Yahoo! Spam from hijacked accounts

Specimen 1)



From jokorea36@yahoo.ca Wed Feb 20 05:56:18 2013

Return-Path: jokorea36@yahoo.ca

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ****

X-Spam-Status: No, score=4.6 required=5.0 tests=DKIM_SIGNED,NOTVALID_YAHOO,

RCVD_IN_BACKSCATTER,TW_JX,TW_XH autolearn=no version=3.3.2

X-Original-To: root@doctor.nl2k.ab.ca

Delivered-To: root@doctor.nl2k.ab.ca

Received: from nm39-vm6.bullet.mail.bf1.yahoo.com

(nm39-vm6.bullet.mail.bf1.yahoo.com [72.30.239.150]) (using TLSv1 with

cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate

requested) by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 3305112CFA82

+for

; Wed, 20 Feb 2013 05:55:34 -0700 (MST)

Received: from [98.139.212.152] by nm39.bullet.mail.bf1.yahoo.com with NNFMP;

20 Feb 2013 12:55:26 -0000

Received: from [98.139.212.206] by tm9.bullet.mail.bf1.yahoo.com with NNFMP; 20

Feb 2013 12:55:26 -0000

Received: from [127.0.0.1] by omp1015.mail.bf1.yahoo.com with NNFMP; 20 Feb

2013 12:55:26 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: 142745.22289.bm@omp1015.mail.bf1.yahoo.com

Received: (qmail 73411 invoked by uid 60001); 20 Feb 2013 12:48:46 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s1024;

t=1361364526; bh=Xv9OdnwUS82/xfUDaG7yUb4fhFx9Cprtj+Y4iBpSXmk=;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=Ae69qUarB4/FFkSAd4+SQsJVNT1iThIPyMH23Yf0mRqED9FamZNewVUpo/4H+V7j2nus6s

evwswVMCAfEPEHEyddISDGzDFExQQyJbl2/t/lo81CImfiSxB6/LnqG9+63CndutXXaydqwI

W5Vgdw2HN7hFt3dOOvSBg4QFv1R4w=

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.ca;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=qPK3g+LS7l5cyy1igWy81aawgNlIOtuidWboxbfETVx3cWmKbLDhuxToe8aDMfm7FHkdMn

kH3gom0T9T39NALvI5/JcEk2dA/q+s/Z1gxsi/m25Byu+L4gyqCxpEbVcaeC49X9djtmB/Mn

Kk7H+mDJntNw+YldaOIZunRMiqa9M=;

X-YMail-OSG: Mrb4F7YVM1lr5JffIFTIlqN12UQohO6w.6zFnVRaQvgCvvf

18wF_RiKmolRAMEbN0giv4PUQkNnlKL6.6iDCxhDSx8zBq4EZdyMlXzdoPzy

aRk1cwdiST9arHzvOlKEXEpPzjVeLkwI88qyk1nuxS64H9bUZZrDNU._G9u9

f6TRckbxzhHJmCANH4_W8aCj8QJS27nf.jG0.8l3YpLqUgDvlZMqOJ8Mnnzt

76rpf22lwgEM8uXi.oKjSbucjzUCaAkg8QFdJmE56qKkGWvRKxEOOKqzL8xL

.j1vjmQwHxwRIKaUTNBThQK8P7xTyST4vxidDRPSDrQq0O6fXBRNrgSReeRE

OYwEjinc38AXIi.A1pBLLCAS.hHx3mk0ExJ6b8UCmyV9CDt7jdSUVGe2KrwC

QxkOipIf0af48pi9rExOq_Y_c.09khUa8olKRKtsIyfy8zSvjd8G3exTSACG

V4qKM6.m7akFxUd6CC77XsN66HGw7BhVY2m6ohY3S0hgEU35hsBlja6ZOIpJ

cUqRFJR9LWNFw2Pp4n.3LT23Wi622vtcgLkq_Bvcd6wVyUKRqrr90ST6qqnK

OgmFnMWDeF6ZMUpiVhhmk8XdRBL5JvxPUqtCOIwNJACo5BX3L5FNv4IBbDHf

2pwUDF8bUusY58wEKih9M

Received: from [95.135.136.9] by web140606.mail.bf1.yahoo.com via HTTP; Wed, 20

Feb 2013 04:48:46 PST

X-Rocket-MIMEInfo:

001.001,aHR0cDovL3d3dy5sZXNtaWVsc2RlbW9ubW91bGluLmNvbS9mY25ydXRjL2oxempw

ZTQyNzN1eHhmZWRwMnQwZDlqay4xMm1jP2FxZnF4aWYzanpsaHZ1bXR2OXI3IAoKCgoKCgpC

aWxsaS1KbyBJcndpbiAKCiAKCgoyLzIwLzIwMTMgMTo0ODo0NSBQTQoKCgoKCgoKCgoKCgoK

CnZjcCBudXMgdHV3aCBlbGp4aHABMAEBAQE-

X-Mailer: YahooMailWebService/0.8.134.513

Message-ID: <1361364526.41205.YahooMailNeo@web140606.mail.bf1.yahoo.com>

Date: Wed, 20 Feb 2013 04:48:46 -0800 (PST)

From: Billi-Jo Irwin

Reply-To: Billi-Jo Irwin

Subject: RE:Billi-Jo Irwin

To: root , amichael202 ,

meynberg ,

John Faber ,

peng tan ,

eikelandpaul ,

bkamphius ,

jdtremblay , ctm e

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1905101558-1130670243-1361364526=:41205"

X-NetKnow-InComing-4-84-5-2-MailScanner-Information: Please contact the ISP for

more information

X-NetKnow-InComing-4-84-5-2-MailScanner-ID: 3305112CFA82.A0B2F

X-NetKnow-InComing-4-84-5-2-MailScanner: Found to be clean

X-NetKnow-InComing-4-84-5-2-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-84-5-2-MailScanner-SpamScore: s

X-NetKnow-InComing-4-84-5-2-MailScanner-From: jokorea36@yahoo.ca

X-NetKnow-InComing-4-84-5-2-MailScanner-Watermark:

1361796935.89456@+PSm77uUqgtUGPqGCktBgQ

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

Status: RO

Content-Length: 3671

Lines: 98



Content-Type: text/plain; charset=us-ascii



http://www.lesmielsdemonmoulin.com/fcnrutc/j1zjpe4273uxxfedp2t0d9jk.12mc?aqfqxif

+3jzlhvumtv9r7













Billi-Jo Irwin









2/20/2013 1:48:45 PM





























vcp nus tuwh eljxhp

--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.







Specimen 2)



From flooringoutfitters@yahoo.ca Wed Feb 20 01:15:54 2013

Return-Path: flooringoutfitters@yahoo.ca

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ****

X-Spam-Status: No, score=4.5 required=5.0 tests=DKIM_SIGNED,NOTVALID_YAHOO,

RCVD_IN_BACKSCATTER autolearn=no version=3.3.2

X-Original-To: aboo@nk.ca

Delivered-To: aboo@nk.ca

Received: from nm32-vm8.bullet.mail.gq1.yahoo.com

(nm32-vm8.bullet.mail.gq1.yahoo.com [98.136.216.231]) (using TLSv1 with

cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate

requested) by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 7CB9212CFA85

+for

; Wed, 20 Feb 2013 01:14:12 -0700 (MST)

Received: from [98.137.12.55] by nm32.bullet.mail.gq1.yahoo.com with NNFMP; 20

Feb 2013 08:14:06 -0000

Received: from [98.137.12.48] by tm15.bullet.mail.gq1.yahoo.com with NNFMP; 20

Feb 2013 08:14:06 -0000

Received: from [127.0.0.1] by omp1063.mail.gq1.yahoo.com with NNFMP; 20 Feb

2013 08:14:06 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: 257270.62035.bm@omp1063.mail.gq1.yahoo.com

Received: (qmail 27644 invoked by uid 60001); 20 Feb 2013 08:14:05 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s1024;

t=1361348045; bh=MGh6OxBk9kn3ozOO+6EOYFt+DfVWM5WsH2mfEYG2bNg=;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=wpVJ79NDTblv16Hzx/yUB2l5NmGiKKCkEuYwIOJfbXMGowjN+JI5JogG5hJHbDUDxZ78u1

ooyfe8qm6NIeetyqFHMfIha1PSw/dURSQfjrsUtalUlBjxavjQjVW4054+jPAnueW/Sbqo/j

aX6DsrvLWmn+BKTuN1vNdnDR4EtAs=

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.ca;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:R

eply-To:Subject:To:MIME-Version:Content-Type;

b=nsIQQGNyDcZdL7Lxd0/j0wYRehSbA3bcpZrCQUPXKB2inhi+1XmJNwPb6B9ibvPKa1Cv2F

02TSYkvzjwTlVOe5PAh0KcIPCOtvTfTzJA0mqIggMDn+a0OPwlTUaGY5DiLWHdvhrMkqvVle

HZc7dmV/xvzsbm+KsMQzTJbgdGRh4=;

X-YMail-OSG: ZCUWSI4VM1lM2_Ja5PU_KAf9LRT5GmWrG7ti1lcjWKnWArZ

_RzkoohazevLuRY_OjdYZ

Received: from [89.239.114.38] by web163606.mail.gq1.yahoo.com via HTTP; Wed,

20 Feb 2013 00:14:05 PST

X-Rocket-MIMEInfo:

001.001,aHR0cDovL3d3dy5tYWNyb21hcmtldGluZ3NvbHV0aW9ucy5jb20vY2xwYWllL2ph

OGVteWpzajR5ODJjNWdqNnp6dGFjdi41ajUybT9uM25yaDJrbGs4ZGV5YWs1cWI2dnFvazRt

NzUgCgoKCgoKCkdhcnkgR2F1bGV5IAoKIAoKCjIvMjAvMjAxMyA5OjE0OjA0IEFNATABAQEB

X-Mailer: YahooMailWebService/0.8.134.513

Message-ID: <1361348045.26792.YahooMailNeo@web163606.mail.gq1.yahoo.com>

Date: Wed, 20 Feb 2013 00:14:05 -0800 (PST)

From: Gary Gauley

Reply-To: Gary Gauley

Subject: Gary Gauley

To: info ,

armstrong ,

mercier , info ,

lauzon ,

scott stewart ,

scottstewart , Aboo Yadalee ,

Alisha Webb

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="-1147583323-719735729-1361348045=:26792"

X-NetKnow-InComing-4-84-5-2-MailScanner-Information: Please contact the ISP for

more information

X-NetKnow-InComing-4-84-5-2-MailScanner-ID: 7CB9212CFA85.ADE2D

X-NetKnow-InComing-4-84-5-2-MailScanner: Found to be clean

X-NetKnow-InComing-4-84-5-2-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-84-5-2-MailScanner-From: flooringoutfitters@yahoo.ca

X-NetKnow-InComing-4-84-5-2-MailScanner-Watermark:

1361780057.51107@nA4IH9uSOfdgKlKm5R9z2w

X-UID: 343491

X-Keywords: NonJunk

Status: RO

Content-Length: 1194

Lines: 33



Content-Type: text/plain; charset=us-ascii



http://www.macromarketingsolutions.com/clpaie/ja8emyjsj4y82c5gj6zztacv.5j52m?n3n

+rh2klk8deyak5qb6vqok4m75













Gary Gauley



2/20/2013 9:14:04 AM

--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.