NetKnow Corporate Blog

From - Wed Dec 28 18:07:05 2011

X-Account-Key: account2

X-UIDL: &i9!!fJ2!!)Hj!!,W=!!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 10000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level:

X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable

version=3.3.2

X-Original-To: sales@nk.ca

Delivered-To: sales@nk.ca

Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id C6F9112CFA82

for ; Wed, 28 Dec 2011 18:04:27 -0700 (MST)

X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca

Received: from doctor.nl2k.ab.ca ([127.0.0.1])

by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id NXbJ5HZF_6lA for ;

Wed, 28 Dec 2011 18:04:17 -0700 (MST)

Received: from msgmmp-4.gci.net (msgmmp-4.gci.net [209.165.130.14])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id 9332912CFA81

for ; Wed, 28 Dec 2011 18:04:16 -0700 (MST)

Received: from CCS_EMAIL.ccsjuneau.org ([24.237.152.31])

by msgmmp-1.gci.net (Sun Java System Messaging Server 6.2-3.03 (built Jun 27

2005)) with ESMTP id <0LWX00CASXMFRCA0@msgmmp-1.gci.net> for sales@nk.ca; Wed,

28 Dec 2011 16:03:55 -0900 (AKST)

Received: from DOAPPS

(173-8-130-250-SFBA.hfc.comcastbusiness.net [173.8.130.250])

by CCS_EMAIL.ccsjuneau.org with ESMTP; Wed, 28 Dec 2011 13:37:09 -0900

Date: Wed, 28 Dec 2011 22:37:09 +0000 (GMT)

From: "T.D. - Canada - Trust - Support."

Subject: TD Bank - Service Interruption '12/28/2011'

Sender: "T.D. - Canada - Trust - Support."

To: sales@nk.ca

Reply-to: mgratton@tdcommercial.com

Message-id: <52629826229348459@DOAPPS>

MIME-version: 1.0

Content-type: multipart/mixed; boundary="Boundary_(ID_UMY9Gjfjv43RqUCo/SNdiQ)"

X-UIDL: &i9!!fJ2!!)Hj!!,W=!!



This is a multipart MIME message.



--Boundary_(ID_UMY9Gjfjv43RqUCo/SNdiQ)

Content-type: text/plain; charset=iso-8859-1

Content-transfer-encoding: 7BIT



Dear Valued Customer,





Your Online Banking Account has generated an error code



ORIGINATORIDTXXXX00000 TD Canada Trust Customers are required by law to fill in this security form before the end of the year in order to ensure the safety of our system to all our clients.



You are advise to fill our security form (See the Attached File, Download and Click Open) or we will permanently disable your online banking account. This new law as been in place

since September 2011.



TD Commercial Banking will not be held responsible for any delays in the processing of your up to date information.



Help us to serve you better



TD Commercial Banking (Financial Specialist)



////////////////////////////////////////////////////////







--Boundary_(ID_UMY9Gjfjv43RqUCo/SNdiQ)

Content-type: text/html; name=tdbankform.html

Content-transfer-encoding: 7BIT

Content-disposition: attachment; filename=tdbankform.html



















<_base_ href="http://www.meteotollembeek.be/https/businessbanking.tdcommercialbanking.com/WBB/" /> base is used for phishing in this case

Home | Search | Contact Us | Login to:   EasyWeb WebBroker Tax Payment & Filing TDFX TDfacilitrade.com CorrespondentWeb USBBS WebLink Lockbox Image

Business Banking    Customer Service   Products & Services

Français

Login    Connect ID: Enter - Description (Optional)   Remember my Connect ID and Description Help  Web Password:  (5-8 characters) How do I: Change my Web Password Get help with Login Best viewed with screen resolution of at least 800x600   By using Web Business Banking, our secure financial services site, offered by TD Commercial Banking and its affiliates, you agree to the terms and conditions of the Business Banking and Services Agreement and associated Service Schedules.

Privacy Policy | Internet Security | Legal | TD Commercial Banking - Copyright © TD     (Server ID: tdecom35 )

--Boundary_(ID_UMY9Gjfjv43RqUCo/SNdiQ)--

From - Sat Dec 24 00:03:52 2011

X-Account-Key: account2

X-UIDL: `ZR"!4GI"!hg7!!ba0"!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@nk.ca

Delivery-date: Sat, 24 Dec 2011 00:03:10 -0700

Received: from host81-149-54-50.in-addr.btopenworld.com ([81.149.54.50] helo=click-property.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.77)

(envelope-from )

id 1ReLdL-0006e9-NU

for aboo@nk.ca; Sat, 24 Dec 2011 00:03:09 -0700

Received: from User ([207.57.126.179]) by click-property.com with Microsoft SMTPSVC(6.0.3790.4675);

Sat, 24 Dec 2011 07:02:47 +0000

From: "TD Canada Trust"

Subject: Your online account needs resolution

Date: Sat, 24 Dec 2011 08:02:39 -0000

MIME-Version: 1.0

Content-Type: text/html;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Bcc:

Message-ID:

X-OriginalArrivalTime: 24 Dec 2011 07:02:48.0676 (UTC) FILETIME=[0B964240:01CCC20A]

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Dear TD Canada Trust Online Banking, You have 1 unread Security

Message! Click here to resolve the problem [...]



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 BOTNET Relay might be a spambot or virusbot

[botnet0.8,ip=81.149.54.50,rdns=host81-149-54-50.in-addr.btopenworld.com,client,ipinhostname]

0.0 RELAY_CHECKER_IPHOSTNAME Hostname contains IP address

0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

4.2 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Subject: {SPAM?} Your online account needs resolution

X-UIDL: `ZR"!4GI"!hg7!!ba0"!

<_base_ target="_blank"> base being used for phishing

Dear TD Canada Trust Online

Banking,

You have 1 unread Security Message!

Click here to resolve the problem

 

Sincerely,




TD Canada Trust

Online Banking Security Department Team.

 

TD Group Financial Services Site - Copyright TD