The Facebook Security Team

Got a facebook account? Maybe you'd like to get it fixed because a hacker just got in...

The link was:

interstaterescue.net/lib.php?fb=5a76KVsd6NSgvMxz9dEVVef8s7iY+fH5+gocjjcfRHY=

which looks very similar to a link Facebook would send you, but really... they would NEVER use a 3rd party like that for the purpose stated here. Anyway, if you gave away your password following such a link, good luck to you!


Return-Path: <zmjsdate1483de@idefix7.rt.cmo.de>
X-Original-To: alexis@m2osw.com
Delivered-To: alexis@m2osw.com
X-Greylist: delayed 344 seconds by postgrey-1.34 at jc; Sat, 13 Dec 2014 13:20:55 PST
Received: from idefix7.rt.cmo.de (idefix7.rt.cmo.de [81.90.33.94])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail.m2osw.com (Postfix) with ESMTPS id 7F9F7CE0321
	for ; Sat, 13 Dec 2014 13:20:55 -0800 (PST)
Received: by idefix7.rt.cmo.de (Postfix, from userid 10016)
	id 58C3328807D9; Sat, 13 Dec 2014 22:14:02 +0100 (CET)
To: alexis@m2osw.com
Subject: Facebook password change
X-PHP-Originating-Script: 10016:object.php(241) : eval()'d code
From: "Facebook" <notification@mjs-datenservice.de>
X-Mailer: Fscfz(ver.2.75)
Reply-To: "Facebook" <notification@mjs-datenservice.de>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------1418505242548CAC1A18B06"
Message-Id: <20141213211402.58C3328807D9@idefix7.rt.cmo.de>
Date: Sat, 13 Dec 2014 22:14:02 +0100 (CET)
  facebook
   
    Hi,

Your Facebook password was been reset on Saturday, December 13, 2014 at 09:13PM (UTC) due to suspicious activity of your account.


Operating system: Windows
Browser: Google Chrome
IP address: 191.218.108.178
Estimated location: Lincoln, MO, US

To restore the password complete this form, please, your request will be considered within 24 hours.

Thanks,
The Facebook Security Team
  Facebook, Inc., Attention: Department 425, PO Box 10005, Palo Alto, CA 94303