Example 194: Warning: Inbox for xxxx@umn.edu is limited [13 undelivered messages]

Fake warning message linked to bogus login page.

Message Text

Subject:    Warning: Inbox for xxxx@umn.edu is limited [13 undelivered messages]
Date:   Fri, 07 Apr 2017 17:29:15 +0100
From:   Mail Delivery Subsystem <bounced-emails@postmaster.net>
To:     xxx@umn.edu


 
This message was created automatically by mail delivery software.
More than 5 incoming messages could not be delivered to your inbox since over 72 hours.
The following address(es) failed: READ Your Undelivered Messages On Server
<https://xxxxxxx.com solution/Retrieve.html?xxxxr@umn.edu>

host smtp.mailchannels.net [54.214.250.163]
SMTP error from remote mail server after end of data:
550 5.7.1 [CS] Messages blocked MAIL FOR: xxxx@umn.edu <mailto:xxxx@umn.edu>. If
you receive this email in your SPAM/JUNK, Kindly move to inbox as to enable you complete the verification. 

Login Form

fake error screen with user name filled in from URL

Things to Note

• Message is customize with email address in message and subject
• URL linking to form includes the email address
• Webform fills in the user name from the URL - but would put any name in if you change the URL