Password theft phishing - "FW: Re: Checking Wire Conf"

From: Brad Ashton <brad.ashton@ccv.net>
To: brad.ashton@ccv.net
Cc: 
Date: Thu, 07 Nov 2013 15:07:18 -0800
Subject: FW: Re: Checking Wire Conf

Hello

Good Morning!

My name is Brad and I was asked by John to forward you a copy of the checking account transfer that was completed this morning.

I have uploaded it for you to confirm the information, click here <http://www.corconsulting.net/images/doc/docs.google.com/> to confirm now.

Let me know if you have any questions.

Thanks,

Brad Ashton.

the link is 404 now and cannot be accessed

Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: binary

Received: from xxx by na3sys009amx185.postini.com ([74.125.148.10]) with SMTP;
 Thu, 07 Nov 2013 15:09:02 GMT 

AjYpAGmse1KAenbxnGdsb2JhbABbHoMhRwEBSawoAZNLFg4BAQEBAQgLCQkUKIIcCQGBGgMBHQwoPgEGE4gKDZtPjzWSJY9qDIQaA4kIOI8ChgePFIFJ
X-IPAS-Result: AjYpAGmse1KAenbxnGdsb2JhbABbHoMhRwEBSawoAZNLFg4BAQEBAQgLCQkUKIIcCQGBGgMBHQwoPgEGE4gKDZtPjzWSJY9qDIQaA4kIOI8ChgePFIFJ
X-IronPort-AV: E=Sophos;i="4.93,652,1378872000"; 
   d="scan'208,217";a="543202289"
Received: from mx1.nyu.edu ([128.122.118.241])
  by iron1-mx.tops.gwu.edu with ESMTP; 07 Nov 2013 10:08:50 -0500
Received: from [81.17.28.200] (DEVWWW.NYU.EDU [128.122.108.192])
 by mx1.nyu.edu (8.13.8/8.13.8) with ESMTP id rA7Eth51018777;
 Thu, 7 Nov 2013 10:08:09 -0500 (EST)
Message-Id: <201311071508.rA7Eth51018777@mx1.nyu.edu>
Content-Type: multipart/alternative; boundary="===============0835071548=="
MIME-Version: 1.0
Subject: FW: Re: Checking Wire Conf
To: brad.ashton@ccv.net
From: Brad Ashton <brad.ashton@ccv.net>
Date: Thu, 07 Nov 2013 15:07:18 -0800