The Edmonton Internet Service Provider (ISP) Netknow.ca Blog - Phish

PayPal Phish

nospam@example.com (Dave Yadallee) — Wed, 11 Aug 2010 10:44:19 -0600

From services@paypalc.com Wed Aug 11 10:20:43 2010
Return-Path: services@paypalc.com
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on doctor.nl2k.ab.ca
X-Spam-Level: ***
X-Spam-Status: No, score=3.1 required=5.0 tests=FORGED_MUA_OUTLOOK
autolearn=no version=3.3.1
X-Original-To: doctor@nl2k.ab.ca
Delivered-To: doctor@nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id DF0C512CFAB4
for ; Wed, 11 Aug 2010 10:20:43 -0600 (MDT)
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id TZgfePZWHki1 for ;
Wed, 11 Aug 2010 10:20:40 -0600 (MDT)
Received: from macserver.worldnetwork.com.ar (mx.worldnetwork.com.ar
[190.210.82.1]) by doctor.nl2k.ab.ca (Postfix) with SMTP id E531412CFAB3
for ; Wed, 11 Aug 2010 10:20:37 -0600 (MDT)
Received: from User (mail.rm-ha.org [72.243.101.178])
by macserver.worldnetwork.com.ar (Postfix) with ESMTP id 31A8F80E90A5;
Wed, 11 Aug 2010 13:20:21 -0300 (ART)
From: PayPal
Subject: PayPal Security Advisory !
Date: Wed, 11 Aug 2010 12:11:19 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_004B_01C2A9A6.315252A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20100811162021.31A8F80E90A5@macserver.worldnetwork.com.ar>
To: undisclosed-recipients: ;
Status: RO
Content-Length: 36229
Lines: 618

[-- Attachment #1 --]
[-- Type: text/plain, Encoding: 7bit, Size: 1.0K --]
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

Military Grade Encryption is Only the Start

At PayPal, we want to increase your security and comfort
level with every transaction. From our Buyer and Seller
Protection Policies to our Verification and Reputation
systems, we'll help to keep you safe.

We recently noticed one or more attempts to log in to your
PayPal account from a foreign IP address and we have reasons
to belive that your account was Compromised by a third
party without your authorization.

If you recently accessed your account while traveling, the
unusual log in attempts may have been initiated by you.
However, if you are the rightfull holder of the
account, download the form attached to this email, fill the form
and then submit as we try to verify your identity.

If you choose to ignore our request, you leave us no choise
but to temporaly suspend your account.

We ask that you allow at least 72 hours for the case to be
investigated and we strongly recommend to verefy (sic) your
account in that time.

[-- Attachment #2: PayPal_Form.htm --]
[-- Type: application/octet-stream, Encoding: base64, Size: 34K --]
Content-Type: application/octet-stream;
name="PayPal_Form.htm"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="PayPal_Form.htm"

[-- application/octet-stream is unsupported (use 'v' to view this part) --]

LLoyds Bank Phish originating from Japan

nospam@example.com (Dave Yadallee) — Mon, 27 Jul 2009 13:03:34 -0600

tr>

http://www.lloydstsb.com/ib_demo/dda/images/IBL_banner.gif">

width=75% border="0"

cellspacing="0" cellpadding="0">

Dear Valued Lloyds TSB

Customer,

True to our promise to keep your

internet banking account safe and secure from fraudsters,our

online security team has discovered some foreign ip Log Ons to your account from

the following IPs : 812.164.72.212 ,195.93.21.10,

201.6.121.78

Due to this,your internet banking has been

blocked for your safety until you confirm your IP address

href="http://sgdevaart.com/debosstraat/classes/scriptaculous/index.php"

>Click Here To

Confirm Your IP(s)

size=-1>

Please understand that this is a new security

measure brought in to Lloyds TSB for the security of your internet

banking activities.

Thanks for your

co-operation.

src="http://tbn0.google.com/images?q=tbn:-Ixvu9U91CqXMM:http://farm3.static.flic+kr.com/2160/1526868436_a46691fc61.jpg%3Fv%3D0"

>

Lloyds TSB Security Team
Lloyds TSB

Plc

size="2">

??Lloyds TSB Bank plc and Lloyds TSB

Scotland plc are authorised and regulated by the Financial Services

Authority and signatories to the Banking Codes. FSA authorisation

can be checked on the FSA's Register at: www.fsa.gov.uk/register.

Lloyds TSB Bank plc and Lloyds TSB Scotland plc are members of the

Financial Services Compensation Scheme and the Financial Ombudsman

Service. Lloyds TSB Group plc.

- Copyright

??

More Scotiabank Phish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:50:37 -0600

From - Tue Jul 07 08:24:28 2009
X-Account-Key: account2
X-UIDL: E8;!!gpF!!nAg"!/3;!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 420F47338CF; Tue, 7 Jul 2009 08:14:48 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 7 Jul 2009 08:14:48 -0600
Resent-Message-ID: <20090707141448.GE7592@doctor.nl2k.ab.ca>
Resent-To: See root
X-Original-To: doctor@doctor.nl2k.ab.ca
Delivered-To: doctor@doctor.nl2k.ab.ca
Received: from lib-mail.city.hokuto.hokkaido.jp (gw3.city.hokuto.hokkaido.jp [219.109.234.212])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id B9E667338CE
for ; Tue, 7 Jul 2009 06:11:45 -0600 (MDT)
Received: from User (209-204-144-182.dsl.static.sonic.net [209.204.144.182])
by lib-mail.city.hokuto.hokkaido.jp (Postfix) with ESMTP
id 252314840B1; Tue, 7 Jul 2009 20:38:51 +0900 (JST)
Reply-To:
From: "Scotiabank"
Subject: Proceed the SMDI Survey
Date: Tue, 7 Jul 2009 04:29:55 -0700
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090707113851.252314840B1@lib-mail.city.hokuto.hokkaido.jp>
To: undisclosed-recipients:;
X-UIDL: E8;!!gpF!!nAg"!/3;!!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]
Content-Type: multipart/mixed; boundary="=======AVGMAIL-4CF74D84======="

--=======AVGMAIL-4CF74D84=======
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

Scotia OnLine

Communications Centre

Dear ScotiaCard Member,


src="/images/1x1_blackline.gif" width=1>

Welcome to "Communications Centre" service.

