Scamming AOL Spam
Posted by Dave Yadallee onX-Account-Key: account2
X-UIDL: "E>"!Wnn!!~QP"!So;!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Level: **
X-Spam-Status: No, score=3.1 required=5.0 tests=DKIM_SIGNED,FORGED_MUA_OUTLOOK,
FORGED_OUTLOOK_TAGS autolearn=no version=3.3.2
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 162F312CFA82
for
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Authentication-Results: doctor.nl2k.ab.ca (amavisd-new);
dkim=fail (1024-bit key) reason="fail (message has been altered)"
header.d=mx.aol.com
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id OJD2jpLWrtab for
Thu, 12 Jul 2012 13:40:14 -0600 (MDT)
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 20EFF12CFA86; Thu, 12 Jul 2012 13:40:14 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Thu, 12 Jul 2012 13:40:14 -0600
Resent-Message-ID: <20120712194014.GA22976@doctor.nl2k.ab.ca>
Resent-To: See root
X-Original-To: doctor@doctor.nl2k.ab.ca
Delivered-To: doctor@doctor.nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 95D1C12CFA8A
for
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id D6VhLxV7g-An for
Thu, 12 Jul 2012 11:21:58 -0600 (MDT)
Received: from oms-mb02.r1000.mx.aol.com (oms-mb02.r1000.mx.aol.com [64.12.102.138])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 619EB12CFA82
for
Received: from mtaout-da01.r1000.mx.aol.com (mtaout-da01.r1000.mx.aol.com [172.29.51.129])
by oms-mb02.r1000.mx.aol.com (AOL Outbound OMS Interface) with ESMTP id A5EA11C0004E5;
Thu, 12 Jul 2012 13:21:51 -0400 (EDT)
Received: from User (unknown [64.122.225.69])
by mtaout-da01.r1000.mx.aol.com (MUA/Third Party Client Interface) with ESMTPA id 771EEE0000AB;
Thu, 12 Jul 2012 13:21:48 -0400 (EDT)
Reply-To:
From: "Mrs. Maria Elena Quintero Rivillas"
Subject: [Norton AntiSpam]***SPAM**
respond
Date: Thu, 12 Jul 2012 12:21:52 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_008D_01C2A9A6.39D3EA76"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
x-aol-global-disposition: S
X-AOL-VSS-INFO: 5400.1158/82172
X-AOL-VSS-CODE: clean
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com;
s=20110426; t=1342113711;
bh=7Ng960VgjlZrQGEqS41NavV/uRd95ItoKorESqhXZ54=;
h=From:Subject:Date:MIME-Version:Content-Type;
b=Pet6CL/N5m+SPOX27NMkK08UtSsK1Y9L4U9HATD1IwYPmYNar8TB+0iH9k0gTXcBl
CCyYQ7jP9Gnb/67IA3fQ+ey/9CP4LDreVzP1pDNv0uX/y2JVgERlAVMmcTnV/W0/vS
TbF0R4hf6nwjGEZDqfE3zMAIgc9qxLXcJbd1XQ8Q=
X-AOL-SCOLL-SCORE: 0:2:246331408:93952408
X-AOL-SCOLL-URL_COUNT: 0
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1d33814fff07ac2828
X-AOL-IP: 64.122.225.69
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
X-UIDL: "E>"!Wnn!!~QP"!So;!!
X-Brightmail-Tracker: AAAAChrot4EYrc9NGGaAaAyuTe4bVrgxG1e5ARtXuM0bV7kIG1e5RxtXsN8=
This is a multi-part message in MIME format.
