Lame phising mail
 

Just got mail with following content:
Canceled Transfer

Transfer id:
48369

Reason for rejection
View details in the report below

Transfer report
(url leading to some in domain) report_43237.pdf.exe (self-extracting archive, Adobe PDF)


13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171, (703) 561-1100

2012 NACHA - The Electronic Payments Association
It's obvious how it's phishing since it's url leading to exe file plus in extension domain,really lame attempt to install malware into computer.But the real question is,how did they got e-mail adress?Since i use that e-mail only for ccbill sponsors,so it's seems some sponsor db could be compromised.I suppose i really need to use unique mail for each sponsor to know who exactly is compromised in such situations.
Here i pasted full message source:
http://pastebin.com/1a073pZy

Click it, scaredie cat!