More Interac Phish
Posted by Dave Yadallee on
From - Wed Jul 11 12:26:16 2012
X-Account-Key: account2
X-UIDL: lma!!Clp!!Wl("!hS2!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 12:25:37 -0600
From: "notify@payments.interac.ca"
Subject: [Norton AntiSpam]*****SPAM**** ***SPAM** *****SPAM**** INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.1 required=5.0 tests=SARE_PHISH_HTML_02,
SARE_PHISH_HTML_03,URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFDC521.98EDE42F"
X-UIDL: lma!!Clp!!Wl("!hS2!!
X-Brightmail-Tracker: AAAAAxsRNoQbETZ7GxIbIQ==
X-Brightmail-Tracker: AAAAARs8T74=
This is a multi-part message in MIME format.
------------=_4FFDC521.98EDE42F
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFDC521.98EDE42F
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 12:25:36 -0600
From: "notify@payments.interac.ca"
Subject: *****SPAM****
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.1 required=5.0 tests=SARE_PHISH_HTML_02,
SARE_PHISH_HTML_03,URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFDC520.CCCBF87C"
This is a multi-part message in MIME format.
------------=_4FFDC520.CCCBF87C
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFDC520.CCCBF87C
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 984C112CFA86
for; Wed, 11 Jul 2012 12:25:34 -0600 (MDT)
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Score: 20.176
X-Spam-Level: ********************
X-Spam-Status: Yes, score=20.176 tagged_above=2 required=6.2
tests=[FROM_MISSPACED=3.6, FROM_MISSP_DKIM=0.87,
FROM_MISSP_NO_TO=2.071, HTML_MESSAGE=0.001, HTTPS_IP_MISMATCH=2.896,
MISSING_HEADERS=1.581, NORMAL_HTTP_TO_IP=0.001, NO_RELAYS=-0.001,
SARE_PHISH_HTML_02=2.5, SARE_PHISH_HTML_03=1.666, URIBL_SBL=2.468,
URIBL_SC_SURBL=2.523] autolearn=unavailable
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id RlADHmm_sB6b for;
Wed, 11 Jul 2012 12:25:29 -0600 (MDT)
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 44C4C12CFA82; Wed, 11 Jul 2012 12:25:29 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Wed, 11 Jul 2012 12:25:29 -0600
Resent-Message-ID: <20120711182529.GA2793@doctor.nl2k.ab.ca>
Resent-To: See root
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 06:42:54 -0600
From: "notify@payments.interac.ca"
Subject: ***SPAM** *****SPAM**** INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFD74CE.9667EE22"
This is a multi-part message in MIME format.
------------=_4FFD74CE.9667EE22
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]
Content analysis details: (9.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
2.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFD74CE.9667EE22
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 06:42:49 -0600
From: "notify@payments.interac.ca"
Subject: *****SPAM***** INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ****************
X-Spam-Status: Yes, score=16.4 required=5.0 tests=BOTNET,FORGED_MUA_OUTLOOK,
RCVD_IN_UCE_PFSM_3,RELAY_CHECKER_BADDNS,RELAY_CHECKER_IPHOSTNAME,
RELAY_CHECKER_KEYWORDS,SARE_PHISH_HTML_02,SARE_PHISH_HTML_03,URIBL_SBL,
URIBL_SC_SURBL autolearn=unavailable version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFD74C9.7C40C45A"
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
This is a multi-part message in MIME format.
------------=_4FFD74C9.7C40C45A
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: This message was transferred with a trial version of CommuniGate(r)
Pro sultan omar Dear customer, [...]
Content analysis details: (16.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_3 RBL: Received via a relay in UCE_PFSM_3
[122.165.254.226 listed in dnsbl-3.uceprotect.net]
2.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
2.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.0 BOTNET Relay might be a spambot or virusbot
[botnet0.8,ip=184.82.239.126,rdns=184-82-239-126.static.hostnoc.net,baddns,client,ipinhostname,clientwords]
0.0 RELAY_CHECKER_IPHOSTNAME Hostname contains IP address
0.0 RELAY_CHECKER_KEYWORDS Hostname matches keywords
0.0 RELAY_CHECKER_BADDNS Doesn't have full circle DNS
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFD74C9.7C40C45A
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: doctor@nl2k.ab.ca
Delivered-To: doctor@nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 216B312CFA86
for; Wed, 11 Jul 2012 06:42:48 -0600 (MDT)
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 9QKSWYdqdREs for;
Wed, 11 Jul 2012 06:42:41 -0600 (MDT)
Received: from ys004.info (unknown [184.82.239.126])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id E24D812CFA82
for; Wed, 11 Jul 2012 06:42:40 -0600 (MDT)
Received: from [122.165.254.226] (account postmaster@ys004.info HELO User)
by ys004.info (CommuniGate Pro SMTP 5.4.4 _trial_)
with ESMTPA id 1378347; Wed, 11 Jul 2012 16:42:32 +0400
From: "notify@payments.interac.ca"
Subject: INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
This message was transferred with a trial version of CommuniGate(r) Pro
sultan omar
.style1 {
font-size: medium;
}
>
------------=_4FFD74C9.7C40C45A
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"
This message has been 'sanitized'. This means that potentially
dangerous content has been rewritten or removed. The following
log describes which actions were taken.
Sanitizer (start="1342010569"):
Part (pos="933"):
SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
Match (names="unnamed.txt", rule="2"):
Enforced policy: accept
Part (pos="2916"):
Part (pos="174"):
SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):
Match (names="unnamed.html, filetype.html", rule="2"):
Enforced policy: accept
Rewrote HTML tag: >>_html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"_<<
as: >>_html DEFANGED_xmlns="http://www.w3.org/1999/xhtml" DEFANGED_xmlns:v="urn:schemas-microsoft-com:vml" DEFANGED_xmlns:o="urn:schemas-microsoft-com:office:office"_<<
Note: Styles and layers give attackers many tools to fool the
user and common browsers interpret Javascript code found
within style definitions.
Rewrote HTML tag: >>_style type="text/css" .style1 { font-size: medium; } _<<
as: >>_DEFANGED_style type="text/css" .style1 { font-size: medium; } _<<
Rewrote HTML tag: >>_/style_<<
as: >>_/DEFANGED_style_<<
Total modifications so far: 5
Anomy 0.0.0 : Sanitizer.pm
$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
------------=_4FFD74C9.7C40C45A--
------------=_4FFD74CE.9667EE22--
------------=_4FFDC520.CCCBF87C--
------------=_4FFDC521.98EDE42F--
X-Account-Key: account2
X-UIDL: lma!!Clp!!Wl("!hS2!!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 12:25:37 -0600
From: "notify@payments.interac.ca"
Subject: [Norton AntiSpam]*****SPAM**** ***SPAM** *****SPAM**** INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.1 required=5.0 tests=SARE_PHISH_HTML_02,
SARE_PHISH_HTML_03,URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFDC521.98EDE42F"
X-UIDL: lma!!Clp!!Wl("!hS2!!
X-Brightmail-Tracker: AAAAAxsRNoQbETZ7GxIbIQ==
X-Brightmail-Tracker: AAAAARs8T74=
This is a multi-part message in MIME format.
------------=_4FFDC521.98EDE42F
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFDC521.98EDE42F
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 12:25:36 -0600
From: "notify@payments.interac.ca"
Subject: *****SPAM****
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.1 required=5.0 tests=SARE_PHISH_HTML_02,
SARE_PHISH_HTML_03,URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFDC520.CCCBF87C"
This is a multi-part message in MIME format.
------------=_4FFDC520.CCCBF87C
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFDC520.CCCBF87C
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: aboo@doctor.nl2k.ab.ca
Delivered-To: aboo@doctor.nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 984C112CFA86
for
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Score: 20.176
X-Spam-Level: ********************
X-Spam-Status: Yes, score=20.176 tagged_above=2 required=6.2
tests=[FROM_MISSPACED=3.6, FROM_MISSP_DKIM=0.87,
FROM_MISSP_NO_TO=2.071, HTML_MESSAGE=0.001, HTTPS_IP_MISMATCH=2.896,
MISSING_HEADERS=1.581, NORMAL_HTTP_TO_IP=0.001, NO_RELAYS=-0.001,
SARE_PHISH_HTML_02=2.5, SARE_PHISH_HTML_03=1.666, URIBL_SBL=2.468,
URIBL_SC_SURBL=2.523] autolearn=unavailable
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id RlADHmm_sB6b for
Wed, 11 Jul 2012 12:25:29 -0600 (MDT)
Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)
id 44C4C12CFA82; Wed, 11 Jul 2012 12:25:29 -0600 (MDT)
Resent-From: doctor@doctor.nl2k.ab.ca
Resent-Date: Wed, 11 Jul 2012 12:25:29 -0600
Resent-Message-ID: <20120711182529.GA2793@doctor.nl2k.ab.ca>
Resent-To: See root
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 06:42:54 -0600
From: "notify@payments.interac.ca"
Subject: ***SPAM** *****SPAM**** INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFD74CE.9667EE22"
This is a multi-part message in MIME format.
------------=_4FFD74CE.9667EE22
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]
Content analysis details: (9.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
2.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFD74CE.9667EE22
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Wed, 11 Jul 2012 06:42:49 -0600
From: "notify@payments.interac.ca"
Subject: *****SPAM***** INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ****************
X-Spam-Status: Yes, score=16.4 required=5.0 tests=BOTNET,FORGED_MUA_OUTLOOK,
RCVD_IN_UCE_PFSM_3,RELAY_CHECKER_BADDNS,RELAY_CHECKER_IPHOSTNAME,
RELAY_CHECKER_KEYWORDS,SARE_PHISH_HTML_02,SARE_PHISH_HTML_03,URIBL_SBL,
URIBL_SC_SURBL autolearn=unavailable version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4FFD74C9.7C40C45A"
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
This is a multi-part message in MIME format.
------------=_4FFD74C9.7C40C45A
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: This message was transferred with a trial version of CommuniGate(r)
Pro sultan omar Dear customer, [...]
Content analysis details: (16.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_3 RBL: Received via a relay in UCE_PFSM_3
[122.165.254.226 listed in dnsbl-3.uceprotect.net]
2.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: 115.93.146.75]
2.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: 115.93.146.75]
1.0 BOTNET Relay might be a spambot or virusbot
[botnet0.8,ip=184.82.239.126,rdns=184-82-239-126.static.hostnoc.net,baddns,client,ipinhostname,clientwords]
0.0 RELAY_CHECKER_IPHOSTNAME Hostname contains IP address
0.0 RELAY_CHECKER_KEYWORDS Hostname matches keywords
0.0 RELAY_CHECKER_BADDNS Doesn't have full circle DNS
1.7 SARE_PHISH_HTML_03 numeric href with https description
2.5 SARE_PHISH_HTML_02 numeric href with https description
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4FFD74C9.7C40C45A
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: doctor@nl2k.ab.ca
Delivered-To: doctor@nl2k.ab.ca
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 216B312CFA86
for
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 9QKSWYdqdREs for
Wed, 11 Jul 2012 06:42:41 -0600 (MDT)
Received: from ys004.info (unknown [184.82.239.126])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id E24D812CFA82
for
Received: from [122.165.254.226] (account postmaster@ys004.info HELO User)
by ys004.info (CommuniGate Pro SMTP 5.4.4 _trial_)
with ESMTPA id 1378347; Wed, 11 Jul 2012 16:42:32 +0400
From: "notify@payments.interac.ca"
Subject: INTERAC e-Transfer from John
Date: Wed, 11 Jul 2012 18:10:44 +0530
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
This message was transferred with a trial version of CommuniGate(r) Pro
.style1 {
font-size: medium;
}
>
Dear customer,
John has sent you an INTERAC e-Transfer
(previously INTERAC Email Money Transfer).
Amount: $50.00 (CAD)
Sender's Message: A message was not provided
Expiry Date: 10 July 2012
Action Required:
To deposit your money, click here:
https://etransfer.interac.ca/CAV4YvVq
Trouble with the link? Type it into your web browser address bar.
Need help?
http://www.interac.ca/consumers/faqs.php#emt
-------------------------------------------------------------------------------
What is an INTERAC e-Transfer? (previously INTERAC Email Money Transfer). If you use
online or mobile banking at a participating financial institution, you can send and
receive money quickly and easily.
Email or text messages carry the notice while the financial institutions securely transfer
the money using existing payment networks. If your financial institution does not yet
offer INTERAC e-Transfer, you can still deposit transfers to any bank account in Canada.
Click http://www.interac.ca/consumers/faqs.php#emt for details.
-------------------------------------------------------------------------------
Pour voir les details du virement en francais,
cliquez sur le lien ci-dessous :
https://etransfer.interac.ca/fr/CAV4YvVq
------------=_4FFD74C9.7C40C45A
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"
This message has been 'sanitized'. This means that potentially
dangerous content has been rewritten or removed. The following
log describes which actions were taken.
Sanitizer (start="1342010569"):
Part (pos="933"):
SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
Match (names="unnamed.txt", rule="2"):
Enforced policy: accept
Part (pos="2916"):
Part (pos="174"):
SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):
Match (names="unnamed.html, filetype.html", rule="2"):
Enforced policy: accept
Rewrote HTML tag: >>_html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"_<<
as: >>_html DEFANGED_xmlns="http://www.w3.org/1999/xhtml" DEFANGED_xmlns:v="urn:schemas-microsoft-com:vml" DEFANGED_xmlns:o="urn:schemas-microsoft-com:office:office"_<<
Note: Styles and layers give attackers many tools to fool the
user and common browsers interpret Javascript code found
within style definitions.
Rewrote HTML tag: >>_style type="text/css" .style1 { font-size: medium; } _<<
as: >>_DEFANGED_style type="text/css" .style1 { font-size: medium; } _<<
Rewrote HTML tag: >>_/style_<<
as: >>_/DEFANGED_style_<<
Total modifications so far: 5
Anomy 0.0.0 : Sanitizer.pm
$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
------------=_4FFD74C9.7C40C45A--
------------=_4FFD74CE.9667EE22--
------------=_4FFDC520.CCCBF87C--
------------=_4FFDC521.98EDE42F--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments