Business AOL Spam

From - Thu Jul 12 09:00:30 2012

X-Account-Key: account2

X-UIDL: mj%#!*kG"!3?G"!4eW!!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: **

X-Spam-Status: No, score=3.1 required=5.0 tests=DKIM_SIGNED,FORGED_MUA_OUTLOOK,

FORGED_OUTLOOK_TAGS autolearn=no version=3.3.2

X-Original-To: aboo@doctor.nl2k.ab.ca

Delivered-To: aboo@doctor.nl2k.ab.ca

Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id 89F2712CFA89

for ; Thu, 12 Jul 2012 09:00:19 -0600 (MDT)

X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca

Authentication-Results: doctor.nl2k.ab.ca (amavisd-new);

dkim=fail (1024-bit key) reason="fail (body has been altered)"

header.d=mx.aol.com

Received: from doctor.nl2k.ab.ca ([127.0.0.1])

by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id pK6FUhxXiKyI for ;

Thu, 12 Jul 2012 09:00:16 -0600 (MDT)

Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)

id F026112CFA82; Thu, 12 Jul 2012 09:00:13 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Thu, 12 Jul 2012 09:00:13 -0600

Resent-Message-ID: <20120712150013.GJ21956@doctor.nl2k.ab.ca>

Resent-To: See root

X-Original-To: doctor@nl2k.ab.ca

Delivered-To: doctor@nl2k.ab.ca

Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id E802312CFA86

for ; Thu, 12 Jul 2012 05:14:05 -0600 (MDT)

X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca

Received: from doctor.nl2k.ab.ca ([127.0.0.1])

by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id jqa1I6FAf-YK for ;

Thu, 12 Jul 2012 05:14:03 -0600 (MDT)

Received: from oms-mb03.r1000.mx.aol.com (oms-mb03.r1000.mx.aol.com [64.12.102.139])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id F1D5512CFA82

for ; Thu, 12 Jul 2012 05:14:02 -0600 (MDT)

Received: from mtaout-da05.r1000.mx.aol.com (mtaout-da05.r1000.mx.aol.com [172.29.51.133])

by oms-mb03.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id B10381C000136;

Thu, 12 Jul 2012 07:13:55 -0400 (EDT)

Received: from User (c-71-229-37-44.hsd1.ga.comcast.net [71.229.37.44])

by mtaout-da05.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPA id 59268E000087;

Thu, 12 Jul 2012 07:13:48 -0400 (EDT)

Reply-To:

From: "Michael Kelvin"

Subject: [Norton AntiSpam]***SPAM**
REPLY ASAP

Date: Thu, 12 Jul 2012 06:15:52 -0500

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_00DA_01C2A9A6.64D907DC"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

x-aol-global-disposition: S

X-AOL-VSS-INFO: 5400.1158/82172

X-AOL-VSS-CODE: clean

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;

s=20110426; t=1342091635;

bh=7s+wMYb4YMq7W0Qpen7CbbzYrxatQ1v1sw7PEVqLCKc=;

h=From:Subject:Date:MIME-Version:Content-Type;

b=aQqcQ8sD/+6HoSoMaTtp22RzxAtvjHXj7hdhn50q35ydEOZyGBZGBPZPU2wp9sbHH

I6PYKNXhhuYLuzp9G0Fq9yudza4CtJXEPyH0yGJ+ZsbMQXxtCx/pvgDnCXXHrdaB/s

tTbgUvGyObe0Q8kSYtJo8bMpyo4BlyaIs8Z0S03s=

X-AOL-SCOLL-SCORE: 0:2:326454240:93952408

X-AOL-SCOLL-URL_COUNT: 0

X-AOL-REROUTE: YES

x-aol-sid: 3039ac1d33854ffeb16c09cb

X-AOL-IP: 71.229.37.44

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-UIDL: mj%#!*kG"!3?G"!4eW!!

X-Brightmail-Tracker: AAAAChrot4EZCEfjFCtF0hGsP2UbETzWGxIbDRsSLU0bEij4GxI1lhsSNSM=



This is a multi-part message in MIME format.



------=_NextPart_000_00DA_01C2A9A6.64D907DC

Content-Type: text/html;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit















Hello





 





I have a very important business, which is the reason i contacted you today. please read the complete message in the attachment and reply urgently.









------=_NextPart_000_00DA_01C2A9A6.64D907DC

Content-Type: application/octet-stream;

name="Letter from Michael kelvin.rtf"

Content-Transfer-Encoding: base64

Content-Disposition: attachment;

filename="Letter from Michael kelvin.rtf"



e1xydGYxXGFuc2lcYW5zaWNwZzEyNTJcZGVmZjBcZGVmbGFuZzEwMzN7XGZv

bnR0Ymx7XGYwXGZzd2lzc1xmY2hhcnNldDAgQXJpYWw7fX0NCntcKlxnZW5l

cmF0b3IgTXNmdGVkaXQgNS40MS4yMS4yNTAwO31cdmlld2tpbmQ0XHVjMVxw

YXJkXGYwXGZzMjAgSGVsbG8sXHBhcg0KXHBhcg0KSG93IGFyZSB5b3UgYW5k

IHlvdXIgZmFtaWx5PyBJIGhvcGUgeW91IGFyZSBpbiBnb29kIGhlYWx0aC4g

SSB3YW50IHlvdSB0byByZWFkIHRoaXMgbWVzc2FnZSB3aXRoIHVuZGVyc3Rh

bmRpbmcuXHBhcg0KXHBhcg0KSSBhbSBNaWNoYWVsIEtlbHZpbiwgUGxlYXNl

IGkgaGF2ZSB0byBiZSBicmllZiBoZXJlIGZvciBzZWN1cml0eSByZWFzb25z

IGFuZCBpIHdhbnQgeW91IHRvIGJlYXIgd2l0aCBtZS4gSSB3b3JrIHdpdGgg

YSBiYW5rIGhlcmUgaW4gdGhlIFVuaXRlZCBLaW5nZG9tLCBhbmQgaSBjb250

YWN0ZWQgeW91IHRvIGFzc2lzdCBtZSBpbiB0aGlzIGJ1c2luZXNzIHRyYW5z

YWN0aW9uLCBhcyBpIG5lZWQgeW91ciBhc3Npc3RhbmNlIGluIGFwcGx5aW5n

IGZvciB0aGUgbmV4dCBvZiBraW4gdG8gbXkgTGF0ZSBjdXN0b21lcidzIGFj

Y291bnQsIHdobyBkaWVkIG9mIGNhbmNlciBhZnRlciB5ZWFycyBvZiBzdHJ1

Z2dsaW5nIHdpdGggdGhlIGRpc2Vhc2UuXHBhcg0KXHBhcg0KSGUgd2FzIGEg

d2VhbHRoeSBCdXNpbmVzcyBtYW4gd2hvIGRlcG9zaXRlZCBhIGh1Z2UgYW1v

dW50IGluIG91ciBiYW5rLiBIZSBkaWVkIHdpdGhvdXQgcmVnaXN0ZXJlZCBu

ZXh0IG9mIGtpbiBhcyBoZSB3YXMgYSBkaXZvcmNlZSBhbmQgaGFkIG5vIGNo

aWxkLiBTbyB0aGlzIGFjY291bnQgaGFzIGFuIG9wZW4gYmVuZWZpY2lhcnkg

bWFuZGF0ZSwgbWVhbmluZyB0aGF0IGFueWJvZHkgY2FuIGFwcGx5IGFzIHRo

ZSBuZXh0IG9mIGtpbiBhbmQgaSBoYXZlIGdlbnVpbmUgcmVhc29uIGZvciBj

b250YWN0aW5nIHlvdSB0byBzdGFuZCBhcyB0aGUgbmV4dCBvZiBraW4gdG8g

dGhpcyBhY2NvdW50LiBJIHdpbGwgZ2l2ZSB5b3UgbXkgcmVhc29ucyBhbmQg

dGhlIGNvbXBsZXRlIGluZm9ybWF0aW9uIG9mIHRoaXMgYWNjb3VudCBieSB0

aGUgdGltZSBpIHJlY2VpdmUgeW91ciBpbnRlcmVzdC5ccGFyDQpccGFyDQpQ

bGVhc2UgZW5kZWF2b3IgdG8gcHJvdmlkZSBtZSB0aGUgZm9sbG93aW5nIGJl

bG93IGluIHlvdXIgcmVwbHk6XHBhcg0KXHBhcg0KRnVsbCBOYW1lOlxwYXIN

CkNvbnRhY3QgQWRkcmVzczpccGFyDQpQcm9mZXNzaW9uOlxwYXINCkFnZTpc

cGFyDQpNb2JpbGUgUGhvbmU6XHBhcg0KXHBhcg0KSSB1cmdlbnRseSBob3Bl

IHRvIGdldCB5b3VyIHJlc3BvbnNlIGFzIHNvb24gYXMgcG9zc2libGUuXHBh

cg0KXHBhcg0KWW91cnMgU2luY2VyZWx5LFxwYXINClxwYXINCk1yLk1pY2hh

ZWwgS2VsdmluXHBhcg0KfQ0KAA==



------=_NextPart_000_00DA_01C2A9A6.64D907DC

Content-Type: text/sanitizer-log; charset="iso-8859-1"

Content-Transfer-Encoding: 8bit

Content-Disposition: attachment; filename="sanitizer.log"



This message has been 'sanitized'. This means that potentially

dangerous content has been rewritten or removed. The following

log describes which actions were taken.



Sanitizer (start="1342091647"):

Part (pos="2568"):

SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):

Match (names="unnamed.html, filetype.html", rule="2"):

Enforced policy: accept



Note: Styles and layers give attackers many tools to fool the

user and common browsers interpret Javascript code found

within style definitions.



Rewrote HTML tag: >>_DIV_<<

as: >>_p__DEFANGED_DIV_<<

Rewrote HTML tag: >>_/DIV_<<

as: >>_/p__DEFANGED_DIV_<<

Rewrote HTML tag: >>_DIV_<<

as: >>_p__DEFANGED_DIV_<<

Rewrote HTML tag: >>_/DIV_<<

as: >>_/p__DEFANGED_DIV_<<

Rewrote HTML tag: >>_DIV_<<

as: >>_p__DEFANGED_DIV_<<

Rewrote HTML tag: >>_/DIV_<<

as: >>_/p__DEFANGED_DIV_<<



Part (pos="3169"):

SanitizeFile (filename="Letter from Michael kelvin.rtf", mimetype="application/octet-stream"):

Match (names="Letter from Michael kelvin.rtf", rule="2"):

Enforced policy: accept



Total modifications so far: 6





Anomy 0.0.0 : Sanitizer.pm

$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $



------=_NextPart_000_00DA_01C2A9A6.64D907DC--







Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA