Paypal Phish via Bell Canada
Posted by Dave Yadallee on
From - Thu Aug 01 12:29:36 2013
X-Account-Key: account1
X-UIDL: 000021874f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 01 Aug 2013 08:51:36 -0600
Received: from toroondcbmts04-srv.bellnexxia.net ([207.236.237.38])
by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)
(envelope-from)
id 1V4uDs-0006hT-9f
for dave@doctor.nl2k.ab.ca; Thu, 01 Aug 2013 08:51:35 -0600
Received: from toip59-bus.srvr.bell.ca ([67.69.240.186])
by toroondcbmts04-srv.bellnexxia.net
(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
id <20130801145119.TION2032.toroondcbmts04-srv.bellnexxia.net@toip59-bus.srvr.bell.ca>
for; Thu, 1 Aug 2013 10:51:19 -0400
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Anh/ACZu+lFKDuIq/2dsb2JhbAA9AhUHF4FaAWBpi0yhWwEBiTeIVIEUdIIbF0ERPgEdDAchYROFfAIBXwqBFQwxjEuMGo8rg38QgQKCUok8gX+MSg2BQgyBDyVuYXMDgSWHTYYpiEOBK5AkgWYgJoEEIIEsAgcXAwFuBg8X
X-IronPort-AV: E=Sophos;i="4.89,795,1367985600";
d="scan'208";a="68392431"
Received: from ktnron06-1242489386.sdsl.bell.ca (HELO servers.com) ([74.14.226.42])
by toip59-bus.srvr.bell.ca with ESMTP; 01 Aug 2013 10:51:19 -0400
From: support
To: dave@doctor.nl2k.ab.ca
Subject: PayPaI - Notice - zgfhhsywf
Date: 01 Aug 2013 10:40:36 -0400
Message-ID: <20130801104036.7F181530C4FD020D@servers.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 5.3
X-Spam_score_int: 53
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: We regret to inform you that access to your account has been
temporarily limited. This has been done due to several failed log-in attempts.
Case ID: QZ-442-55-12 [...]
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1
[207.236.237.38 listed in dnsbl-1.uceprotect.net]
1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org
[207.236.237.38 listed in ips.backscatterer.org]
2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2
[207.236.237.38 listed in dnsbl-2.uceprotect.net]
0.1 TW_GF BODY: Odd Letter Triples with GF
0.1 TW_YW BODY: Odd Letter Triples with YW
0.1 TW_FH BODY: Odd Letter Triples with FH
0.1 TW_ZG BODY: Odd Letter Triples with ZG
Subject: {SPAM?} PayPaI - Notice - zgfhhsywf
We regret to inform you that access to&nb=
sp;your account has been temporarily limited.
r>
This has been done due to several failed&=
nbsp;log-in attempts.
Case ID: QZ-442-55-12
To restore your account please
58152247122.netvigator.com/appserv/bosa24512.html">Click Here =
=2E
If you fail to log in correctly your =
;account will be suspended for fraud preventio=
n.
We apologize for the inconvenience, this measu=
re was taken for your protection.
This message is intended for dave@doctor.nl2k.ab.ca
X-Account-Key: account1
X-UIDL: 000021874f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 01 Aug 2013 08:51:36 -0600
Received: from toroondcbmts04-srv.bellnexxia.net ([207.236.237.38])
by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)
(envelope-from
id 1V4uDs-0006hT-9f
for dave@doctor.nl2k.ab.ca; Thu, 01 Aug 2013 08:51:35 -0600
Received: from toip59-bus.srvr.bell.ca ([67.69.240.186])
by toroondcbmts04-srv.bellnexxia.net
(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
id <20130801145119.TION2032.toroondcbmts04-srv.bellnexxia.net@toip59-bus.srvr.bell.ca>
for
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Anh/ACZu+lFKDuIq/2dsb2JhbAA9AhUHF4FaAWBpi0yhWwEBiTeIVIEUdIIbF0ERPgEdDAchYROFfAIBXwqBFQwxjEuMGo8rg38QgQKCUok8gX+MSg2BQgyBDyVuYXMDgSWHTYYpiEOBK5AkgWYgJoEEIIEsAgcXAwFuBg8X
X-IronPort-AV: E=Sophos;i="4.89,795,1367985600";
d="scan'208";a="68392431"
Received: from ktnron06-1242489386.sdsl.bell.ca (HELO servers.com) ([74.14.226.42])
by toip59-bus.srvr.bell.ca with ESMTP; 01 Aug 2013 10:51:19 -0400
From: support
To: dave@doctor.nl2k.ab.ca
Subject: PayPaI - Notice - zgfhhsywf
Date: 01 Aug 2013 10:40:36 -0400
Message-ID: <20130801104036.7F181530C4FD020D@servers.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 5.3
X-Spam_score_int: 53
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: We regret to inform you that access to your account has been
temporarily limited. This has been done due to several failed log-in attempts.
Case ID: QZ-442-55-12 [...]
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1
[207.236.237.38 listed in dnsbl-1.uceprotect.net]
1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org
[207.236.237.38 listed in ips.backscatterer.org]
2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2
[207.236.237.38 listed in dnsbl-2.uceprotect.net]
0.1 TW_GF BODY: Odd Letter Triples with GF
0.1 TW_YW BODY: Odd Letter Triples with YW
0.1 TW_FH BODY: Odd Letter Triples with FH
0.1 TW_ZG BODY: Odd Letter Triples with ZG
Subject: {SPAM?} PayPaI - Notice - zgfhhsywf
We regret to inform you that access to&nb=
sp;your account has been temporarily limited.
r>
This has been done due to several failed&=
nbsp;log-in attempts.
Case ID: QZ-442-55-12
To restore your account please
58152247122.netvigator.com/appserv/bosa24512.html">Click Here =
=2E
If you fail to log in correctly your =
;account will be suspended for fraud preventio=
n.
We apologize for the inconvenience, this measu=
re was taken for your protection.
This message is intended for dave@doctor.nl2k.ab.ca
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments