Can anyone pls help? where is this e-mail from?

Tattooed · 17 Apr 2014 at 12:05

Hi,
Can anyone pls tell me where this e-mail came from?

X-Apparently-To:
.com via 188.125.84.66; Thu, 17 Apr 2014 10:16:39 +0000
Received-SPF: softfail (transitioning domain of paypal.co.uk does not designate 65.20.0.12 as permitted sender)
X-YMailISG: 9zSOF7AWLDv6Dfvxe7F138LcV8N9vihpNL5192m2CbwDTtfl
kW1Uksbs4uPVLV7Kz10JrC.ztoQbokh6Gf_xDmBDKSp8l7WKzGpqvKwoAafp
ddQaYWfFTsR1tC5uoSX4FSzrH.rBWnYqT3Imi3PyGwGRmcKPvjKFWoruQDlA
NKI44N3tlsQx19TcZ8bofC5uI4JXzyuZ_6DiqAtd9GZScJTDN4DooXM55.c4
b2F.uHE50JIPqpDblbjX9T6jjpKW8olvsjAHkbtZrU0H7Y2tGVtFrRvRxl5p
Vjsbp1k55AnPbtOQEpfgYBeOhj8rP2Z672DitL6FX3kjix_0qIoqVXb2mzOp
HkHm8TOyoGMRdJh0cXGP5.GeJGnfCzMzpYr8mv4zp4No.gFL.P66axn.5zyS
6mppLnPYEOKXbPigbydvfPPoHsNclXBYDXFgAUdqVsA1hpwDZDP2UUgMo7LN
EVnKL5j4iQpPVIIV2k3tZXymVXoaJ8_C2WigPxZrfUYPhR5_4QNpRyEWicpc
Y.HmqGpmSIBC0FJKU628i4kuL.GpBRUMRvh2K.pJlvPHsr2TIHpDvo2NQt2j
XPjny0ccbS1iVqjqSbSIr7tMHYI5Emt0a6ELXiJ6Bprw1BgvB3jeLZonSi0C
KoKrsVVjGC6TjinospyGZeJV2qm0NB6LMMCSz29boZyoFGdc8s80ay5rYLaE
Pg6q9LZrKUrYb5jXHbCnMqAkJUY23PIXifpd.G0oZ4dPSGES0N4oRxJCuEnb
fSa_mluhQBNFUQkCzm1Fsf4ZXdOJnKWqS0ec.RQm.TM4FEYsDhtJU6hxl2qV
28lf1wW45LriR7pvBSYeINB4y_zg0bD99f7D.OSMCJZ9zpyBGB_g2pvo6xkG
BWCtM1CxKZq4.YHWCE0.vzaE.9svfnbIUhC2.CDKo1xUTIdsLdq0y_lrYcMM
KNcs3.SzJMwwAJE11.BHgfRZASeDEoYmZfESW6WkNppi2Tcg0fya0tVblI0d
UiBVXVFIsgPomfVe94vME_cxGw6iCX6DsoZfblz8Ns43TAdPavlP_lxAFGen
yF1GqGcedGYtC_qSGOMffod9uHnwrBig0a5Ww0MPyq9SMFjLmWt2.5ywTKdf
48VKqG0mZZynmFJJ1yrkIrli7bthgtHRXR_1le5rBFMSgIpP6foDkmz9o14e
vs5ZNj4NxViRr7E9zkPXP6M.ljl2D1p2Gof9HwTzF.XjCdlfXv.EwQLdxtm9
1annLh1_Vy4pVUUNKdVSPrVr3iF7POmBAX4Ysw4nZhXvHOvYflnxozHTY3wj
.m4ClSXdfLze3ZfOYSaw38Eyj5rXme2imgzjOcVC
X-Originating-IP: [65.20.0.12]
Authentication-Results: mta1025.bt.mail.ir2.yahoo.com from=paypal.co.uk; domainkeys=neutral (no sig); from=paypal.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO smtpin06.bt.ext.cpcloud.co.uk) (65.20.0.12)
by mta1025.bt.mail.ir2.yahoo.com with SMTP; Thu, 17 Apr 2014 10:16:39 +0000
X-CTCH-RefID: str=0001.0A090209.534FA432.0185,ss=3,sh,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0
X-CTCH-VOD: Unknown
X-CTCH-Spam: Bulk
Received: from h1226651.stratoserver.net (85.214.87.167) by smtpin06.bt.ext.cpcloud.co.uk (8.6.100.99.10459)
id 5321B9B009B80DA2 for ; Thu, 17 Apr 2014 11:16:39 +0100
Received: from u1226651 by h1226651.stratoserver.net with local (Exim 4.63)
(envelope-from <[email protected]>)
id 1WajN0-0004BH-U5
for ; Thu, 17 Apr 2014 12:16:38 +0200

Subject: Access to Online Banking Service !
From: NatWest <[email protected]>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <[email protected]>
Date: Thu, 17 Apr 2014 12:16:38 +0200
Received: from 188.125.84.66 (188.125.84.66) by 46.228.37.111(46.228.37.111); Thu, 17 Apr 2014 10:16:39 +0000
X-Antivirus: AVG for E-mail 2014.0.4569 [3882/7355]
X-AVG-ID: ID1ADE68D-16544126

<div id="yiv2044481656AOLMsgPart_0_86202002-bc32-4807-adb7-ec5f9d826fd8">

<img id="yiv2044481656yui_3_7_2_1_1376823391428_4222" alt="http://www.natwest.com/img/logo/logo-natwest.png" src="http://www.natwest.com/img/logo/logo-natwest.png" style="border:0px;line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);"><br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;">
Valued Customer,<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<span id="yiv2044481656yui_3_7_2_1_1376823391428_4211" style="color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:15.921875px;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);display:inline;float:none;">
We have temporarily prevented access to your account for your security,<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<span id="yiv2044481656yui_3_7_2_1_1376823391428_4209" style="color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:15.921875px;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);display:inline;float:none;">
This is due to either of the following reasons;<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<span id="yiv2044481656yui_3_7_2_1_1376823391428_4207" style="color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:15.921875px;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);display:inline;float:none;">
*Your Login Details has been entered incorrectly.<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<span id="yiv2044481656yui_3_7_2_1_1376823391428_4205" style="color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:15.921875px;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);display:inline;float:none;">
*Your Account has been accessed from a blacklisted Location<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<span id="yiv2044481656yui_3_7_2_1_1376823391428_4170" style="color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:15.921875px;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);display:inline;float:none;">
Follow the link below to confirm your identity and re-gain account access.<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<b id="yiv2044481656yui_3_7_2_1_1376823391428_4215" style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">


<a rel="nofollow" id="yiv2044481656yui_3_7_2_1_1376823391428_4214" style="line-height:1.2em;text-decoration:none;color:rgb(0, 51, 153);outline:none;" target="_blank" href="http://www.murcott.com//wp-content/jejelaye.asp.htm">
http://www.natwest.com/security/online-accounts.aspx</a><br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<br style="line-height:15.921875px;outline:none;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
<span id="yiv2044481656yui_3_7_2_1_1376823391428_4216" style="color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:15.921875px;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);display:inline;float:none;">
Account Department<p id="yiv2044481656yui_3_7_2_1_1376823391428_4218" style="margin:0px;padding:0px;line-height:15.921875px;outline:none;display:block;color:rgb(0, 0, 0);font-family:arial, helvetica, clean, sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255, 255, 255);">
National
Westminster Bank

</div>

Gambisk · 17 Apr 2014 at 12:17

The interwebs scammers??

No idea, where it originated from but the link takes you to some dodgy phishing website. So safe to say it's not from your bank. Mark it up as spam and move on.

Edit: removed dodgy link.

Nymins · 17 Apr 2014 at 12:22

From: NatWest <[email protected]>

Scam I guess.

Tattooed · 17 Apr 2014 at 12:30

Hi,
I know it's a scam. Just want to know where these e-mails are coming from.

Nymins · 17 Apr 2014 at 12:36

Tattooed said:
Hi,
I know it's a scam. Just want to know where these e-mails are coming from.

China, Nigeria, does it really matter? They get bounced around all over the place, so tracking down the computer that it came from isn't particularly easy.

ots3go · 17 Apr 2014 at 12:53

Looks like http://who.is/whois-ip/ip-address/65.20.0.12 which has failed the SPF check for the domain.

Abuse complaint over to [email protected].