf9MI6uUTfKjCXiOe2R_ZGvBCUjdbid8QnJ.6wO
2gZMJgYv..Lk2WVCazXSfiOJaTXUfvsdQV6A4A4oMw7bSt8fNqz8BxjYNL8M
RQPvq7o20HZTuZV7AApVc4gfLxZ0w4.8MReQKnICywgbRvZswnNewGiLmQgK
VVmBrgiwAUw8TLvNyI0MRulpfOQGnZyuakdyJ1Rq0U3J1xCvnVrF0aBwxrTH
cxfCrHIi9SHi0ME8CS5aesu3atM5c65pxtDxziGH9B3cDn4AEjoTFvVnqV9H
oW5VrPhB2yvDix6yzueAtL14YXkmDMJHuy6Zhtfglj0qgRkEzjEU4eRkVoVJ
JmdDel5HKQMGGN96L.WxWtLoosgXgOVN_sCSLFWya4szl3V1GN2C_U0puXOX
pXpFRW7dRaSy2qrMplVzXerBtJRMMlU8_qS8.Y0uMS_Q_6963xygPpAG3_Yd
TeEWmS.HlxXRoeNzhq1VBuXggziSHbtDehIr5qH.1PNZk7.S0tlB0NzeZ8eL
7pCSIyFMYWfWsls_pVJ__.n_8_BTLBpuBbhfFg4WG.MSy.cls1Oavpp1Vg4-
X-Originating-IP: [159.134.118.221]
Authentication-Results: mta1259.mail.mud.yahoo.com from=littlewoods.co.uk; domainkeys=neutral (no sig); from=littlewoods.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO mail20.svc.cra.dublin.eircom.net) (159.134.118.221)
by mta1259.mail.mud.yahoo.com with SMTP; Thu, 05 Apr 2012 03:28:30 -0700
Received: (qmail 837 messnum 16302139 invoked from network[213.94.190.11/avas00.vendorsvc.cra.dublin.eircom.net]); 5 Apr 2012 10:28:30 -0000
Received: from avas00.vendorsvc.cra.dublin.eircom.net (213.94.190.11)
by mail20.svc.cra.dublin.eircom.net (qp 837) with SMTP; 5 Apr 2012 10:28:30 -0000
Received: from User ([86.43.121.7])
by avas00.vendorsvc.cra.dublin.eircom.net with Cloudmark Gateway
id uAUJ1i00u09gUB201AUNzd; Thu, 05 Apr 2012 11:28:29 +0100
From: "LITTLEWOODS"<[email protected]>
Subject: Unusual Activity On Your Account.
Date: Thu, 5 Apr 2012 11:28:30 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 856

 

[Mousey]

Reads like an old fashioned phishing email like we get from banks and the FBI and the IRS and Paypal, etc. If we have a Littlewoods rep, maybe send them a PM and get an addy to forward the email to.

as an aside: You do receive the most ummm... 'interesting' emails. LOL

 

[anniemac]

Mousey,

Hon, I'm just sending the good ones. You should see some of the other crap I get thru Yahoo. I always just scan over my spam because sometimes my 'good' casinos get sent there.

But let me tell you if I was so inclined I could buy anything I wanted from my spam mail. Like Alice's Restaurant, if you're old enough to remember that song.

 

[JackTenOff]

standard fishing email, also it should come from littlewoodsgaming.co.uk not littlewoods.co.uk, at least in the emails I've received from them

 

[anniemac]

I looked to see if there is a rep here and didn't see one.

Deanimus, if you have an email address or something for a Rep, I would let them know about this.

 

[chayton]

Here's the rep for Littlewoods https://www.casinomeister.com/forums/members/

It was linked in their baptism by fire thread.

 

[liverpool10]

Email

Hi,

Just to confirm this has nothing to do with the online company, namely Littlewoodsgaming. Can you forward the email you have received directly to me please at [email protected] so we can try to trace its origins and take any action we can to stop further activity. ( Just for your information Vernons and Littlewoods are both Uk brands of Sportech plc - Vernons is just the main brand and 2 years older - actually celebrating its 90th year shortly .

Cheers,

James

I got this email this morning. Now let me equivocably say that I have never signed up at Littlewoods. Where is this coming from?