------=_NextPart_000_008D_01C2A9A6.39D3EA76
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
Kindly read the memo for more info from Mrs. Maria Elena Quintero Rivillas and get back to me
------=_NextPart_000_008D_01C2A9A6.39D3EA76
Content-Type: application/octet-stream;
name="Maria.rtf"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="Maria.rtf"
e1xydGYxXGFuc2lcYW5zaWNwZzEyNTJcZGVmZjBcZGVmbGFuZzEwMzN7XGZv
bnR0Ymx7XGYwXGZuaWxcZmNoYXJzZXQwIENhbGlicmk7fX0NCntcKlxnZW5l
cmF0b3IgTXNmdGVkaXQgNS40MS4yMS4yNTEwO31cdmlld2tpbmQ0XHVjMVxw
YXJkXHNhMjAwXHNsMjc2XHNsbXVsdDFcbGFuZzlcZjBcZnMyMiAgRGVhciBG
cmllbmQsXHBhcg0KIFxwYXINCk15IG5hbWUgaXMgTXJzLiBNYXJpYSBFbGVu
YSBRdWludGVybyBSaXZpbGxhcywgRnJvbSBDb2x1bWJpYSwgTmF0aW9uYWxp
emUgaW4gVW5pdGVkIFN0YXRlcyBvZiBBbWVyaWNhLCBhbmQgYSBjaXRpemVu
IG9mIChVU0EpIGJhc2UgaW4gQmVhdmVydG9uIE9yZWdvbi4gIEkgYW0gbWFy
cmllZCB0byBsYXRlIE1yLiBGZXJuYW5kbyBSaXZpbGxhcywgd2hvIHdvcmtl
ZCB3aXRoIEFncm9jYW1jb25zdWx0YW50IENvbXBhbnkgaW4gTG9uZG9uIGZv
ciBUd2VudHkgb25lIHllYXJzIGJlZm9yZSBoZSBkaWVkIGluIHRoZSB5ZWFy
IEF1Z3VzdCAyN3RoIDIwMTAsIGluIHBsYW5lIGNyYXNoLiBJIGdvdCB5b3Vy
IGNvbnRhY3QgaW4gSW50ZXJuZXQgY2h1cmNoIG1pc3Npb25hcnkgRGF0YWJh
c2UgYXMgc29tZW9uZSB3aG8gaXMgY2FwYWJsZSB0byBoYW5kbGUgdGhpcyBw
cm9qZWN0LlxwYXINCiBccGFyDQpXaGVuIG15IGxhdGUgaHVzYmFuZCB3YXMg
YWxpdmUgaGUgZGVwb3NpdGVkIHRoZSBzdW0gb2YgKFVTJDEwNiwwMDAsMDAw
LjAwKSAoT25lIEh1bmRyZWQgYW5kIFNpeCBNaWxsaW9uIFVuaXRlZCBTdGF0
ZXMgRG9sbGFycykgd2l0aCB0aGUgYmFuayBOZWdhcmEgTmV3IFlvcmsuIFBy
ZXNlbnRseSwgdGhpcyBtb25leSBpcyBzdGlsbCB3aXRoIHRoZSBiYW5rIE5l
Z2FyYSBOZXcgWW9yay4gSWYgeW91IGFyZSBpbnRlcmVzdGVkIGluIGNhcnJ5
aW5nIG91dCB0aGlzIHByb2plY3QsIHlvdSB3aWxsIGdvIGFoZWFkIGFuZCBj
b250YWN0IG91ciBGYW1pbHkgTGF3eWVyIHdpdGggdGhlIGNvbnRhY3QgZGV0
YWlscyBiZWxvdyBzbyB0aGF0IGhlIGNhbiBhcnJhbmdlIHRoZSByZWxlYXNl
IG9mIHRoZSBmdW5kcyB0byB5b3UuXHBhcg0KIFxwYXINClJlY2VudGx5LCBm
b2xsb3dpbmcgbXkgaWxsIGhlYWx0aCwgbXkgRG9jdG9yIHRvbGQgbWUgdGhh
dCBJIG1heSBub3QgbGFzdCBmb3IgdGhlIG5leHQgc2l4IG1vbnRocyBkdWUg
dG8gbXkgY2FuY2VyIHByb2JsZW0uIFRoZSBvbmUgdGhhdCBkaXN0dXJicyBt
ZSBtb3N0IGlzIG15IHN0cm9rZSBzaWNrbmVzcy4gSGF2aW5nIGtub3duIG15