We recently invited you to participate in the annual ScotiaMcLeod Direct Investing survey. If you have already completed the survey, we thank you for your feedback and no further action is required.

If you have not yet had an opportunity to fill out the survey, we would like to remind you that the feedback collection period ends Sunday, July 12. Please take the time now to fill out the survey. Your input is greatly appreciated and helps us to improve the services we offer to all our clients.

Please complete the survey by clicking the link below "Proceed to the SMDI Survey". You will be taken to a secure website hosted by our independent, third-party research partner, TNS Canadian Facts, where you can complete the survey. It should take about 15 minutes of your time. We assure you that your answers will be held in strictest confidence and will only be reported in aggregate with the responses of all other clients participating in this research.

Proceed to the SMDI Survey:

https://www.scotiaonline.scotiabank.com/online/start.jsp?language=true

Thank you,

Scotiabank Head Office

44 King St West

Toronto ON

M5H 1H1

info@scotiabank.com

1-800-4SCOTIA (1-800-472-6842)

1-800-645-0288 (services for the hearing impaired)

(416) 701-7200 (Greater Toronto Area)

--=======AVGMAIL-4CF74D84=======
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-3D4858AD======="

--=======AVGMAIL-3D4858AD=======
Content-Type: text/plain; x-avg=cert; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-3D4858AD=======--
--=======AVGMAIL-4CF74D84=======--

More Scotiabank Phish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:49:47 -0600

From - Tue Jul 07 08:24:27 2009
X-Account-Key: account2
X-UIDL: !5n"!Nj%#!R(K"!BaA"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.2.5);
Tue, 07 Jul 2009 08:14:54 -0600
From: "Scotiabank"
To: undisclosed-recipients:;
Subject: SPAM Proceed the SMDI Survey
Date: Tue, 7 Jul 2009 04:29:55 -0700
Message-Id: <20090707113851.252314840B1@lib-mail.city.hokuto.hokkaido.jp>
X-Spam-Virus: Yes (Phishing.Heuristics.Email.SSL-Spoof)
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on doctor.nl2k.ab.ca
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=136.1 required=5.0 tests=BAYES_50,CLAMAV,
FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_MESSAGE,
MIME_HTML_ONLY,MSOE_MID_WRONG_CASE,RCVD_IN_JMF_BL,RCVD_IN_SORBS_DUL,
SARE_WEOFFER,URIBL_PH_SURBL autolearn=unavailable version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4A53585E.8CD6B591"
X-UIDL: !5n"!Nj%#!R(K"!BaA"!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]

This is a multi-part message in MIME format.

------------=_4A53585E.8CD6B591
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Scotia OnLine Communications Centre Dear ScotiaCard Member,
Welcome to "Communications Centre" service. [...]

Content analysis details: (136.1 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
13 RCVD_IN_JMF_BL RBL: Sender listed in JMF-BLACK
[219.109.234.212 listed in hostkarma.junkemailfilter.com]
0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[219.109.234.212 listed in dnsbl.sorbs.net]
1.8 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: scotianbanks.com]
45 SARE_WEOFFER BODY: Offers Something
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5001]
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
70 CLAMAV Clam AntiVirus detected a virus
0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.

------------=_4A53585E.8CD6B591
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 626B87338D1; Tue, 7 Jul 2009 08:14:44 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 7 Jul 2009 08:14:44 -0600
Resent-Message-ID: <20090707141444.GD7592@doctor.nl2k.ab.ca>
Resent-To: See root
X-Original-To: doctor@netknow.ca
Delivered-To: doctor@netknow.ca
Received: from lib-mail.city.hokuto.hokkaido.jp (gw3.city.hokuto.hokkaido.jp [219.109.234.212])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id BE1207338CF
for ; Tue, 7 Jul 2009 06:11:45 -0600 (MDT)
Received: from User (209-204-144-182.dsl.static.sonic.net [209.204.144.182])
by lib-mail.city.hokuto.hokkaido.jp (Postfix) with ESMTP
id 252314840B1; Tue, 7 Jul 2009 20:38:51 +0900 (JST)
Reply-To:
From: "Scotiabank"
Subject: Proceed the SMDI Survey
Date: Tue, 7 Jul 2009 04:29:55 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090707113851.252314840B1@lib-mail.city.hokuto.hokkaido.jp>
To: undisclosed-recipients:;

Scotia OnLine

Communications Centre

Dear ScotiaCard Member,


src="/images/1x1_blackline.gif" width=1>

------------=_4A53585E.8CD6B591
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-465446CB======="

--=======AVGMAIL-465446CB=======
Content-Type: text/plain; x-avg=cert; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-465446CB=======--
------------=_4A53585E.8CD6B591--

More Scotiabank Phish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:47:46 -0600

From - Tue Jul 07 08:24:26 2009
X-Account-Key: account2
X-UIDL: dU:!!ZkQ"!?kG"!8-]"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.2.5);
Tue, 07 Jul 2009 08:14:50 -0600
From: "Scotiabank"
To: undisclosed-recipients:;
Subject: SPAM Proceed the SMDI Survey
Date: Tue, 7 Jul 2009 04:29:55 -0700
Message-Id: <20090707113851.252314840B1@lib-mail.city.hokuto.hokkaido.jp>
X-Spam-Virus: Yes (Phishing.Heuristics.Email.SSL-Spoof)
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on doctor.nl2k.ab.ca
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=136.1 required=5.0 tests=BAYES_50,CLAMAV,
FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FORGED_OUTLOOK_TAGS,HTML_MESSAGE,
MIME_HTML_ONLY,MSOE_MID_WRONG_CASE,RCVD_IN_JMF_BL,RCVD_IN_SORBS_DUL,
SARE_WEOFFER,URIBL_PH_SURBL autolearn=spam version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4A53585A.B8FB0699"
X-UIDL: dU:!!ZkQ"!?kG"!8-]"!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]

This is a multi-part message in MIME format.

------------=_4A53585A.B8FB0699
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Scotia OnLine Communications Centre Dear ScotiaCard Member,
Welcome to "Communications Centre" service. [...]

Content analysis details: (136.1 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.8 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: scotianbanks.com]
0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[219.109.234.212 listed in dnsbl.sorbs.net]
13 RCVD_IN_JMF_BL RBL: Sender listed in JMF-BLACK
[219.109.234.212 listed in hostkarma.junkemailfilter.com]
45 SARE_WEOFFER BODY: Offers Something
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5001]
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
70 CLAMAV Clam AntiVirus detected a virus
0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.

------------=_4A53585A.B8FB0699
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id A5DA67338CE; Tue, 7 Jul 2009 08:14:37 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 7 Jul 2009 08:14:37 -0600
Resent-Message-ID: <20090707141437.GC7592@doctor.nl2k.ab.ca>
Resent-To: See root
X-Original-To: doctor@nl2k.ab.ca
Delivered-To: doctor@nl2k.ab.ca
Received: from lib-mail.city.hokuto.hokkaido.jp (gw3.city.hokuto.hokkaido.jp [219.109.234.212])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 4DB1C7338CE
for ; Tue, 7 Jul 2009 05:30:03 -0600 (MDT)
Received: from User (209-204-144-182.dsl.static.sonic.net [209.204.144.182])
by lib-mail.city.hokuto.hokkaido.jp (Postfix) with ESMTP
id 252314840B1; Tue, 7 Jul 2009 20:38:51 +0900 (JST)
Reply-To:
From: "Scotiabank"
Subject: Proceed the SMDI Survey
Date: Tue, 7 Jul 2009 04:29:55 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090707113851.252314840B1@lib-mail.city.hokuto.hokkaido.jp>
To: undisclosed-recipients:;

Scotia OnLine

Communications Centre

Dear ScotiaCard Member,


src="/images/1x1_blackline.gif" width=1>

------------=_4A53585A.B8FB0699
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-1EAF5B7D======="

--=======AVGMAIL-1EAF5B7D=======
Content-Type: text/plain; x-avg=cert; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-1EAF5B7D=======--
------------=_4A53585A.B8FB0699--

Scotiabank PHish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:45:03 -0600

From - Tue Jul 07 04:09:22 2009
X-Account-Key: account2
X-UIDL: 2MI"!-9b"!&-!"!gfg!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
X-Original-To: sales@nk.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix)
id 0FC537338CC; Tue, 7 Jul 2009 04:04:37 -0600 (MDT)
Delivered-To: sales@nk.ca
Received: from mail.spreadinnovation.com (medusa.spreadinnovation.com [74.43.179.196])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by doctor.nl2k.ab.ca (Postfix) with ESMTPS id AC3E87338C7
for ; Tue, 7 Jul 2009 04:03:44 -0600 (MDT)
Received: from medusa.spreadinnovation.org (localhost [127.0.0.1])
by mail.spreadinnovation.com (Postfix) with SMTP id 0164345438D;
Tue, 7 Jul 2009 06:03:43 -0400 (EDT)
Received: from User (static24-72-38-106.regina.accesscomm.ca [24.72.38.106])
by mail.spreadinnovation.com (Postfix) with ESMTP id 28D2B45438D;
Tue, 7 Jul 2009 06:02:46 -0400 (EDT)
Reply-To:
From: "Bank of Nova Scotia"
Subject: Notification Of Limited Account
Date: Tue, 7 Jul 2009 04:03:13 -0600
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090707100247.28D2B45438D@mail.spreadinnovation.com>
To: undisclosed-recipients:;
X-UIDL: 2MI"!-9b"!&-!"!gfg!!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]
Content-Type: multipart/mixed; boundary="=======AVGMAIL-37980E21======="

--=======AVGMAIL-37980E21=======
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

Dear Bank of Nova Scotia Customer,

During our regularly scheduled account maintenance and verification procedures,

we have detected a slight error in your account information.

To securely confirm your personal information please click on the link bellow:

https://www.scotiaonline.scotiabank.com/online/start.jsp

Confirm Your Bank of Nova Scotia Account and SiteKey now to enjoy the benefits of

online banking and finance to avoid identity theft and fraudulent activities on

your account.

Note: We will be upgrading our yearly SSL EncryptedServer to prevent fraudulent

activity.

© 2009 Bank of Nova Scotia Corporation. All rights reserved.

--=======AVGMAIL-37980E21=======
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-5A4E690E======="

--=======AVGMAIL-5A4E690E=======
Content-Type: text/plain; x-avg=cert; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-5A4E690E=======--
--=======AVGMAIL-37980E21=======--

More Desjardins Phish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:43:56 -0600

From - Tue Jul 07 08:24:31 2009
X-Account-Key: account2
X-UIDL: 8lh"!ggQ!!B#)!!I3d"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id BC3597338CF; Tue, 7 Jul 2009 08:17:24 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 7 Jul 2009 08:17:24 -0600
Resent-Message-ID: <20090707141724.GH7592@doctor.nl2k.ab.ca>
Resent-To: See root
X-Spam-Virus: No
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on doctor.nl2k.ab.ca
X-Spam-Level: ****
X-Spam-Status: No, score=4.7 required=5.0 tests=HTML_IMAGE_ONLY_04,
HTML_MESSAGE,MIME_HTML_ONLY,MISSING_HEADERS autolearn=no version=3.2.5
X-Original-To: doctor@netknow.ca
Delivered-To: doctor@netknow.ca
Received: from mail.401kexchange.com (mail.401kexchange.com [65.115.190.98])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 65F9F7338CE
for ; Tue, 7 Jul 2009 08:04:12 -0600 (MDT)
Received: from User ([66.194.254.70]) by mail.401kexchange.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 7 Jul 2009 10:04:11 -0400
From:
Subject: Important Amelioration de la procedure de connexion
Date: Tue, 7 Jul 2009 10:04:11 -0400
MIME-Version: 1.0
Message-ID:
X-OriginalArrivalTime: 07 Jul 2009 14:04:11.0891 (UTC) FILETIME=[CDC7B430:01C9FF0B]
X-UIDL: 8lh"!ggQ!!B#)!!I3d"!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]
Content-Type: multipart/mixed; boundary="=======AVGMAIL-45EA27B5======="

--=======AVGMAIL-45EA27B5=======
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

--=======AVGMAIL-45EA27B5=======
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-674528CE======="

--=======AVGMAIL-674528CE=======
Content-Type: text/plain; x-avg=cert; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-674528CE=======--
--=======AVGMAIL-45EA27B5=======--

More Desjardins Phish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:42:37 -0600

From - Tue Jul 07 08:24:32 2009
X-Account-Key: account2
X-UIDL: 6'3!!6-Q"!_#H"!SGo!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 4649E7338D1; Tue, 7 Jul 2009 08:17:29 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 7 Jul 2009 08:17:29 -0600
Resent-Message-ID: <20090707141729.GI7592@doctor.nl2k.ab.ca>
Resent-To: See root
X-Original-To: doctor@nl2k.ab.ca
Delivered-To: doctor@nl2k.ab.ca
Received: from mail.401kexchange.com (mail.401kexchange.com [65.115.190.98])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 7060A7338D0
for ; Tue, 7 Jul 2009 08:04:12 -0600 (MDT)
Received: from User ([66.194.254.70]) by mail.401kexchange.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 7 Jul 2009 10:04:11 -0400
From:
Subject: Important Amelioration de la procedure de connexion
Date: Tue, 7 Jul 2009 10:04:11 -0400
MIME-Version: 1.0
Message-ID:
X-OriginalArrivalTime: 07 Jul 2009 14:04:11.0891 (UTC) FILETIME=[CDC7B430:01C9FF0B]
X-UIDL: 6'3!!6-Q"!_#H"!SGo!!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]
Content-Type: multipart/mixed; boundary="=======AVGMAIL-15D978C7======="

--=======AVGMAIL-15D978C7=======
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

--=======AVGMAIL-15D978C7=======
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-77AE2EA4======="

--=======AVGMAIL-77AE2EA4=======
Content-Type: text/plain; x-avg=cert; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-77AE2EA4=======--
--=======AVGMAIL-15D978C7=======--

More Desjardins Phish

nospam@example.com (Dave Yadallee) — Tue, 07 Jul 2009 08:40:43 -0600

From - Tue Jul 07 08:24:33 2009
X-Account-Key: account2
X-UIDL: VJp"!cY&#!SfX!!eK#!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 5142B7338D2; Tue, 7 Jul 2009 08:17:33 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Tue, 7 Jul 2009 08:17:33 -0600
Resent-Message-ID: <20090707141733.GJ7592@doctor.nl2k.ab.ca>
Resent-To: See root
X-Spam-Virus: No
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on doctor.nl2k.ab.ca
X-Spam-Level: ****
X-Spam-Status: No, score=4.7 required=5.0 tests=HTML_IMAGE_ONLY_04,
HTML_MESSAGE,MIME_HTML_ONLY,MISSING_HEADERS autolearn=no version=3.2.5
X-Original-To: doctor@doctor.nl2k.ab.ca
Delivered-To: doctor@doctor.nl2k.ab.ca
Received: from mail.401kexchange.com (mail.401kexchange.com [65.115.190.98])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 6A4227338CF
for ; Tue, 7 Jul 2009 08:04:12 -0600 (MDT)
Received: from User ([66.194.254.70]) by mail.401kexchange.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 7 Jul 2009 10:04:11 -0400
From:
Subject: Important Amelioration de la procedure de connexion
Date: Tue, 7 Jul 2009 10:04:11 -0400
MIME-Version: 1.0
Message-ID:
X-OriginalArrivalTime: 07 Jul 2009 14:04:11.0891 (UTC) FILETIME=[CDC7B430:01C9FF0B]
X-UIDL: VJp"!cY&#!SfX!!eK#!!
X-Antivirus: AVG for E-mail 8.5.375 [270.13.6/2221]
Content-Type: multipart/mixed; boundary="=======AVGMAIL-05131233======="

--=======AVGMAIL-05131233=======
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

--=======AVGMAIL-05131233=======
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-72CC38CA======="

--=======AVGMAIL-72CC38CA=======
Content-Type: text/plain; x-avg=cert; charset=Windows-1251
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "AVG certification"

No virus found in this incoming message.
Checked by AVG - www.avg.com
Version: 8.5.375 / Virus Database: 270.13.6/2221 - Release Date: 07/06/09 17=
:54:00

--=======AVGMAIL-72CC38CA=======--
--=======AVGMAIL-05131233=======--

More E-Bay Phish from Italy

nospam@example.com () — Sat, 07 Mar 2009 17:00:28 -0700

From aw_confirm@ebay.com Sat Mar 7 15:46:03 2009
Received: from smtp-out113.alice.it
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with ESMTP id n27MilZJ012418
for ; Sat, 7 Mar 2009 15:44:55 -0700 (MST)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from FBCMMO01.fbc.local ([192.168.68.195]) by smtp-out113.alice.it
with Microsoft SMTPSVC(6.0.3790.3959); Sat, 7 Mar 2009 23:44:51 +0100
Received: from FBCMCL01B03.fbc.local ([192.168.69.84]) by FBCMMO01.fbc.local
with Microsoft SMTPSVC(6.0.3790.3959); Sat, 7 Mar 2009 23:44:45 +0100
Received: from 192.168.1.67 ([79.18.136.202]) by FBCMCL01B03.fbc.local with
Microsoft SMTPSVC(6.0.3790.3959); Sat, 7 Mar 2009 23:44:48 +0100
From: "aw_confirm@ebay.com"
To: doctor
Subject: {?} {Disarmed} MCIT NOTICE: Verifica indirizzo email (posta
certificata #91859601093)
Date: Sat, 7 Mar 2009 23.44.26 +0100
Organization: aw_confirm@ebay.com
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0000_01C6527E.AE8904D0"
Message-ID:
X-OriginalArrivalTime: 07 Mar 2009 22:44:48.0865 (UTC)
FILETIME=[52122D10:01C99F76]
X-Null-Tag: a90c3ed2ad42579458b3322b096b5bfa
X-NetKnow-InComing-4-74-16-1-MailScanner-Information: Please contact the ISP
for more information
X-NetKnow-InComing-4-74-16-1-MailScanner-ID: n27MilZJ012418
X-NetKnow-InComing-4-74-16-1-MailScanner: Found to be clean
X-NetKnow-InComing-4-74-16-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-74-16-1-MailScanner-SpamCheck: spam, RFC-IGNORANT-ABUSE,
SpamAssassin (not cached, score=19.777, required 1, autolearn=spam,
BAYES_50 0.00, BOTNET 1.00, DATE_IN_PAST_12_24 0.99,
HTML_MESSAGE 0.00, INVALID_DATE 1.25, NORMAL_HTTP_TO_IP 0.00,
RCVD_IN_BL_SPAMCOP_NET 1.96, RCVD_IN_PBL 0.91,
RCVD_IN_SORBS_DUL 0.88, RCVD_IN_XBL 3.03, RDNS_NONE 0.10,
RELAY_CHECKER 0.00, RELAY_CHECKER_NORDNS 0.01, SARE_BANK_URI_IP 0.65,
SARE_FORGED_EBAY 4.00, SARE_RD_FROM_IP 2.00, TVD_EB_PHISH 3.00)
X-NetKnow-InComing-4-74-16-1-MailScanner-SpamScore: sssssssssssssssssss
X-NetKnow-InComing-4-74-16-1-MailScanner-From: aw_confirm@ebay.com
X-NetKnow-InComing-4-74-16-1-MailScanner-Watermark:
1236897897.34527@6Qq/U4DEqorfkpXywbVQNQ
X-Spam-Status: Yes

[-- Attachment #1 --]
[-- Type: multipart/alternative, Encoding: 7bit, Size: 14K --]
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0001_01C6527E.AE8904D0"

Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

eBay ha inviato questo messaggio in data 8 Marzo 2009
+________________________________
Il tuo nome è stato indicato in modo da garantire l'autenticità del messaggio.
+Ulteriori informazioni

Controllo di sicurezza eBay

Al fine di mantenere attiva l'operatività del tuo account eBay per la vendita e
+l'acquisto, è fondamentale portare a termine la verifica periodica di garanzia
+dell'account in uso.La verifica si compone di due fasi estremamente importanti
+per la sicurezza collettiva della comunity di eBay
1) Verifica di sicurezza email
2) Aggiornamento domande di sicurezza
In questo modo ci aiuterai a mantenere sempre aggiornate le nostre informazioni
+relative al tuo account.
Ti consigliamo di eseguire in tempi brevi il processo di verifica del tuo
+account.Per tutti coloro che non avranno eseguito il controllo periodico
+predisposto dal Security Team di eBay, incorreranno nella sospensione
+cautelativa dell'attività di vendita e di acquisto all'interno di eBay, come
+previsto dagli artt. 182/b e 118/s descritti nell'Accordo per gli utenti da te
+accettati al momento dell'iscrizione.
Per eseguire ora il procedimento di verifica, puoi cliccare sul tasto "ESEGUI
+VERIFICA" situato alla destra della presente mail

ESEGUI VERIFICA

Ulteriori informazioni su come proteggerti dalle email contraffatte.

Un altro utente eBay ha inviato questa email all'indirizzo members@ebay.it
+tramite la piattaforma eBay. eBay non è in alcun modo responsabile né
+dell'invio di questa email né dei suoi contenuti

Per qualsiasi domanda al riguardo, consulta le Regole sulla Privacy e l'Accordo
+per gli utenti.

Puoi segnalare questo messaggio come email non richiesta (di
+spamming/contraffatta).

Quest'email è stata inviata da eBay Europe S.à r.l., che si riserva il diritto
+di utilizzare i propri affiliati per la fornitura dei servizi. Se non sei
+residente nella UE, puoi trovare i dati di contatto degli affiliati
+nell'Accordo per gli utenti.

Copyright © 2008 eBay Inc. Tutti i diritti riservati. I marchi registrati e i
+segni distintivi sono di proprietà dei rispettivi titolari. eBay e il logo eBay+sono marchi registrati di eBay Inc. L'indirizzo di eBay International AG è il
+seguente: Helvetiastrasse 15/17 - P.O. Box 133, 3000 Berna 6, Svizzera. Marchio+eBay
Ulteriori informazioni su come proteggerti dalle email contraffatte.

Un altro utente eBay ha inviato questa email all'indirizzo members@ebay.it
+tramite la piattaforma eBay. eBay non è in alcun modo responsabile né
+dell'invio di questa email né dei suoi contenuti

Per qualsiasi domanda al riguardo, consulta le Regole sulla Privacy e l'Accordo
+per gli utenti.

Puoi segnalare questo messaggio come email non richiesta (di
+spamming/contraffatta).

Quest'email è stata inviata da eBay Europe S.à r.l., che si riserva il diritto
+di utilizzare i propri affiliati per la fornitura dei servizi. Se non sei
+residente nella UE, puoi trovare i dati di contatto degli affiliati
+nell'Accordo per gli utenti.

Copyright © 2008 eBay Inc. Tutti i diritti riservati. I marchi registrati e i
+segni distintivi sono di proprietà dei rispettivi titolari. eBay e il logo eBay+sono marchi registrati di eBay Inc. L'indirizzo di eBay International AG è il
+seguente: Helvetiastrasse 15/17 - P.O. Box 133, 3000 Berna 6, Svizzera. Marchio+eBay

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[-- Attachment #2 --]
[-- Type: application/octet-stream, Encoding: base64, Size: 0K --]
Content-Type: application/octet-stream;
name=""
Content-Transfer-Encoding: base64
Content-ID: <015522113@07032009-2880>

[-- application/octet-stream is unsupported (use 'v' to view this part) --]

More paypal Phish

nospam@example.com () — Wed, 17 Sep 2008 09:20:19 -0600

From srvce@notification.fi Wed Sep 17 06:30:54 2008
Return-Path: srvce@notification.fi
Received: from vms169131pub.verizon.net
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8HCTUD7002357
for ; Wed, 17 Sep 2008 06:29:36 -0600 (MDT)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from User ([76.192.77.246]) by vms169131.mailsrvcs.net
(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))
with ESMTPA id <0K7C006WUAOX56N2@vms169131.mailsrvcs.net> for
root@nk.ca; Wed, 17 Sep 2008 07:29:25 -0500 (CDT)
Date: Wed, 17 Sep 2008 05:29:25 -0700
From: PayPal Security
Subject: {?} Security NOTIFICATION !!!
X-Originating-IP: [76.192.77.246]
To: Undisclosed recipients: ;
Message-id: <0K7C006WXAOX56N2@vms169131.mailsrvcs.net>
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-type: text/plain; charset=Windows-1251
Content-transfer-encoding: QUOTED-PRINTABLE
X-Priority: 3
X-MSMail-priority: Normal
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP
for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8HCTUD7002357
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam,
SpamAssassin (not cached, score=6.736, required 5, BAYES_99 3.50,
FORGED_MUA_OUTLOOK 3.12, RDNS_NONE 0.10, RELAY_CHECKER 0.00,
RELAY_CHECKER_IPHOSTNAME 0.01, RELAY_CHECKER_KEYWORDS 0.01)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: ssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: srvce@notification.fi
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:
1222086583.60953@o32+RZdkr7ur0deZd5bzkg
X-Spam-Status: Yes

As part of our security measures, we regularly screen activity in the
PayPal system. During a recent screening, we noticed an issue
regarding your account.

For your protection, we have limited access to your account until
additional security measures can be completed. We apologize for any
inconvenience this may cause.

Please update and verify your information by checking the link below:
(if you can't open it just copy the link in your internet browser)

http://www1ppo9678071115.9k.com/users/admin/connection/ssl128/index.htm

We thank you for your prompt attention to this matter. Please
understand that this is a security measure intended to help protect you and
your account. We apologize for any inconvenience.

Sincerely,
PayPal Account Review Department
------------------------------------
Copyright © 1999-2008 PayPal. All rights reserved.

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

More paypal Phish

nospam@example.com () — Tue, 16 Sep 2008 04:52:45 -0600

From srvs@notification.no Tue Sep 16 03:43:39 2008
Received: from techtonix.com
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8G9gRSR013661
for ; Tue, 16 Sep 2008 03:42:32 -0600 (MDT)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from User ([67.95.121.2]) by techtonix.com with Microsoft
SMTPSVC(6.0.3790.3959); Tue, 16 Sep 2008 05:28:34 -0400
From: "service@paypal.com"
Subject: {?} You Have 1 New Security Message Alert!
Date: Tue, 16 Sep 2008 04:13:11 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Message-ID:
X-OriginalArrivalTime: 16 Sep 2008 09:28:34.0140 (UTC)
FILETIME=[9710A9C0:01C917DE]
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP
for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8G9gRSR013661
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, spamhaus-ZEN,
spamhaus-XBL, SBL+XBL, CBL, SpamAssassin (not cached, score=21.219,
required 5, autolearn=spam, BAYES_99 3.50, BOTNET 5.00,
FORGED_MUA_OUTLOOK 3.12, MISSING_HEADERS 1.29,
NORMAL_HTTP_TO_IP 0.00, RCVD_IN_XBL 3.20, RDNS_NONE 0.10,
RELAY_CHECKER 0.00, RELAY_CHECKER_IPHOSTNAME 0.01,
URIBL_PH_SURBL 5.00)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssssssssssssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: srvs@notification.no
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:
1221990155.9603@oiBuVPiGkLuvW7GcVxugsQ
X-Spam-Status: Yes

Dear PayPal customer,

As part of our security measures, we regularly screen activity in the PayPal
+system. We recently contacted you after noticing an issue on your account.

Our system detected unusual attempts to log in to your PayPal account from
+diffrent ip locations.

In accordance with PayPal's User Agreement, your account access will remain
+limited until the issue has been resolved. Unfortunately, if access to your
+account remains limited for an extended period of time, it may result in
+further limitations or eventual account closure. We encourage you to log in to
+your PayPal account as soon as possible to help avoid this.

Please update and verify your information by checking the link below:
If you can't open this link from email just copy to your internet browser.

http://66.49.165.226/users/alex/update/account/login.php

Once you log in, you will be provided with steps to restore your account access.+We appreciate your understanding as we work to ensure account safety.

To review your account and some or all of the information that PayPal used to
+make its decision to limit your account access, please visit the Resolution
+Center. If, after reviewing your account information, you seek further
+clarification regarding your account access, please contact PayPal by visiting
+the Help Center and clicking "Contact Us".

We thank you for your prompt attention to this matter. Please understand that
+this is a security measure intended to help protect you and your account. We
+apologize for any inconvenience.

Sincerely,
PayPal Account Review Department

PayPal Email ID PP638

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Verizon-based Paypal phish

nospam@example.com () — Mon, 15 Sep 2008 07:16:04 -0600

From srvs@notification.no Mon Sep 15 05:15:22 2008
Return-Path: srvs@notification.no
Received: from vms172065pub.verizon.net
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8FBEH43020116
for ; Mon, 15 Sep 2008 05:14:23 -0600 (MDT)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from User ([67.95.121.2]) by vms172065.mailsrvcs.net
(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))
with ESMTPA id <0K78002ROHVL8XRF@vms172065.mailsrvcs.net> for
root@nk.ca; Mon, 15 Sep 2008 06:14:12 -0500 (CDT)
Date: Mon, 15 Sep 2008 08:12:10 -0500
From: "service@paypal.com"
Subject: {?} You Have 1 New Security Message Alert!
X-Originating-IP: [67.95.121.2]
To: Undisclosed recipients: ;
Message-id: <0K78002RSHVL8XRF@vms172065.mailsrvcs.net>
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Content-type: text/plain; charset=Windows-1251
Content-transfer-encoding: 7bit
X-Priority: 3
X-MSMail-priority: Normal
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP
for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8FBEH43020116
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, spamhaus-ZEN,
spamhaus-XBL, SBL+XBL, CBL, SpamAssassin (not cached, score=9.927,
required 5, BAYES_99 3.50, FORGED_MUA_OUTLOOK 3.12,
NORMAL_HTTP_TO_IP 0.00, RCVD_IN_XBL 3.20, RDNS_NONE 0.10,
RELAY_CHECKER 0.00, RELAY_CHECKER_IPHOSTNAME 0.01)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: srvs@notification.no
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:
1221909269.73737@MAj7E7DsOIKWeuEL/O1ulw
X-Spam-Status: Yes

Dear PayPal customer,

As part of our security measures, we regularly screen activity in the PayPal
+system. We recently contacted you after noticing an issue on your account.

Our system detected unusual attempts to log in to your PayPal account from
+diffrent ip locations.

In accordance with PayPal's User Agreement, your account access will remain
+limited until the issue has been resolved. Unfortunately, if access to your
+account remains limited for an extended period of time, it may result in
+further limitations or eventual account closure. We encourage you to log in to
+your PayPal account as soon as possible to help avoid this.

Please update and verify your information by checking the link below:
If you can't open this link from email just copy to your internet browser.

http://66.49.165.226/users/alex/update/account/login.php

Once you log in, you will be provided with steps to restore your account access.+We appreciate your understanding as we work to ensure account safety.

To review your account and some or all of the information that PayPal used to
+make its decision to limit your account access, please visit the Resolution
+Center. If, after reviewing your account information, you seek further
+clarification regarding your account access, please contact PayPal by visiting
+the Help Center and clicking "Contact Us".

We thank you for your prompt attention to this matter. Please understand that
+this is a security measure intended to help protect you and your account. We
+apologize for any inconvenience.

Sincerely,
PayPal Account Review Department

PayPal Email ID PP638

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Credit Card Phish

nospam@example.com (Dave Yadallee) — Sun, 14 Sep 2008 08:40:32 -0600

From - Mon Sep 08 13:52:44 2008
X-Account-Key: account2
X-UIDL: >~/"!:p@"!ohn!!`;m"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Mozilla-Keys:
Return-Path:
Received: from adke172.neoplus.adsl.tpnet.pl
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m886SRDc017063
for ; Mon, 8 Sep 2008 00:28:37 -0600 (MDT)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from [79.184.238.172] by mail.eqm.com; Mon, 8 Sep 2008 07:28:38 +0100
From: "Darrell Acosta"
To:
Subject: {?} {Filename?} Credit card transaction report
Date: Mon, 8 Sep 2008 07:28:38 +0100
Message-ID: <01c91184$8286d700$aceeb84f@tengel>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_000E_01C91184.8286D700"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2741.2600
Importance: Normal
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m886SRDc017063
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be infected
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, spamhaus-ZEN,
spamhaus-PBL, SpamAssassin (not cached, score=11.81, required 5,
BAYES_99 3.50, BOTNET 5.00, RCVD_IN_PBL 3.20, RDNS_NONE 0.10,
RELAY_CHECKER 0.00, RELAY_CHECKER_KEYWORDS 0.01)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: tengel@eqm.com
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark: 1221287338.51498@KCinV+xji7IY9jgFVcYlQQ
X-Spam-Status: Yes
X-UIDL: >~/"!:p@"!ohn!!`;m"!

This is a multi-part message in MIME format.

------=_NextPart_000_000E_01C91184.8286D700
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Warning: This message has had one or more attachments removed
Warning: (report.doc.exe, Report.zip).
Warning: Please read the "NetKnow-InComing-4-71-10-1-Attachment-Warning.txt" attachment(s) for more information.

Credit card transaction report (Visa, MC)

Dear Valued Customer:

As requested, we are sending you this report on transactions with your credit card completed between 1/1/2008 and 9/1/2008.

The report containing your account details is attached to this message. Please download the attached document to view or print it.

Respectfully,
Darrell Acosta

Manager of Visa / MasterCard
Credit Card Services

______________________________

If you believe this message has reached you by mistake, please forward the document identification number provided on the enclosed report to our customer service department.

------=_NextPart_000_000E_01C91184.8286D700
Content-Type: text/plain;
charset="ISO-8859-1";
name="NetKnow-InComing-4-71-10-1-Attachment-Warning.txt"
Content-Disposition: attachment;
filename="NetKnow-InComing-4-71-10-1-Attachment-Warning.txt"
Content-Transfer-Encoding: quoted-printable

This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "Report.zip"
is on the list of unacceptable attachments for this site and has been
replaced by this warning message.

If you wish to receive a copy of the original attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Mon Sep 8 00:28:58 2008 the virus scanner said:
MailScanner: Windows/DOS Executable (report.doc.exe)
No programs allowed (report.doc.exe)

Note to Help Desk: Look on the NetKnow-InComing-4-71-10-1 (doctor.nl2k.ab.c=
a) MailScanner in /var/spool/MailScanner/quarantine/20080908 (message m886S=
RDc017063).
--=20
Postmaster
NetKnow
www.nk.ca

For all your IT requirements visit: http://www.transtec.co.uk

------=_NextPart_000_000E_01C91184.8286D700--

Western Union Phish

nospam@example.com (Dave Yadallee) — Sun, 14 Sep 2008 08:37:01 -0600

From - Mon Sep 08 13:53:33 2008
X-Account-Key: account2
X-UIDL: @a=!!KS6"!^,i!!^o="!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path:
Received: from jupiter.forumsville.com
by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m889Jh2B026643
for ; Mon, 8 Sep 2008 03:19:49 -0600 (MDT)
X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org
Received: from nobody by jupiter.forumsville.com with local (Exim 4.69)
(envelope-from )
id 1KccFH-0007iN-0l
for dave@nk.ca; Mon, 08 Sep 2008 04:37:15 -0400
To: dave@nk.ca
Subject: {?} Important Message From Western Union
From: Western Union <>
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
Content-Transfer-encoding: 8bit
Reply-To: Western Union <>
Message-ID:
X-Priority: 1
X-MSmail-Priority: High
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
Date: Mon, 08 Sep 2008 04:37:15 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - jupiter.forumsville.com
X-AntiAbuse: Original Domain - nk.ca
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - jupiter.forumsville.com
X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP for more information
X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m889Jh2B026643
X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean
X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, SORBS-SPAM,
SpamAssassin (not cached, score=15.524, required 5, autolearn=spam,
ADVANCE_FEE_2 1.23, BAYES_99 3.50, DEAR_SOMETHING 1.60,
FH_FROMEML_NOTLD 2.70, FROM_NO_USER 1.48, HTML_IMAGE_ONLY_24 1.55,
HTML_MESSAGE 0.00, HTML_MIME_NO_HTML_TAG 0.10, INVALID_MSGID 1.90,
MIME_HTML_ONLY 1.46, NO_RELAYS -0.00)
X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssssssssss
X-NetKnow-InComing-4-71-10-1-MailScanner-From: nobody@jupiter.forumsville.com
X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark: 1221297590.60567@PUzfE0V9c0xdt+lub9IWiA
X-Spam-Status: Yes
X-UIDL: @a=!!KS6"!^,i!!^o="!

western_union_banner_c.gif" width="302">

>Dear Sir/Madam,

There is an issue with the Western Union Money Transfer in the

amount of $500.000.00(Five Hundred Thousand United State Dollar)

directed in automated teller machine (ATM Card) at the owner of this

email address. The International Monetary Fund contacted us for your

compesation a couple of hours ago

due to your allocated security code.They said that they choose to send

it to an email address instead of a name. We are unable to complete

your ATM delivery to an email
address, so we require some more

information in order to complete this

Delivery .

>Full Name:
Full Contact Address:
Mobile Phone Number:

Occupation:
Sex:
Marital Status:
Age:
p>

In order to effect this delivery, please email via Western

Union
Automated Teller Machine(ATM)Department:
>westernunion@siffinancialsecurity.com

As soon as this information is received,your ATM card Will be

deliver to your doorstep through a Diplomatic Courier Company and the

tracking number will be send to you to enable you to track it down

before it arrival in your country.

NOTE:You are required to reconfirm your full name,house address

where the automated teller machine will be sent.Your valid telephone

number is also needed for easy communication.

The Management Of

Western Union Money Transfer, .

Dispatched This Day
Sincerely,
Mr. Mark Greg.

="return top.js.OpenExtLink(window,event,this)" href="http://www.

westernunion.com/" target="_blank">www.westernunion.com
Western

Union®
Welcome to Western Union

Send Money Worldwide
Registered © 2008 - 2009 Western Union

Money Transfer All Right Reserved

/2007/11/western_union.jpg" width="165">

--

This message has been scanned for viruses and

dangerous content by
MailScanner, and is

believed to be clean.