Here's the header in full:

From LITTLEWOODS Thu Apr 5 03:28:30 2012
X-Apparently-To: [email protected] via (insert IP Addy); Thu, 05 Apr 2012 03:28:31 -0700
Return-Path: <[email protected]>
Received-SPF: none (domain of littlewoods.co.uk does not designate permitted sender hosts)
ZXcgU2VjdXJpdHkgTWVzc2FnZSBBbGVydCAhCgogICAgCiAgICAgICBDbGlj
ayBoZXJlIHRvIHJlc29sdmUgdGhlIHByb2JsZW0KCiAgICAgIApTaW5jZXJl
bHksCgogICAgICBMaXR0bGV3b29kcwoKICAgICAgU2VjdXJpdHkgRGVwYXJ0
bWVudCBUZWFtATABAQEB
X-YMailISG: aoMG3BEWLDsx7PaZWZg5gkB9sDQQYuS0iVxLA6yi7E2cam3j
ksAVvXIGi9gHAGBH900ytrkeYipCe6C0uVaNJKHv8lKMPS9jQjuNgjdkaGyM
S5arCnd3mkCYyjET.aq88pR6kKltGCbsSN57oUvCkSdL0YlTK6QvGJMgAne0
Hw3RCbSH8ZLFopmRZkGp6fGGIlIAFC7Yyi.XMnbPhyIz_.oN4opeF0j65Edo
O7vqCg.V7CiUWPzsMYfx2Xs7wTDZ7yPMWkDuqth94VBJXQOJV_RdBoS4_Uov
7K8q0rdq9yfcvHO4mBymqL_OM1TJQRwyPuFWDkwc3icxiAvSiBKBODSEViA5
2oTi6s6XI53FHx.0NTS9zSzWvbscdmoA.k_Vaca1y9XkGnyyxlj.fjDNoUHE
eo5tkZR6vkVWSi5ekpkBZGqhmBveLAd3tidNwazTGJnwDZTccv3YQDbGarI8
daIiwH39gahLb5HTbhWHqgnmx5r8c32EVbqg.fT1VQqU5p7sTOAvTHd8kEHp
tmOq_g871t_BZWrV0m4MxNf9MI6uUTfKjCXiOe2R_ZGvBCUjdbid8QnJ.6wO
2gZMJgYv..Lk2WVCazXSfiOJaTXUfvsdQV6A4A4oMw7bSt8fNqz8BxjYNL8M
RQPvq7o20HZTuZV7AApVc4gfLxZ0w4.8MReQKnICywgbRvZswnNewGiLmQgK
VVmBrgiwAUw8TLvNyI0MRulpfOQGnZyuakdyJ1Rq0U3J1xCvnVrF0aBwxrTH
cxfCrHIi9SHi0ME8CS5aesu3atM5c65pxtDxziGH9B3cDn4AEjoTFvVnqV9H
oW5VrPhB2yvDix6yzueAtL14YXkmDMJHuy6Zhtfglj0qgRkEzjEU4eRkVoVJ
JmdDel5HKQMGGN96L.WxWtLoosgXgOVN_sCSLFWya4szl3V1GN2C_U0puXOX
pXpFRW7dRaSy2qrMplVzXerBtJRMMlU8_qS8.Y0uMS_Q_6963xygPpAG3_Yd
TeEWmS.HlxXRoeNzhq1VBuXggziSHbtDehIr5qH.1PNZk7.S0tlB0NzeZ8eL
7pCSIyFMYWfWsls_pVJ__.n_8_BTLBpuBbhfFg4WG.MSy.cls1Oavpp1Vg4-
X-Originating-IP: [159.134.118.221]
Authentication-Results: mta1259.mail.mud.yahoo.com from=littlewoods.co.uk; domainkeys=neutral (no sig); from=littlewoods.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO mail20.svc.cra.dublin.eircom.net) (159.134.118.221)
by mta1259.mail.mud.yahoo.com with SMTP; Thu, 05 Apr 2012 03:28:30 -0700
Received: (qmail 837 messnum 16302139 invoked from network[213.94.190.11/avas00.vendorsvc.cra.dublin.eircom.net]); 5 Apr 2012 10:28:30 -0000
Received: from avas00.vendorsvc.cra.dublin.eircom.net (213.94.190.11)
by mail20.svc.cra.dublin.eircom.net (qp 837) with SMTP; 5 Apr 2012 10:28:30 -0000
Received: from User ([86.43.121.7])
by avas00.vendorsvc.cra.dublin.eircom.net with Cloudmark Gateway
id uAUJ1i00u09gUB201AUNzd; Thu, 05 Apr 2012 11:28:29 +0100
From: "LITTLEWOODS"<[email protected]>
Subject: Unusual Activity On Your Account.
Date: Thu, 5 Apr 2012 11:28:30 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Length: 856

 

[anniemac]

I have already deleted this email.

But what is posted here is a full description of the email.