IGNvbmRpdGlvbiBJIGRlY2lkZWQgdG8gZG9uYXRlIHRoaXMgZnVuZCB0byBh
IENocmlzdGlhbiBvcmdhbml6YXRpb24gKENodXJjaCkgdGhhdCB3aWxsIHV0
aWxpemUgdGhpcyBtb25leSB0aGUgd2F5IEkgYW0gZ29pbmcgdG8gaW5zdHJ1
Y3QgaGVyZWluLCBhY2NvcmRpbmcgdG8gdGhlIGRlc2lyZSBvZiBteSBsYXRl
IGh1c2JhbmQgYmVmb3JlIGhpcyBkZWF0aC5ccGFyDQogXHBhcg0KSSB3YW50
IHRoaXMgZnVuZCB0byBiZSB1c2VkIGluIENocmlzdGlhbiBBY3Rpdml0aWVz
IGxpa2UsIE9ycGhhbmFnZXMsIENocmlzdGlhbiBzY2hvb2xzLCBhbmQgQ2h1
cmNoZXMgZm9yIHByb3BhZ2F0aW5nIHRoZSB3b3JkIG9mIEdvZCBhbmQgdG8g
ZW5kZWF2b3IgdGhhdCB0aGUgaG91c2Ugb2YgR29kIGlzIG1haW50YWluZWQu
XHBhcg0KIFxwYXINClRoZSBCaWJsZSBtYWRlIHVzIHRvIHVuZGVyc3RhbmQg
dGhhdCAiQmxlc3NlZCBpcyB0aGUgaGFuZCB0aGF0IGdpdmV0aCIuIEkgdG9v
ayB0aGlzIGRlY2lzaW9uIGJlY2F1c2UgSSBkb24ndCBoYXZlIGFueSBjaGls
ZCB0aGF0IHdpbGwgaW5oZXJpdCB0aGlzIG1vbmV5IGFuZCBteSBodXNiYW5k
IHJlbGF0aXZlcyBhcmUgbm90IENocmlzdGlhbnMgYW5kIEkgZG9uJ3Qgd2Fu
dCBteSBodXNiYW5kJ3MgZWZmb3J0cyB0byBiZSB1c2VkIGJ5IHVuYmVsaWV2
ZXJzLiBJIGRvbid0IHdhbnQgYSBzaXR1YXRpb24gd2hlcmUgdGhpcyBtb25l
eSB3aWxsIGJlIHVzZWQgaW4gYW4gdW5nb2RseSB3YXkuIFRoaXMgaXMgd2h5
IEkgYW0gdGFraW5nIHRoaXMgZGVjaXNpb24uXHBhcg0KIFxwYXINCklmIHlv
dSBhcmUgaW50ZXJlc3RlZCBpbiBjYXJyeWluZyBvdXQgdGhpcyB0YXNrLCBJ
IGhhdmUgaW5mb3JtZWQgbXkgQXR0b3JuZXkgRWR3YXJkIEN1cml6IGluIExv
bmRvbiBzbyB0aGF0IGhlIGNhbiBhcnJhbmdlIHRoZSByZWxlYXNlIG9mIHRo
ZSBmdW5kcyB0byB5b3UuXHBhcg0KIFxwYXINCllvdSBjYW4gcmVhY2ggbXkg
YXR0b3JuZXkgKCBCYXJyaXN0ZXIgRWR3YXJkIEN1cml6ICkgIG9uIHRlbGVw
aG9uZSBudW1iZXI6KzQ0NzkyNDUyMDc3MyBmb3Igb3JhbCBjb21tdW5pY2F0
aW9uIG9yIGNvbnRhY3QgaGltIG9uIGhpcyBkaXJlY3QgZW1haWwgYWRkcmVz
cyA6IGVkYXdyZGN1cml6YXR0b3JuZXkxQGUtbWFpbC51YVxwYXINCiBccGFy
DQpIaXMgY29udGFjdCBpbmZvcm1hdGlvbiBvZiBteSBzb2xpY2l0b3IgYmVs
b3c6XHBhcg0KIFxwYXINCkJhcnJpc3RlciBFZHdhcmQgQ3VyaXpccGFyDQpN
eSBGYW1pbHkgQXR0b3JuZXkuXHBhcg0KVGVsZXBob25lIG51bWJlcjogKzQ0
NzkyNDUyMDc3MyAgICAgICAgIFxwYXINCkUtTWFpbDogIGVkYXdyZGN1cml6
YXR0b3JuZXkxQGUtbWFpbC51YVxwYXINCiBccGFyDQpNeSBBdHRvcm5leSBF
ZHdhcmQgQ3VyaXogd2lsbCBhbHNvIGlzc3VlIHlvdSB0aGUgZG9jdW1lbnRz
IHRoYXQgd2lsbCBwcm92ZSB5b3UgdGhlIHByZXNlbnQgYmVuZWZpY2lhcnkg
b2YgdGhpcyBmdW5kLlxwYXINCiBccGFyDQpJIHdhbnQgeW91IGFuZCB0aGUg
Q2h1cmNoIHRvIGFsd2F5cyBwcmF5IGZvciBtZSBiZWNhdXNlIHRoZSBsb3Jk
IGlzIG15IHNoZXBoZXJkLiBNeSBoYXBwaW5lc3MgaXMgdGhhdCBJIGxpdmVk
IGEgbGlmZSBvZiBhIHdvcnRoeSBDaHJpc3RpYW4uIFdob2V2ZXIgdGhhdCB3
YW50cyB0byBzZXJ2ZSB0aGUgTG9yZCBtdXN0IHNlcnZlIGhpbSBpbiBzcGly
aXQgYW5kIFRydXRoLiBQbGVhc2UgYWx3YXlzIGJlIHByYXllcmZ1bCBhbGwg
dGhyb3VnaCB5b3VyIGxpZmUuIEFueSBkZWxheSBpbiB5b3VyIHJlcGx5IHdp
bGwgZ2l2ZSBtZSByb29tIGluIHNvdXJjaW5nIGFub3RoZXIgcGVyc29uIGZv
ciB0aGlzIHNhbWUgcHVycG9zZS5ccGFyDQogXHBhcg0KUGxlYXNlIGlmIHlv
dSB3YW50IHdyaXRlIG1lIG9uIHRoaXMgZW1haWwgYWRkcmVzczogbWFyaWFx
dWludGVyb19yaXZpbGxhc0BlLW1haWwudWEgIGlmIEkgY2FuIGdldCBteSBz
ZWxmIEkgd2lsbCByZXBseSB5b3UuXHBhcg0KIFxwYXINCiBccGFyDQpQbGVh
c2UgYXNzdXJlIG1lIHRoYXQgeW91IHdpbGwgYWN0IGFjY29yZGluZ2x5IGFz
IEkgU3RhdGVkIGhlcmVpbi5ccGFyDQogXHBhcg0KUmVtYWluIGJsZXNzZWQg
aW4gdGhlIExvcmQuXHBhcg0KIFxwYXINCllvdXJzIGluIENocmlzdCxccGFy
DQogXHBhcg0KTXJzLiBNYXJpYSBFbGVuYSBRdWludGVybyBSaXZpbGxhcy5c
cGFyDQpDYW5jZXIgSW5zdGl0dXRlXHBhcg0KQmVhdmVydG9uIE9yZWdvbiBV
U0FccGFyDQpFLW1haWw6ICBtYXJpYXF1aW50ZXJvX3JpdmlsbGFzQGUtbWFp
bC51YSBccGFyDQp9DQoA
------=_NextPart_000_008D_01C2A9A6.39D3EA76
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"
This message has been 'sanitized'. This means that potentially
dangerous content has been rewritten or removed. The following
log describes which actions were taken.
Sanitizer (start="1342113722"):
Part (pos="2738"):
SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):
Match (names="unnamed.html, filetype.html", rule="2"):
Enforced policy: accept
Note: Styles and layers give attackers many tools to fool the
user and common browsers interpret Javascript code found
within style definitions.
Rewrote HTML tag: >>_DIV_<<
as: >>_p__DEFANGED_DIV_<<
Rewrote HTML tag: >>_/DIV_<<
as: >>_/p__DEFANGED_DIV_<<
Part (pos="3185"):
SanitizeFile (filename="Maria.rtf", mimetype="application/octet-stream"):
Match (names="Maria.rtf", rule="2"):
Enforced policy: accept
Total modifications so far: 2
Anomy 0.0.0 : Sanitizer.pm
$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
------=_NextPart_000_008D_01C2A9A6.39D3EA76--