Scotia Bank Phish
Posted by Dave Yadallee on
From - Wed Mar 27 12:31:26 2013
X-Account-Key: account1
X-UIDL: 000012b94f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Tue, 26 Mar 2013 19:35:58 -0600
From: "Scotia OnLine"
Subject: SPAM URGENT!! IRREGULAR ACTIVITY ON YOUR ACCOUNT - ALERT!!!
Date: Tue, 26 Mar 2013 17:02:15 -0500
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.2 required=5.0 tests=FORGED_MUA_OUTLOOK,
URIBL_PH_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_51524CFE.63979E25"
X-Antivirus: AVG for E-mail 10.0.1430 [2641/5707]
X-AVG-ID: ID6317F28C-3C15F669
X-Brightmail-Tracker: AAAABh1cw90dXMPUHVzahR1d+6EdXeeYHV3nng==
X-Brightmail-Tracker: AAAAAA==
This is a multi-part message in MIME format.
------------=_51524CFE.63979E25
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: New Page 2 Dear ScotiaTM Customer: A message regarding "Important
information regarding your account" has been sent to your [...]
Content analysis details: (6.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: izonegator.com]
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_51524CFE.63979E25
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: dave@nk.ca
Delivered-To: dave@nk.ca
Received: from reloc-wgtn.co.nz (smtp.reloc-wgtn.co.nz [125.236.230.182])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 7495412CFA98
for; Tue, 26 Mar 2013 19:35:52 -0600 (MDT)
thread-index: Ac4qbZY8Yxp2yWssSOOx6CDKnxT+Fg==
X-Brightmail-Tracker: AAAAAhrot4EVm9LZ
Received: from User ([99.171.232.190]) by reloc-wgtn.co.nz with Microsoft SMTPSVC(6.0.3790.4675); Wed, 27 Mar 2013 10:02:16 +1200
From: "Scotia OnLine"
Subject: URGENT!! IRREGULAR ACTIVITY ON YOUR ACCOUNT - ALERT!!!
Date: Tue, 26 Mar 2013 17:02:15 -0500
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4913
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
Message-ID:
X-OriginalArrivalTime: 26 Mar 2013 22:02:16.0757 (UTC) FILETIME=[94436650:01CE2A6D]
X-Virus-Scanned: clamav-milter 0.97.7-exp-debug at doctor.nl2k.ab.ca
X-Virus-Status: Clean
New Page 2
------------=_51524CFE.63979E25
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-5FF9911B======="
--=======AVGMAIL-5FF9911B=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1430 / Virus Database: 2641/5707 - Release Date: 03/27/13=
--=======AVGMAIL-5FF9911B=======--
------------=_51524CFE.63979E25
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-241911F4======="
--=======AVGMAIL-241911F4=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1430 / Virus Database: 2641/5707 - Release Date: 03/27/13=
--=======AVGMAIL-241911F4=======--
------------=_51524CFE.63979E25--
X-Account-Key: account1
X-UIDL: 000012b94f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Tue, 26 Mar 2013 19:35:58 -0600
From: "Scotia OnLine"
Subject: SPAM URGENT!! IRREGULAR ACTIVITY ON YOUR ACCOUNT - ALERT!!!
Date: Tue, 26 Mar 2013 17:02:15 -0500
Message-Id:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.2 required=5.0 tests=FORGED_MUA_OUTLOOK,
URIBL_PH_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_51524CFE.63979E25"
X-Antivirus: AVG for E-mail 10.0.1430 [2641/5707]
X-AVG-ID: ID6317F28C-3C15F669
X-Brightmail-Tracker: AAAABh1cw90dXMPUHVzahR1d+6EdXeeYHV3nng==
X-Brightmail-Tracker: AAAAAA==
This is a multi-part message in MIME format.
------------=_51524CFE.63979E25
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: New Page 2 Dear ScotiaTM Customer: A message regarding "Important
information regarding your account" has been sent to your [...]
Content analysis details: (6.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: izonegator.com]
4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_51524CFE.63979E25
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: dave@nk.ca
Delivered-To: dave@nk.ca
Received: from reloc-wgtn.co.nz (smtp.reloc-wgtn.co.nz [125.236.230.182])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id 7495412CFA98
for
thread-index: Ac4qbZY8Yxp2yWssSOOx6CDKnxT+Fg==
X-Brightmail-Tracker: AAAAAhrot4EVm9LZ
Received: from User ([99.171.232.190]) by reloc-wgtn.co.nz with Microsoft SMTPSVC(6.0.3790.4675); Wed, 27 Mar 2013 10:02:16 +1200
From: "Scotia OnLine"
Subject: URGENT!! IRREGULAR ACTIVITY ON YOUR ACCOUNT - ALERT!!!
Date: Tue, 26 Mar 2013 17:02:15 -0500
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4913
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
Message-ID:
X-OriginalArrivalTime: 26 Mar 2013 22:02:16.0757 (UTC) FILETIME=[94436650:01CE2A6D]
X-Virus-Scanned: clamav-milter 0.97.7-exp-debug at doctor.nl2k.ab.ca
X-Virus-Status: Clean
Dear ScotiaTM Customer:
A message regarding "Important information
regarding your account" has been sent to your
Secure Message Center. To see your message, log on to www.scotia.com and click
"Secure Message Center" on the My
Accounts page. If you are already logged on, you can see your message(s) at any
time by visiting the Secure Message Center.
The message will be available in your Secure Message Center until 03/30/2013.
Thank you for being our valued customer.
------------=_51524CFE.63979E25
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-5FF9911B======="
--=======AVGMAIL-5FF9911B=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1430 / Virus Database: 2641/5707 - Release Date: 03/27/13=
--=======AVGMAIL-5FF9911B=======--
------------=_51524CFE.63979E25
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-241911F4======="
--=======AVGMAIL-241911F4=======
Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1430 / Virus Database: 2641/5707 - Release Date: 03/27/13=
--=======AVGMAIL-241911F4=======--
------------=_51524CFE.63979E25--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments