Yahoo! Spam from hijacked accounts

Posted by Dave Yadallee on
Specimen 1)



From jokorea36@yahoo.ca Wed Feb 20 05:56:18 2013

Return-Path: jokorea36@yahoo.ca

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ****

X-Spam-Status: No, score=4.6 required=5.0 tests=DKIM_SIGNED,NOTVALID_YAHOO,

RCVD_IN_BACKSCATTER,TW_JX,TW_XH autolearn=no version=3.3.2

X-Original-To: root@doctor.nl2k.ab.ca

Delivered-To: root@doctor.nl2k.ab.ca

Received: from nm39-vm6.bullet.mail.bf1.yahoo.com

(nm39-vm6.bullet.mail.bf1.yahoo.com [72.30.239.150]) (using TLSv1 with

cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate

requested) by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 3305112CFA82

+for

; Wed, 20 Feb 2013 05:55:34 -0700 (MST)

Received: from [98.139.212.152] by nm39.bullet.mail.bf1.yahoo.com with NNFMP;

20 Feb 2013 12:55:26 -0000

Received: from [98.139.212.206] by tm9.bullet.mail.bf1.yahoo.com with NNFMP; 20

Feb 2013 12:55:26 -0000

Received: from [127.0.0.1] by omp1015.mail.bf1.yahoo.com with NNFMP; 20 Feb

2013 12:55:26 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: 142745.22289.bm@omp1015.mail.bf1.yahoo.com

Received: (qmail 73411 invoked by uid 60001); 20 Feb 2013 12:48:46 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s1024;

t=1361364526; bh=Xv9OdnwUS82/xfUDaG7yUb4fhFx9Cprtj+Y4iBpSXmk=;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=Ae69qUarB4/FFkSAd4+SQsJVNT1iThIPyMH23Yf0mRqED9FamZNewVUpo/4H+V7j2nus6s

evwswVMCAfEPEHEyddISDGzDFExQQyJbl2/t/lo81CImfiSxB6/LnqG9+63CndutXXaydqwI

W5Vgdw2HN7hFt3dOOvSBg4QFv1R4w=

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.ca;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=qPK3g+LS7l5cyy1igWy81aawgNlIOtuidWboxbfETVx3cWmKbLDhuxToe8aDMfm7FHkdMn

kH3gom0T9T39NALvI5/JcEk2dA/q+s/Z1gxsi/m25Byu+L4gyqCxpEbVcaeC49X9djtmB/Mn

Kk7H+mDJntNw+YldaOIZunRMiqa9M=;

X-YMail-OSG: Mrb4F7YVM1lr5JffIFTIlqN12UQohO6w.6zFnVRaQvgCvvf

18wF_RiKmolRAMEbN0giv4PUQkNnlKL6.6iDCxhDSx8zBq4EZdyMlXzdoPzy

aRk1cwdiST9arHzvOlKEXEpPzjVeLkwI88qyk1nuxS64H9bUZZrDNU._G9u9

f6TRckbxzhHJmCANH4_W8aCj8QJS27nf.jG0.8l3YpLqUgDvlZMqOJ8Mnnzt

76rpf22lwgEM8uXi.oKjSbucjzUCaAkg8QFdJmE56qKkGWvRKxEOOKqzL8xL

.j1vjmQwHxwRIKaUTNBThQK8P7xTyST4vxidDRPSDrQq0O6fXBRNrgSReeRE

OYwEjinc38AXIi.A1pBLLCAS.hHx3mk0ExJ6b8UCmyV9CDt7jdSUVGe2KrwC

QxkOipIf0af48pi9rExOq_Y_c.09khUa8olKRKtsIyfy8zSvjd8G3exTSACG

V4qKM6.m7akFxUd6CC77XsN66HGw7BhVY2m6ohY3S0hgEU35hsBlja6ZOIpJ

cUqRFJR9LWNFw2Pp4n.3LT23Wi622vtcgLkq_Bvcd6wVyUKRqrr90ST6qqnK

OgmFnMWDeF6ZMUpiVhhmk8XdRBL5JvxPUqtCOIwNJACo5BX3L5FNv4IBbDHf

2pwUDF8bUusY58wEKih9M

Received: from [95.135.136.9] by web140606.mail.bf1.yahoo.com via HTTP; Wed, 20

Feb 2013 04:48:46 PST

X-Rocket-MIMEInfo:

001.001,aHR0cDovL3d3dy5sZXNtaWVsc2RlbW9ubW91bGluLmNvbS9mY25ydXRjL2oxempw

ZTQyNzN1eHhmZWRwMnQwZDlqay4xMm1jP2FxZnF4aWYzanpsaHZ1bXR2OXI3IAoKCgoKCgpC

aWxsaS1KbyBJcndpbiAKCiAKCgoyLzIwLzIwMTMgMTo0ODo0NSBQTQoKCgoKCgoKCgoKCgoK

CnZjcCBudXMgdHV3aCBlbGp4aHABMAEBAQE-

X-Mailer: YahooMailWebService/0.8.134.513

Message-ID: <1361364526.41205.YahooMailNeo@web140606.mail.bf1.yahoo.com>

Date: Wed, 20 Feb 2013 04:48:46 -0800 (PST)

From: Billi-Jo Irwin

Reply-To: Billi-Jo Irwin

Subject: RE:Billi-Jo Irwin

To: root , amichael202 ,

meynberg ,

John Faber ,

peng tan ,

eikelandpaul ,

bkamphius ,

jdtremblay , ctm e

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1905101558-1130670243-1361364526=:41205"

X-NetKnow-InComing-4-84-5-2-MailScanner-Information: Please contact the ISP for

more information

X-NetKnow-InComing-4-84-5-2-MailScanner-ID: 3305112CFA82.A0B2F

X-NetKnow-InComing-4-84-5-2-MailScanner: Found to be clean

X-NetKnow-InComing-4-84-5-2-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-84-5-2-MailScanner-SpamScore: s

X-NetKnow-InComing-4-84-5-2-MailScanner-From: jokorea36@yahoo.ca

X-NetKnow-InComing-4-84-5-2-MailScanner-Watermark:

1361796935.89456@+PSm77uUqgtUGPqGCktBgQ

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

Status: RO

Content-Length: 3671

Lines: 98



Content-Type: text/plain; charset=us-ascii



http://www.lesmielsdemonmoulin.com/fcnrutc/j1zjpe4273uxxfedp2t0d9jk.12mc?aqfqxif

+3jzlhvumtv9r7













Billi-Jo Irwin









2/20/2013 1:48:45 PM





























vcp nus tuwh eljxhp

--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.







Specimen 2)



From flooringoutfitters@yahoo.ca Wed Feb 20 01:15:54 2013

Return-Path: flooringoutfitters@yahoo.ca

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ****

X-Spam-Status: No, score=4.5 required=5.0 tests=DKIM_SIGNED,NOTVALID_YAHOO,

RCVD_IN_BACKSCATTER autolearn=no version=3.3.2

X-Original-To: aboo@nk.ca

Delivered-To: aboo@nk.ca

Received: from nm32-vm8.bullet.mail.gq1.yahoo.com

(nm32-vm8.bullet.mail.gq1.yahoo.com [98.136.216.231]) (using TLSv1 with

cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate

requested) by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 7CB9212CFA85

+for

; Wed, 20 Feb 2013 01:14:12 -0700 (MST)

Received: from [98.137.12.55] by nm32.bullet.mail.gq1.yahoo.com with NNFMP; 20

Feb 2013 08:14:06 -0000

Received: from [98.137.12.48] by tm15.bullet.mail.gq1.yahoo.com with NNFMP; 20

Feb 2013 08:14:06 -0000

Received: from [127.0.0.1] by omp1063.mail.gq1.yahoo.com with NNFMP; 20 Feb

2013 08:14:06 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: 257270.62035.bm@omp1063.mail.gq1.yahoo.com

Received: (qmail 27644 invoked by uid 60001); 20 Feb 2013 08:14:05 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s1024;

t=1361348045; bh=MGh6OxBk9kn3ozOO+6EOYFt+DfVWM5WsH2mfEYG2bNg=;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=wpVJ79NDTblv16Hzx/yUB2l5NmGiKKCkEuYwIOJfbXMGowjN+JI5JogG5hJHbDUDxZ78u1

ooyfe8qm6NIeetyqFHMfIha1PSw/dURSQfjrsUtalUlBjxavjQjVW4054+jPAnueW/Sbqo/j

aX6DsrvLWmn+BKTuN1vNdnDR4EtAs=

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.ca;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=nsIQQGNyDcZdL7Lxd0/j0wYRehSbA3bcpZrCQUPXKB2inhi+1XmJNwPb6B9ibvPKa1Cv2F

02TSYkvzjwTlVOe5PAh0KcIPCOtvTfTzJA0mqIggMDn+a0OPwlTUaGY5DiLWHdvhrMkqvVle

HZc7dmV/xvzsbm+KsMQzTJbgdGRh4=;

X-YMail-OSG: ZCUWSI4VM1lM2_Ja5PU_KAf9LRT5GmWrG7ti1lcjWKnWArZ

_RzkoohazevLuRY_OjdYZ

Received: from [89.239.114.38] by web163606.mail.gq1.yahoo.com via HTTP; Wed,

20 Feb 2013 00:14:05 PST

X-Rocket-MIMEInfo:

001.001,aHR0cDovL3d3dy5tYWNyb21hcmtldGluZ3NvbHV0aW9ucy5jb20vY2xwYWllL2ph

OGVteWpzajR5ODJjNWdqNnp6dGFjdi41ajUybT9uM25yaDJrbGs4ZGV5YWs1cWI2dnFvazRt

NzUgCgoKCgoKCkdhcnkgR2F1bGV5IAoKIAoKCjIvMjAvMjAxMyA5OjE0OjA0IEFNATABAQEB

X-Mailer: YahooMailWebService/0.8.134.513

Message-ID: <1361348045.26792.YahooMailNeo@web163606.mail.gq1.yahoo.com>

Date: Wed, 20 Feb 2013 00:14:05 -0800 (PST)

From: Gary Gauley

Reply-To: Gary Gauley

Subject: Gary Gauley

To: info ,

armstrong ,

mercier , info ,

lauzon ,

scott stewart ,

scottstewart , Aboo Yadalee ,

Alisha Webb

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="-1147583323-719735729-1361348045=:26792"

X-NetKnow-InComing-4-84-5-2-MailScanner-Information: Please contact the ISP for

more information

X-NetKnow-InComing-4-84-5-2-MailScanner-ID: 7CB9212CFA85.ADE2D

X-NetKnow-InComing-4-84-5-2-MailScanner: Found to be clean

X-NetKnow-InComing-4-84-5-2-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-84-5-2-MailScanner-From: flooringoutfitters@yahoo.ca

X-NetKnow-InComing-4-84-5-2-MailScanner-Watermark:

1361780057.51107@nA4IH9uSOfdgKlKm5R9z2w

X-UID: 343491

X-Keywords: NonJunk

Status: RO

Content-Length: 1194

Lines: 33



Content-Type: text/plain; charset=us-ascii



http://www.macromarketingsolutions.com/clpaie/ja8emyjsj4y82c5gj6zztacv.5j52m?n3n

+rh2klk8deyak5qb6vqok4m75













Gary Gauley



2/20/2013 9:14:04 AM

--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.





Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA