Verizon-based Paypal phish

From srvs@notification.no Mon Sep 15 05:15:22 2008

Return-Path: srvs@notification.no

Received: from vms172065pub.verizon.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8FBEH43020116

for ; Mon, 15 Sep 2008 05:14:23 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from User ([67.95.121.2]) by vms172065.mailsrvcs.net

(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))

with ESMTPA id <0K78002ROHVL8XRF@vms172065.mailsrvcs.net> for

root@nk.ca; Mon, 15 Sep 2008 06:14:12 -0500 (CDT)

Date: Mon, 15 Sep 2008 08:12:10 -0500

From: "service@paypal.com"

Subject: {?} You Have 1 New Security Message Alert!

X-Originating-IP: [67.95.121.2]

To: Undisclosed recipients: ;

Message-id: <0K78002RSHVL8XRF@vms172065.mailsrvcs.net>

MIME-version: 1.0

X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

Content-type: text/plain; charset=Windows-1251

Content-transfer-encoding: 7bit

X-Priority: 3

X-MSMail-priority: Normal

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8FBEH43020116

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, spamhaus-ZEN,

spamhaus-XBL, SBL+XBL, CBL, SpamAssassin (not cached, score=9.927,

required 5, BAYES_99 3.50, FORGED_MUA_OUTLOOK 3.12,

NORMAL_HTTP_TO_IP 0.00, RCVD_IN_XBL 3.20, RDNS_NONE 0.10,

RELAY_CHECKER 0.00, RELAY_CHECKER_IPHOSTNAME 0.01)

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: srvs@notification.no

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1221909269.73737@MAj7E7DsOIKWeuEL/O1ulw

X-Spam-Status: Yes



Dear PayPal customer,



As part of our security measures, we regularly screen activity in the PayPal

+system. We recently contacted you after noticing an issue on your account.



Our system detected unusual attempts to log in to your PayPal account from

+diffrent ip locations.



In accordance with PayPal's User Agreement, your account access will remain

+limited until the issue has been resolved. Unfortunately, if access to your

+account remains limited for an extended period of time, it may result in

+further limitations or eventual account closure. We encourage you to log in to

+your PayPal account as soon as possible to help avoid this.



Please update and verify your information by checking the link below:

If you can't open this link from email just copy to your internet browser.



http://66.49.165.226/users/alex/update/account/login.php



Once you log in, you will be provided with steps to restore your account access.+We appreciate your understanding as we work to ensure account safety.



To review your account and some or all of the information that PayPal used to

+make its decision to limit your account access, please visit the Resolution

+Center. If, after reviewing your account information, you seek further

+clarification regarding your account access, please contact PayPal by visiting

+the Help Center and clicking "Contact Us".



We thank you for your prompt attention to this matter. Please understand that

+this is a security measure intended to help protect you and your account. We

+apologize for any inconvenience.



Sincerely,

PayPal Account Review Department



PayPal Email ID PP638





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More Nigerian Yahoo! Spam

From barrgillmartin03@yahoo.com Mon Sep 15 00:08:20 2008

Return-Path: barrgillmartin03@yahoo.com

Received: from n6c.bullet.mail.ac4.yahoo.com

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8F67eo6025660

for ; Mon, 15 Sep 2008 00:07:46 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from [76.13.13.26] by n6.bullet.mail.ac4.yahoo.com with NNFMP; 15 Sep

2008 06:07:40 -0000

Received: from [76.13.10.183] by t3.bullet.mail.ac4.yahoo.com with NNFMP; 15

Sep 2008 06:07:40 -0000

Received: from [127.0.0.1] by omp124.mail.ac4.yahoo.com with NNFMP; 15 Sep 2008

06:07:40 -0000

X-Yahoo-Newman-Property: ymail-5

X-Yahoo-Newman-Id: 640024.15096.bm@omp124.mail.ac4.yahoo.com

Received: (qmail 83506 invoked by uid 60001); 15 Sep 2008 06:07:40 -0000

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=ymail_nen1; d=yahoo.com;

h=Received:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Conte

nt-Transfer-Encoding:Message-ID;

b=gD4xvGAUVpa7iNesqI+IqI9qwzl5jl7UpRrEzlorVl1Nc59j7HWMR8GZi0znDn8ZdwLdxR

jqjGooXyP4sFeWFgPmVm5JPyGCBQX6kUBPyZUrMfBn7XAumK/DdpLUKbELy3l25SWk+ei/CU

SbfU2bW47Fpfaxx5SGxGVvGPuGPjs=;

Received: from [203.55.231.100] by web59603.mail.ac4.yahoo.com via HTTP; Sun,

14 Sep 2008 23:07:40 PDT

Date: Sun, 14 Sep 2008 23:07:40 -0700 (PDT)

From: Barrister Gill Martins

Reply-To: barristergillmartins@yahoo.in

Subject: {?} EMAIL ME BACK FOR MORE DETAILS.

To: root@nk.ca

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="0-1819515902-1221458860=:77507"

Content-Transfer-Encoding: 8bit

Message-ID: <440290.77507.qm@web59603.mail.ac4.yahoo.com>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8F67eo6025660

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam,

RFC-IGNORANT-POSTMASTER, RFC-IGNORANT-ABUSE, RFC-IGNORANT-WHOIS,

SpamAssassin (not cached, score=13.601, required 5, BAYES_99 3.50,

HTML_MESSAGE 0.00, RDNS_NONE 0.10, SUBJ_ALL_CAPS 10.00)

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssssssss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: barrgillmartin03@yahoo.com

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1221890867.90185@xxilwclSXLrClIOvorYmBQ

X-Spam-Status: Yes



Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: 8bit



I have a new email address!You can now email me at: barrgillmartin03@yahoo.com



YOU HAVE BEEN SELECTED FOR THE PAYMENT OF 6.2M AS THE NEXT OF KIN BEQUEST.



- Barrister Gill Martins





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More investment Bell Canada Spam

From k.macdonald@pei.sympatico.ca Mon Sep 15 06:53:23 2008

Return-Path: k.macdonald@pei.sympatico.ca

Received: from tomts23-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8FCqCh3024122

for ; Mon, 15 Sep 2008 06:52:18 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from toip36-bus.srvr.bell.ca ([67.69.240.37])

by tomts23-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080915125207.EOTL2576.tomts23-srv.bellnexxia.net@toip36-bus.srvr.bell

.ca>; Mon, 15 Sep 2008 08:52:07 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: Aks7AI7wzUjR4q/5/2dsb2JhbACKIIkjnj+ERYEFgTw

Received: from tofep1.bellnexxia.net (HELO smtp.bellnexxia.net)

([209.226.175.249]) by toip36-bus.srvr.bell.ca with SMTP; 15 Sep 2008

08:51:55 -0400

X-Mailer: Openwave WebEngine, version 2.8.11 (webedge20-101-194-20030622)

X-Originating-IP: [200.50.111.194]

From: "CHINA JEWELLERY CO. LTD"

Reply-To: mr.koji_watanabe147@live.com

Organization: CHINA JEWELLERY CO. LTD

To: humanresourcesdept@chinajewellery.com

Subject: {?} WORK WITH US

Date: Mon, 15 Sep 2008 8:51:55 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 7bit

Message-Id:

<20080915125207.EOTL2576.tomts23-srv.bellnexxia.net@toip36-bus.srvr.bell

.ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8FCqCh3024122

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam,

SpamAssassin (not cached, score=18.61, required 5, autolearn=spam,

BAYES_99 3.50, BOTNET 5.00, RDNS_NONE 0.10, RELAY_CHECKER 0.00,

RELAY_CHECKER_BADDNS 0.01, SUBJ_ALL_CAPS 10.00)

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: ssssssssssssssssss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: k.macdonald@pei.sympatico.ca

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1221915138.63758@eaCOgAnHqikIzD8vzscYOQ

X-Spam-Status: Yes



We are China jewellery company based in China,Please we are interested in

+employing your service to work with us as our claims/representative agent. If

+interested, Please contact us for more informations.



as we awaits your response.

Kindest Regards,

Mr. Koji Watanabe

Email:mr.koji_watanabe147@live.com





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.