E-mail phish
Posted by Dave Yadallee on
From - Wed Jul 31 15:34:23 2013
X-Account-Key: account1
X-UIDL: 000021604f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 31 Jul 2013 12:44:08 -0600
Received: from toroondcbmts07-srv.bellnexxia.net ([207.236.237.41])
by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)
(envelope-from)
id 1V4bNR-0000NC-1z
for dave@doctor.nl2k.ab.ca; Wed, 31 Jul 2013 12:44:08 -0600
Received: from toip37-bus.srvr.bell.ca ([67.69.240.38])
by toroondcbmts07-srv.bellnexxia.net
(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
id <20130731184358.DPEC29410.toroondcbmts07-srv.bellnexxia.net@toip37-bus.srvr.bell.ca>
for; Wed, 31 Jul 2013 14:43:58 -0400
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqhWAHxX+VFKDuIq/2dsb2JhbAA9AhUHEwEBAoFaBAFcaYlygVqhMAGJN4hdgRF0ghsXQRE+AR0MByF0hXwCAV8KgRU9jBmMGo8rg38QgQKCWYk8gX+MSg2BQgyBDyVtYXMDgSWHTYYpiEORToFmICaBBCCBLAIHFwMBbgYPFw
X-IronPort-AV: E=Sophos;i="4.89,788,1367985600";
d="scan'208";a="430625396"
Received: from ktnron06-1242489386.sdsl.bell.ca (HELO ssl.com) ([74.14.226.42])
by toip37-bus.srvr.bell.ca with ESMTP; 31 Jul 2013 14:43:52 -0400
From: support
To: dave@doctor.nl2k.ab.ca
Subject: Notice From PayPaI
Date: 31 Jul 2013 14:33:09 -0400
Message-ID: <20130731143308.2D963A085E6A0A45@ssl.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 5.0
X-Spam_score_int: 50
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: We regret to inform you that access to your account has been
temporarily limited. This has been done due to several failed log-in attempts.
Case ID: QB-482-77-82 [...]
Content analysis details: (5.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1
[207.236.237.41 listed in dnsbl-1.uceprotect.net]
1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org
[207.236.237.41 listed in ips.backscatterer.org]
2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2
[207.236.237.41 listed in dnsbl-2.uceprotect.net]
Subject: {SPAM?} Notice From PayPaI
We regret to inform you that access to&nb=
sp;your account has been temporarily limited.
r>
This has been done due to several failed&=
nbsp;log-in attempts.
Case ID: QB-482-77-82
To restore your account please
c.co.kr/.pp/b.html">Click Here .
If you fail to log in correctly your =
;account will be suspended for fraud preventio=
n.
We apologize for the inconvenience, this measu=
re was taken for your protection.
X-Account-Key: account1
X-UIDL: 000021604f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 31 Jul 2013 12:44:08 -0600
Received: from toroondcbmts07-srv.bellnexxia.net ([207.236.237.41])
by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)
(envelope-from
id 1V4bNR-0000NC-1z
for dave@doctor.nl2k.ab.ca; Wed, 31 Jul 2013 12:44:08 -0600
Received: from toip37-bus.srvr.bell.ca ([67.69.240.38])
by toroondcbmts07-srv.bellnexxia.net
(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
id <20130731184358.DPEC29410.toroondcbmts07-srv.bellnexxia.net@toip37-bus.srvr.bell.ca>
for
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqhWAHxX+VFKDuIq/2dsb2JhbAA9AhUHEwEBAoFaBAFcaYlygVqhMAGJN4hdgRF0ghsXQRE+AR0MByF0hXwCAV8KgRU9jBmMGo8rg38QgQKCWYk8gX+MSg2BQgyBDyVtYXMDgSWHTYYpiEORToFmICaBBCCBLAIHFwMBbgYPFw
X-IronPort-AV: E=Sophos;i="4.89,788,1367985600";
d="scan'208";a="430625396"
Received: from ktnron06-1242489386.sdsl.bell.ca (HELO ssl.com) ([74.14.226.42])
by toip37-bus.srvr.bell.ca with ESMTP; 31 Jul 2013 14:43:52 -0400
From: support
To: dave@doctor.nl2k.ab.ca
Subject: Notice From PayPaI
Date: 31 Jul 2013 14:33:09 -0400
Message-ID: <20130731143308.2D963A085E6A0A45@ssl.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 5.0
X-Spam_score_int: 50
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: We regret to inform you that access to your account has been
temporarily limited. This has been done due to several failed log-in attempts.
Case ID: QB-482-77-82 [...]
Content analysis details: (5.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1
[207.236.237.41 listed in dnsbl-1.uceprotect.net]
1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org
[207.236.237.41 listed in ips.backscatterer.org]
2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2
[207.236.237.41 listed in dnsbl-2.uceprotect.net]
Subject: {SPAM?} Notice From PayPaI
We regret to inform you that access to&nb=
sp;your account has been temporarily limited.
r>
This has been done due to several failed&=
nbsp;log-in attempts.
Case ID: QB-482-77-82
To restore your account please
c.co.kr/.pp/b.html">Click Here .
If you fail to log in correctly your =
;account will be suspended for fraud preventio=
n.
We apologize for the inconvenience, this measu=
re was taken for your protection.
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments