More Bank of Montreal Phish

Posted by Dave Yadallee on
From - Tue Jun 11 13:44:39 2013

X-Account-Key: account1

X-UIDL: 00001c0e4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Tue, 11 Jun 2013 09:25:30 -0600

Received: from troll.websitewelcome.com ([50.97.97.53])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.80.1)

(envelope-from )

id 1UmQRr-0006xD-5x

for dave@nk.ca; Tue, 11 Jun 2013 09:25:30 -0600

Received: from [88.2.97.79] (port=12831 helo=servidor)

by troll.websitewelcome.com with esmtpa (Exim 4.80)

(envelope-from )

id 1UmQRj-0005gy-Q2; Tue, 11 Jun 2013 10:25:20 -0500

MIME-Version: 1.0

Date: Tue, 11 Jun 2013 17:25:01 +0200

X-Priority: 3 (Normal)

Subject: Your access has been locked.

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html

From: "Bank of Montreal"

Message-ID: <044A6552B1CC3A83E223BD205FEE7F93D87B177E@SERVIDOR>

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - troll.websitewelcome.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - partypillhighs.com

X-BWhitelist: no

X-Source:

X-Source-Args:

X-Source-Dir:

X-Source-Sender: (servidor) [88.2.97.79]:12831

X-Source-Auth: lee@superputers.net

X-Email-Count: 41

X-Source-Cap: c3VwZXJwdXQ7ZG9qNDY0O3Ryb2xsLndlYnNpdGV3ZWxjb21lLmNvbQ==

X-Antivirus: AVG for E-mail 10.0.1432 [3199/5901]

X-AVG-ID: ID7F6D7831-653962EA




=3Dutf-8">


"http://s9.postimg.org/z1rfh9cb3/image.gif" />




Your Onlin=

e Banking access has been locked.



You will need to click :
ref=3D"http://7b590223b5d1697926d3998acdc5d463.askfana.com/bmo/?token=3D7b5=

90223b5d1697926d3998acdc5d463" target=3D"_blank">Log On to BMO Online Banki=

ng and proceed with the verification process.




Sincere=

ly,
BMO Financial Group




>

No virus foun=

d in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3199/5901 - Release Date: 06/11/13

=









More Bank of Montreal Phish

Posted by Dave Yadallee on
From - Tue Jun 11 13:44:39 2013

X-Account-Key: account1

X-UIDL: 00001c0d4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 11 Jun 2013 09:24:43 -0600

Received: from server.bizonehosting.com ([216.14.120.121])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.80.1)

(envelope-from )

id 1UmQR6-0006sj-Ks

for dave@doctor.nl2k.ab.ca; Tue, 11 Jun 2013 09:24:43 -0600

Received: from 79.red-88-2-97.staticip.rima-tde.net ([88.2.97.79]:12818 helo=servidor)

by server.bizonehosting.com with esmtpa (Exim 4.80.1)

(envelope-from )

id 1UmQQz-0006AQ-2l; Tue, 11 Jun 2013 11:24:09 -0400

MIME-Version: 1.0

Date: Tue, 11 Jun 2013 17:24:23 +0200

X-Priority: 3 (Normal)

Subject: Your access has been locked.

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html

From: "Bank of Montreal"

Message-ID:

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.bizonehosting.com

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - partypillhighs.com

X-Get-Message-Sender-Via: server.bizonehosting.com: authenticated_id: test@solarchemonline.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Antivirus: AVG for E-mail 10.0.1432 [3199/5901]

X-AVG-ID: ID3DEEB69C-4351864




=3Dutf-8">


"http://s9.postimg.org/z1rfh9cb3/image.gif" />




Your Onlin=

e Banking access has been locked.



You will need to click :
ref=3D"http://f18a75e7b3e75c9c6d729ef60cb1f6b5.askfana.com/bmo/?token=3Df18=

a75e7b3e75c9c6d729ef60cb1f6b5" target=3D"_blank">Log On to BMO Online Banki=

ng and proceed with the verification process.




Sincere=

ly,
BMO Financial Group




>

No virus foun=

d in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3199/5901 - Release Date: 06/11/13

=









More Bank of Montreal Phish

Posted by Dave Yadallee on
From - Tue Jun 11 13:44:34 2013

X-Account-Key: account1

X-UIDL: 00001c024f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Mon, 10 Jun 2013 07:43:50 -0600

Received: from server.webhostingscotland.net ([109.75.162.216])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.80.1)

(envelope-from )

id 1Um2Nt-0000iQ-Pi

for dave@nk.ca; Mon, 10 Jun 2013 07:43:50 -0600

Received: from 72-48-88-11.static.grandenetworks.net ([72.48.88.11]:56781 helo=elsmail1)

by server.webhostingscotland.net with esmtpa (Exim 4.80)

(envelope-from )

id 1Um2Nh-0003yL-4U; Mon, 10 Jun 2013 14:43:33 +0100

MIME-Version: 1.0

Date: Mon, 10 Jun 2013 08:43:29 -0500

X-Priority: 3 (Normal)

Subject: Failed login attempts - Reference ID: (3nt77aokU7cPMiA)

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

From: "Bank of Montreal"

Message-ID: <74B4FD4C53FA0F278C7E1EDFC256744128DA1F3D@ELSMAIL1>

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.webhostingscotland.net

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - bmo.com

X-Get-Message-Sender-Via: server.webhostingscotland.net: authenticated_id: info@funkylemon.com

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: New Page 1 Your Online Banking access has been locked due

to an unusual number of failed login attempts. You will need to click : Log

On to BMO Online Banking and proceed with the verification process. [...]





Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

11 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN

[109.75.162.216 listed in hostkarma.junkemailfilter.com]

0.7 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.7 SARE_HTML_URI_LHOST31 URI: Long unbroken string within URI

Subject: {SPAM?} Failed login attempts - Reference ID: (3nt77aokU7cPMiA)
















252">

New Page 1












" cellPadding=3D"10"

width=3D"575" summary=3D"layout" borderColorLight=3D"#003399" border=3D"1">








e.gif">




rong>
Your Online Ba=

nking access has been locked due to an unusual number of fa=

iled login attempts.





You will need to click :


/b1/?token=3D82f5acb51a3c06955318325ebdee7b0d">Log On to BMO Online Bank=

ing and proceed with the verification process.
ont face=3D"Verdana" size=3D"2">








Sinc
-- p2h! -->erely,




BMO Financial Group




Message ID: OU5WKZylS1PtM3MbhcSPSszioqEnq3y1














More Paypal Phish

Posted by Dave Yadallee on
From - Thu May 30 05:18:32 2013

X-Account-Key: account1

X-UIDL: 00001b7a4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 30 May 2013 02:49:49 -0600

Received: from relais.videotron.ca ([24.201.245.36])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1UhyYF-00003B-9u

for dave@nk.ca; Thu, 30 May 2013 02:49:48 -0600

MIME-version: 1.0

Content-type: multipart/mixed; boundary="Boundary_(ID_9GWAlhrtL3oXnTGS306Rkg)"

Received: from [192.168.1.10] ([135.19.80.127]) by VL-VM-MR001.ip.videotron.ca

(Oracle Communications Messaging Exchange Server 7u4-22.01 64bit (built Apr 21

2011)) with ESMTP id <0MNL00G6BSF88G90@VL-VM-MR001.ip.videotron.ca> for

dave@nk.ca; Thu, 30 May 2013 04:49:38 -0400 (EDT)

Message-id: <0MNL00GD0SID8G90@VL-VM-MR001.ip.videotron.ca>

Subject: PayPal Service - Security Measure

To: Recipients

From: Service PayPal

Date: Thu, 30 May 2013 04:49:01 -0400

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: PayPal PayPal account information: Hello, We have recently

determined that differents computers are connected to your account, and spend

a lot of chess were present before the login. Therefore, your account has

been suspended. To recover your PayPal account, you'll need to update your

account information. [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[24.201.245.36 listed in dnsbl-1.uceprotect.net]

2.0 RCVD_IN_SPAMCANNIBAL RBL: Received via a relay in SpamCannibal

[24.201.245.36 listed in bl.spamcannibal.org]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[24.201.245.36 listed in ips.backscatterer.org]

Subject: {SPAM?} PayPal Service - Security Measure



You will not see this in a MIME-aware mail reader.



--Boundary_(ID_9GWAlhrtL3oXnTGS306Rkg)

MIME-version: 1.0

Content-type: text/plain; CHARSET=US-ASCII

Content-transfer-encoding: 7BIT

Content-description: Mail message body



PayPal









PayPal account information:





Hello,

We have recently determined that differents computers are connected to your account,

and spend a lot of chess were present before the login.

Therefore, your account has been suspended. To recover your PayPal account, you'll need to update your account information.



It will be easy!



Download the attached and open it in a browser window secure.

Once opened, you will be provided with steps to restore your access and follow the instructions..





Sincerely,

PayPal



--Boundary_(ID_9GWAlhrtL3oXnTGS306Rkg)

MIME-version: 1.0

Content-type: text/html; NAME=formulaire.html; charset=iso-8859-1

Content-transfer-encoding: quoted-printable

Content-disposition: attachment; filename=formulaire.html







Donn=E9es de facturation













=



--Boundary_(ID_9GWAlhrtL3oXnTGS306Rkg)--





More Paypal Phish

Posted by Dave Yadallee on
From - Thu May 30 05:18:32 2013

X-Account-Key: account1

X-UIDL: 00001b794f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 May 2013 02:49:32 -0600

Received: from relais.videotron.ca ([24.201.245.36])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1UhyXz-0007nG-5S

for dave@doctor.nl2k.ab.ca; Thu, 30 May 2013 02:49:31 -0600

MIME-version: 1.0

Content-type: multipart/mixed; boundary="Boundary_(ID_fFcgTPNhCnbJ6rNLOS8J1Q)"

Received: from [192.168.1.10] ([135.19.80.127]) by VL-VM-MR001.ip.videotron.ca

(Oracle Communications Messaging Exchange Server 7u4-22.01 64bit (built Apr 21

2011)) with ESMTP id <0MNL00G6BSF88G90@VL-VM-MR001.ip.videotron.ca> for

dave@doctor.nl2k.ab.ca; Thu, 30 May 2013 04:49:22 -0400 (EDT)

Message-id: <0MNL00GBNSHX8G90@VL-VM-MR001.ip.videotron.ca>

Subject: PayPal Service - Security Measure

To: Recipients

From: Service PayPal

Date: Thu, 30 May 2013 04:48:44 -0400

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: PayPal PayPal account information: Hello, We have recently

determined that differents computers are connected to your account, and spend

a lot of chess were present before the login. Therefore, your account has

been suspended. To recover your PayPal account, you'll need to update your

account information. [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[24.201.245.36 listed in dnsbl-1.uceprotect.net]

2.0 RCVD_IN_SPAMCANNIBAL RBL: Received via a relay in SpamCannibal

[24.201.245.36 listed in bl.spamcannibal.org]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[24.201.245.36 listed in ips.backscatterer.org]

Subject: {SPAM?} PayPal Service - Security Measure



You will not see this in a MIME-aware mail reader.



--Boundary_(ID_fFcgTPNhCnbJ6rNLOS8J1Q)

MIME-version: 1.0

Content-type: text/plain; CHARSET=US-ASCII

Content-transfer-encoding: 7BIT

Content-description: Mail message body



PayPal









PayPal account information:





Hello,

We have recently determined that differents computers are connected to your account,

and spend a lot of chess were present before the login.

Therefore, your account has been suspended. To recover your PayPal account, you'll need to update your account information.



It will be easy!



Download the attached and open it in a browser window secure.

Once opened, you will be provided with steps to restore your access and follow the instructions..





Sincerely,

PayPal



--Boundary_(ID_fFcgTPNhCnbJ6rNLOS8J1Q)

MIME-version: 1.0

Content-type: text/html; NAME=formulaire.html; charset=iso-8859-1

Content-transfer-encoding: quoted-printable

Content-disposition: attachment; filename=formulaire.html







Donn=E9es de facturation













=



--Boundary_(ID_fFcgTPNhCnbJ6rNLOS8J1Q)--





More Royal Bank of Canada Phish

Posted by Dave Yadallee on
From - Thu May 30 06:18:20 2013

X-Account-Key: account1

X-UIDL: 00001b7e4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 May 2013 06:17:22 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1Ui1mY-00012D-C7

for dave@doctor.nl2k.ab.ca; Thu, 30 May 2013 06:16:38 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Thu, 30 May 2013 06:16:38 -0600

Resent-Message-ID: <20130530121638.GA3670@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from www.oneeyeland.com ([66.132.135.128] helo=oneeyeland.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1Ui1Zw-0002c5-3f

for sales@nk.ca; Thu, 30 May 2013 06:03:45 -0600

Received: from advisor.webssl.com (unknown [142.46.21.137])

by oneeyeland.com (Postfix) with ESMTPA id 569448B935

for ; Tue, 28 May 2013 04:54:13 +0530 (IST)

From: RBC Royal Bank

To: sales@nk.ca

Subject: Message Center: 1 New Alert Message!

Date: 27 May 2013 19:24:09 -0400

Message-ID: <20130527192409.068D033D58DC61D7@advisor.webssl.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 15.0

X-Spam_score_int: 150

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: RBC Royal Bank / Message Center: 1 New Alert Message! 1 New

Alert Message! Customer Service: Your account has been limited! Click to

Resolve Thank you for using Royal Bank of Canada. [...]



Content analysis details: (15.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_SPAMCANNIBAL RBL: Received via a relay in SpamCannibal

[66.132.135.128 listed in bl.spamcannibal.org]

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[66.132.135.128 listed in dnsbl-1.uceprotect.net]

11 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN

[66.132.135.128 listed in hostkarma.junkemailfilter.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

Subject: {SPAM?} Message Center: 1 New Alert Message!







RBC Royal Bank / Message Center: 1 New Alert Message!


albank_en.gif">






ld.gif"> 1 New Alert Message!




=20



g=3D"0" width=3D"100%">

ellpadding=3D"3" cellspacing=3D"0" width=3D"100%">




Customer Service: Your account has be=

en limited!
-107-193-215-2.dsl.pltn13.sbcglobal.net/ssl/rbaccess/encrypted-session/F6=3D=

1&F7=3DIB&F21=3DIB&F22=3DIB&REQUEST=3DClientSignin&LANGUAGE=3DENGLISH/index.=

php">Click to Resolve






=20

Thank you for using Royal Bank of Canada.











Western Union Phish

Posted by Dave Yadallee on
From - Sat May 25 07:47:31 2013

X-Account-Key: account1

X-UIDL: 00001af44f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level:

X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable

version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: from olc-11.verat.net (olc-11.verat.net [62.108.127.37])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id BE50612CFA88

for ; Thu, 23 May 2013 06:27:35 -0600 (MDT)

Received: from webmail.verat.net (home.verat.net [217.26.64.151])

by olc-11.verat.net (Postfix) with ESMTP id 44B8323AE81;

Thu, 23 May 2013 14:19:54 +0200 (CEST)

Received: from 41.206.15.37

(SquirrelMail authenticated user iglavic)

by webmail.verat.net with HTTP;

Thu, 23 May 2013 14:27:25 +0200

Message-ID: <36d37d70be85e33c9478a793e170de0a.squirrel@webmail.verat.net>

Date: Thu, 23 May 2013 14:27:25 +0200

Subject: [Norton AntiSpam]Western Union

From: "Western Union"

Reply-To: agentandersonmax@yahoo.com.hk

User-Agent: SquirrelMail/1.4.22

MIME-Version: 1.0

Content-Type: text/plain; charset=utf8

Content-Transfer-Encoding: 8bit

X-Priority: 3 (Normal)

Importance: Normal

To: undisclosed-recipients:;

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID222F86B0-5294BCB8

X-Brightmail-Tracker: AAAABR3FMVQdxPsvHcVezh3FYScdxV7R



Your $250,000.00USD deposited in our Western Union Transfer Office is

available for pickup.You were selected as a winner of ECOWAS LOTTERY

JACKPOT.For more info/how to claim your prize,you are to contact

thewestern union money office agent : Mr Anderson Max

Email:agentandersonmax@yahoo.com.hk



Regards

Mrs Josephine Rose





-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13









-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13





Paypal Phish

Posted by Dave Yadallee on
From - Sat May 25 07:47:27 2013

X-Account-Key: account1

X-UIDL: 00001aed4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Received: from localhost by doctor.nl2k.ab.ca

with SpamAssassin (version 3.3.2);

Thu, 23 May 2013 04:18:57 -0600

From: =?UTF-8?Q?ServicesPayPal?=

To: doctor@doctor.nl2k.ab.ca

Subject: SPAM =?UTF-8?Q?Dernier_rappel_=3a_Mise_ _jours_necessaire_=21?=

Date: Wed, 22 May 2013 17:17:51 -0700 (MST)

Message-Id: <20130523001751.5C1842F5B6@ip-97-74-196-133.ip.secureserver.net>

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Flag: YES

X-Spam-Level: **************

X-Spam-Status: Yes, score=14.0 required=5.0 tests=RCVD_IN_BACKSCATTER,

RCVD_IN_JMF_BR,RCVD_IN_UCE_PFSM_1 autolearn=unavailable version=3.3.2

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="----------=_519DED11.0B76F80A"

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID586FF73B-52843E52

X-Brightmail-Tracker: AAAAAh3E6AodxOgB

X-Brightmail-Tracker: AAAAAA==



This is a multi-part message in MIME format.



------------=_519DED11.0B76F80A

Content-Type: text/plain; charset=iso-8859-1

Content-Disposition: inline

Content-Transfer-Encoding: 8bit



Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Chère/Chèr, Client : Cliquez ici pour afficher le message

complet. [...]



Content analysis details: (14.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[64.202.189.19 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[64.202.189.19 listed in ips.backscatterer.org]

11 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN

[64.202.189.19 listed in hostkarma.junkemailfilter.com]



The original message was not completely plain text, and may be unsafe to

open with some email clients; in particular, it may contain a virus,

or confirm that your address can receive spam. If you wish to view

it, it may be safer to save it to a file and open it with an editor.





------------=_519DED11.0B76F80A

Content-Type: message/rfc822; x-spam-type=original

Content-Description: original message before SpamAssassin

Content-Disposition: attachment

Content-Transfer-Encoding: 8bit



Return-Path:

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)

id C6D4212CFAD3; Thu, 23 May 2013 04:18:46 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Thu, 23 May 2013 04:18:46 -0600

Resent-Message-ID: <20130523101846.GA29611@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ***

X-Spam-Status: No, score=3.0 required=5.0 tests=RCVD_IN_BACKSCATTER,

RCVD_IN_UCE_PFSM_1 autolearn=no version=3.3.2

X-Original-To: doctor@doctor.nl2k.ab.ca

Delivered-To: doctor@doctor.nl2k.ab.ca

Received: from m1plded02-02.prod.mesa1.secureserver.net (m1plded02-02.prod.mesa1.secureserver.net [64.202.189.19])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id 3460512CFAC0

for ; Thu, 23 May 2013 02:01:56 -0600 (MDT)

Received: from ip-97-74-196-133.ip.secureserver.net ([97.74.196.133])

by m1plded02-02.prod.mesa1.secureserver.net with : DED :

id fL1h1l00G2t9yH501L1plF; Thu, 23 May 2013 01:01:49 -0700

x-originating-ip: 97.74.196.133

Received: by ip-97-74-196-133.ip.secureserver.net (Postfix, from userid 48)

id 5C1842F5B6; Wed, 22 May 2013 17:17:51 -0700 (MST)

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?Dernier_rappel_=3a_Mise_ _jours_necessaire_=21?=

From: =?UTF-8?Q?ServicesPayPal?=

Reply-To:

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: 8bit

Message-Id: <20130523001751.5C1842F5B6@ip-97-74-196-133.ip.secureserver.net>

Date: Wed, 22 May 2013 17:17:51 -0700 (MST)

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean















Chère/Chèr, Client :
size=2 face=Tahoma>Cliquez ici pour afficher le message complet.



















------------=_519DED11.0B76F80A

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-793823E1======="



--=======AVGMAIL-793823E1=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-793823E1=======--



------------=_519DED11.0B76F80A

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-7CFA8909======="



--=======AVGMAIL-7CFA8909=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-7CFA8909=======--



------------=_519DED11.0B76F80A--







More Amazon Phish

Posted by Dave Yadallee on
From - Sat May 25 07:47:22 2013

X-Account-Key: account1

X-UIDL: 00001ae44f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ***

X-Spam-Status: No, score=3.0 required=5.0 tests=RELAY_CHECKER_IPHOSTNAME,

SARE_FORGED_AMAZON autolearn=no version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)

id 6838212CFAA3; Wed, 22 May 2013 16:12:17 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Wed, 22 May 2013 16:12:17 -0600

Resent-Message-ID: <20130522221217.GA19622@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-Original-To: root@doctor.nl2k.ab.ca

Delivered-To: root@doctor.nl2k.ab.ca

Received: from www.chubun.com (s240.GhirosimaFL1.vectant.ne.jp [202.215.175.240])

(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 1B28A12CFAA0

for ; Wed, 22 May 2013 15:43:40 -0600 (MDT)

Received: from www.chubun.com (localhost.chubun.com [127.0.0.1])

by www.chubun.com (8.13.6/8.13.6) with ESMTP id r4MM84lh077876

for ; Thu, 23 May 2013 07:08:04 +0900 (JST)

(envelope-from www@chubun.com)

Received: (from www@localhost)

by www.chubun.com (8.13.6/8.13.6/Submit) id r4MM83Ks077874;

Thu, 23 May 2013 07:08:03 +0900 (JST)

(envelope-from www)

Date: Thu, 23 May 2013 07:08:03 +0900 (JST)

To: root@doctor.nl2k.ab.ca

Subject: [Norton AntiSpam]Important Account Security

From: "Amazon.com"

MIME-Version: 1.0

Content-type: text/html; charset=iso-8859-1

Content-Transfer-encoding: 8bit

Reply-To: "Amazon.com"

Message-ID: <5eb6bd18d9f7f6d054def04d6cac7ebd@>

X-Priority: 1

X-MSmail-Priority: High

X-Mailer: Microsoft Office Outlook, Build 11.0.5510

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID54439BA8-A54F272

X-Brightmail-Tracker: AAAABRwMUbodxOsrHcUHWB3FEpYdxRwo

X-Brightmail-Tracker: AAAAAR3Qe90=





Amazon Notice









Dear valued member,



We know how important account security is to you, and we've taken
several

steps to help keep your Amazon account information secure.



Your Amazon Payments account is subjected to several

verification
procedures to maintain the highest levels of security, trust,

and
protection. In order to maintain this level, we require

verification
of your current account. All details are kept in strict

confidence
and is sent via our secure server, which encrypts all submitted


information.



Please click con the confirm link below to complete your verification.




https://www.amazon.com/gp/css/account/cards/view.html?ie=UTF8&viewID=187




Thank you for choosing Amazon.com

No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13

No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13











Amazon Phish

Posted by Dave Yadallee on
From - Sat May 25 07:47:20 2013

X-Account-Key: account1

X-UIDL: 00001ae04f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ***

X-Spam-Status: No, score=3.0 required=5.0 tests=RELAY_CHECKER_IPHOSTNAME,

SARE_FORGED_AMAZON autolearn=no version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix, from userid 0)

id 6AD0112CFA84; Wed, 22 May 2013 13:01:00 -0600 (MDT)

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Wed, 22 May 2013 13:01:00 -0600

Resent-Message-ID: <20130522190100.GE1186@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-Original-To: root@nl2k.ab.ca

Delivered-To: root@nl2k.ab.ca

Received: from www.chubun.com (s240.GhirosimaFL1.vectant.ne.jp [202.215.175.240])

(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 3DC0D12CFA84

for ; Wed, 22 May 2013 12:50:07 -0600 (MDT)

Received: from www.chubun.com (localhost.chubun.com [127.0.0.1])

by www.chubun.com (8.13.6/8.13.6) with ESMTP id r4MJESdR094877

for ; Thu, 23 May 2013 04:14:28 +0900 (JST)

(envelope-from www@chubun.com)

Received: (from www@localhost)

by www.chubun.com (8.13.6/8.13.6/Submit) id r4MJERP0094876;

Thu, 23 May 2013 04:14:27 +0900 (JST)

(envelope-from www)

Date: Thu, 23 May 2013 04:14:27 +0900 (JST)

To: root@nl2k.ab.ca

Subject: [Norton AntiSpam]Important Account Security

From: "Amazon.com"

MIME-Version: 1.0

Content-type: text/html; charset=iso-8859-1

Content-Transfer-encoding: 8bit

Reply-To: "Amazon.com"

Message-ID: <5eb6bd18d9f7f6d054def04d6cac7ebd@>

X-Priority: 1

X-MSmail-Priority: High

X-Mailer: Microsoft Office Outlook, Build 11.0.5510

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID27F59328-3B1ED21F

X-Brightmail-Tracker: AAAABRwMUbodxOsrHcUHWB3FEpYdxRwo

X-Brightmail-Tracker: AAAAAR3Qe90=





Amazon Notice









Dear valued member,



We know how important account security is to you, and we've taken
several

steps to help keep your Amazon account information secure.



Your Amazon Payments account is subjected to several

verification
procedures to maintain the highest levels of security, trust,

and
protection. In order to maintain this level, we require

verification
of your current account. All details are kept in strict

confidence
and is sent via our secure server, which encrypts all submitted


information.



Please click con the confirm link below to complete your verification.




https://www.amazon.com/gp/css/account/cards/view.html?ie=UTF8&viewID=187




Thank you for choosing Amazon.com

No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13

No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13











More Wells Fargo Phish

Posted by Dave Yadallee on
From - Sat May 25 07:47:20 2013

X-Account-Key: account1

X-UIDL: 00001ae14f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ***

X-Spam-Status: No, score=3.9 required=5.0 tests=BOTNET,RCVD_IN_SPAMCANNIBAL,

RELAY_CHECKER_BADDNS,RELAY_CHECKER_IPHOSTNAME,SARE_SUB_MSG_SUBJ autolearn=no

version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: from vijon.it (unknown [158.58.172.137])

(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 9F79512CFA88

for ; Wed, 22 May 2013 13:47:19 -0600 (MDT)

Received: from [205.204.94.129] (helo=frontiernet.net)

by vijon.it with esmtpa (Exim 4.67)

(envelope-from )

id 1UfBRr-0005Rk-0U; Wed, 22 May 2013 17:59:31 +0200

Reply-To: no-reply@frontiernet.net

From: "WellsFargo"

Subject: New Message

Date: 22 May 2013 09:39:10 -0700

Message-ID: <20130522093910.AA5C0EA621001195@frontiernet.net>

MIME-Version: 1.0

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID797FFD3F-400ED1FD

X-Brightmail-Tracker: AAAABB3FBtgdxVhfHcVYgx3FWFc=

X-Brightmail-Tracker: AAAAAA==




solid #dddece;border-bottom:1px solid #999" cellpadding=3D"0" cellspacing=

=3D"0">=


;margin-left:10px;text-align:center" align=3D"center">
w.northcoastconcussion.org/WF.jpg" alt=3D"Wells Fargo" border=3D"0">
<=

/td>
-family:arial,helvetica,sans-serif;font-size:12px"> 

g=3D"0" cellspacing=3D"0">

y:arial,helvetica,sans-serif">

0px">


l,helvetica,sans-serif">Your online account will expire today


v style=3D"margin-left:0px;margin-bottom:15px">

x 10px;font-family:arial,helvetica,sans-serif;font-size:12px">Your online a=

ccount will expire today on May 22, 2013.

eft:0px;margin-bottom:15px">

arial,helvetica,sans-serif;font-size:12px">To=

reactivate your account, click :
"v2">
.scripts/">Sign On to Wells Fargo Online and proceed with the verificat=

ion process.

bottom:15px">


ont-size:12px">In case this process is not performed within 24 hours, your =

account will be permanently disabled.

:0px;margin-bottom:15px">


ont-size:12px">Sincerely,

tyle=3D"margin:0 0 15px 10px;font-family:arial,helvetica,sans-serif;font-si=

ze:12px">Wells Fargo Online Customer Service

n:16px 0 12px 0;padding:3px 0 3px 10px;background-color:#f7f8f3;border-top:=

1px solid #b3b2b2;border-bottom:1px solid #b3b2b2;vertical-align:top">
style=3D"padding-left:10px;font-size:11px;margin-bottom:15px;color:#666"><=

strong>Please do not reply to this email directly. To ensure a pro=

mpt and secure response, sign on to email us.



6">47fi9a15-3255-4v6n-ag57-84504fg4ddfe  
=








t" color=3D"#000000">No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13

=








t" color=3D"#000000">No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13

=







More CIBC Phish

Posted by Dave Yadallee on
From - Sat May 25 07:47:19 2013

X-Account-Key: account1

X-UIDL: 00001adf4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: *

X-Spam-Status: No, score=1.0 required=5.0 tests=BOTNET,RELAY_CHECKER_BADDNS

autolearn=no version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix, from userid 0)

id 534D312CFA84; Wed, 22 May 2013 12:57:05 -0600 (MDT)

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Wed, 22 May 2013 12:57:05 -0600

Resent-Message-ID: <20130522185705.GD1186@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-Original-To: doctor@doctor.nl2k.ab.ca

Delivered-To: doctor@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix)

id 0DE1112CFA9F; Wed, 22 May 2013 10:23:41 -0600 (MDT)

Delivered-To: ctm-e@nk.ca

Received: from jerry.hostirex.com (unknown [80.83.117.68])

(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 39F6212CFA9C

for ; Wed, 22 May 2013 10:23:39 -0600 (MDT)

Received: (qmail 3084 invoked by uid 0); 22 May 2013 16:21:35 -0000

Date: 22 May 2013 16:21:35 -0000

To: ctm-e@nk.ca

Subject: Your account is on restricted status

From: CIBC.Online.Request@cibc.com

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="968493591a75166bdeb0269e7640023d"

Message-Id: ibanking+3661694@cibc.com

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID260B0308-764F3650

X-Brightmail-Tracker: AAAAAQa7OvU=

X-Brightmail-Tracker: AAAAAA==



This is a multi-part message in MIME format.

--968493591a75166bdeb0269e7640023d

Content-Type: application/DEFANGED-966; charset="UTF-8"

Content-Transfer-Encoding: 7bit









--968493591a75166bdeb0269e7640023d

Content-Type: text/sanitizer-log; charset="iso-8859-1"

Content-Transfer-Encoding: 8bit

Content-Disposition: attachment; filename="sanitizer.log"



This message has been 'sanitized'. This means that potentially

dangerous content has been rewritten or removed. The following

log describes which actions were taken.



Sanitizer (start="1369239826"):

Part (pos="1278"):

SanitizeFile (filename="unnamed.html", mimetype="text/html"):

Match (names="unnamed.html", rule="2"):

Enforced policy: accept



File name doesn't match file contents, defanging.

Replaced mime type with: application/DEFANGED-966

Replaced file name with: unnamed_html.DEFANGED-966



Total modifications so far: 1





Anomy 0.0.0 : Sanitizer.pm

$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $



--968493591a75166bdeb0269e7640023d

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-7400BE95======="



--=======AVGMAIL-7400BE95=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-7400BE95=======--



--968493591a75166bdeb0269e7640023d

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-65858F8A======="



--=======AVGMAIL-65858F8A=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-65858F8A=======--



--968493591a75166bdeb0269e7640023d--







More Alberta Treasury Branch Phish from Australia

Posted by Dave Yadallee on
From - Sat May 25 07:48:04 2013

X-Account-Key: account1

X-UIDL: 00001b304f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level:

X-Spam-Status: No, score=1.0 required=5.0 tests=BOTNET,RELAY_CHECKER_BADDNS

autolearn=no version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix, from userid 101)

id 87AFA12CFAE8; Fri, 24 May 2013 07:59:16 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Fri, 24 May 2013 07:59:16 -0600

Resent-Message-ID: <20130524135916.GA21880@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-Original-To: games@nl2k.ab.ca

Delivered-To: games@nl2k.ab.ca

Received: from host.gapajob.com.au (unknown [173.199.190.140])

(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id A2FB712CFAE5

for ; Fri, 24 May 2013 07:53:40 -0600 (MDT)

Received: from [185.7.214.35] (port=51063 helo=fb.mail.gandi.net)

by host.gapajob.com.au with esmtpsa (SSLv3:EDH-RSA-DES-CBC3-SHA:168)

(Exim 4.80)

(envelope-from )

id 1Uf9WO-0001Et-U3

for games@nl2k.ab.ca; Wed, 22 May 2013 23:56:06 +1000

From: "ATBONLINE - Financial Services"

Subject: ATB ONLINE BUSINESS - Your Account Statement Notice is Ready

22/05/2013

To: games@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="d07KQL=_5kqkQXOKfT51sG1RpvUNyFolpG"

MIME-Version: 1.0

Reply-To: sharon.lennox@atb.com.au

Date: Wed, 22 May 2013 15:56:23 +0000

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - host.gapajob.com.au

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - atb.com.au

X-Get-Message-Sender-Via: host.gapajob.com.au: authenticated_id: sharon.lennox@thoughtsonbox.com.au

X-Source:

X-Source-Args:

X-Source-Dir:

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: IDB47135B-6EBD3454

X-Brightmail-Tracker: AAAABh3FYAQdxV+rHcVgzh3FYN0dxWDYHcVf+g==

X-Brightmail-Tracker: AAAAAA==



This is a multi-part message in MIME format



--d07KQL=_5kqkQXOKfT51sG1RpvUNyFolpG

Content-Type: text/plain_; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



DEAR ALBERTA TREASURY BRANCH CUSTOMER



Your most recent monthly statement is ready and is available for download (=

see attachement). The statement includes all ATB Financial transactions and=

your starting and ending balances.



We email you to let you know your account statement is ready. You can view =

or print a copy of your statement from the same page. kindly download the a=

ttached file to view your most recent statement.



ATB Financial Online Services

Customer Relations Services





As this e-mail is an automated message, do not reply to this email.





--------------------------------------------------



No virus found in this message.

Checked by AVG - www.avg.com

Version: 2013.0.1901 / Virus Database: 4108/8641 - Release Date...





--d07KQL=_5kqkQXOKfT51sG1RpvUNyFolpG

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-041BAE89======="



--=======AVGMAIL-041BAE89=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

Viruses found in the attached files.

 ATB Financial Statement May 2013.html: Virus found JS/Phish. The attac=

hment was moved to the Virus Vault.

* sanitizer.log: Virus found JS/Phish. The attachment was moved to the V=

irus Vault.



Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-041BAE89=======--



--d07KQL=_5kqkQXOKfT51sG1RpvUNyFolpG

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-0A5A1042======="



--=======AVGMAIL-0A5A1042=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-0A5A1042=======--



--d07KQL=_5kqkQXOKfT51sG1RpvUNyFolpG--





.



Alberta Treasury Branch Phish from Australia

Posted by Dave Yadallee on
From - Sat May 25 07:47:16 2013

X-Account-Key: account1

X-UIDL: 00001add4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

X-AVG: Scanning

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: **

X-Spam-Status: No, score=3.0 required=5.0 tests=BOTNET,RCVD_IN_SPAMCANNIBAL,

RELAY_CHECKER_BADDNS autolearn=no version=3.3.2

X-Original-To: dave@doctor.nl2k.ab.ca

Delivered-To: dave@doctor.nl2k.ab.ca

Received: by doctor.nl2k.ab.ca (Postfix, from userid 0)

id 88FBB12CFA9E; Wed, 22 May 2013 12:46:20 -0600 (MDT)

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Wed, 22 May 2013 12:46:20 -0600

Resent-Message-ID: <20130522184620.GB1186@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-Original-To: doctor@nk.ca

Delivered-To: doctor@nk.ca

Received: from host.gapajob.com.au (unknown [173.199.190.140])

(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id AE9E212CFAA3

for ; Wed, 22 May 2013 11:14:30 -0600 (MDT)

Received: from 70-91-112-217-miami-fl.hfc.comcastbusiness.net ([70.91.112.217]:48781 helo=MICROMAS0H)

by host.gapajob.com.au with esmtpsa (SSLv3:EDH-RSA-DES-CBC3-SHA:168)

(Exim 4.80)

(envelope-from )

id 1UfBRU-0007ta-HV

for doctor@nk.ca; Thu, 23 May 2013 01:59:09 +1000

From: "ATB BUSINESS - ONLINE"

Subject: Alberta Treasury Branch - Monthly Statement Summary Report 05-2013

To: doctor@nk.ca

Content-Type: multipart/mixed; boundary="BHMyMbFcJk6EwFT9=_43BWynHjms9loep9"

MIME-Version: 1.0

Reply-To: samantha.taliaferro@atb.com.au

Date: Wed, 22 May 2013 11:59:09 +0000

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - host.gapajob.com.au

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - atb.com.au

X-Get-Message-Sender-Via: host.gapajob.com.au: authenticated_id: samantha.taliaferro@thoughtsonbox.com.au

X-Source:

X-Source-Args:

X-Source-Dir:

X-Sanitizer: This message has been sanitized!

X-Sanitizer-URL: http://mailtools.anomy.net/

X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID174CFBD8-387C99E9

X-Brightmail-Tracker: AAAAAA==

X-Brightmail-Tracker: AAAAAA==



This is a multi-part message in MIME format



--BHMyMbFcJk6EwFT9=_43BWynHjms9loep9

Content-Type: text/plain_; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



DEAR ALBERTA TREASURY BRANCH CUSTOMER



Your most recent monthly statement is ready and is available for download (=

see attachement). The statement includes all ATB Financial transactions and=

your starting and ending balances.



We email you to let you know your account statement is ready. You can view =

or print a copy of your statement from the same page. kindly download the a=

ttached file to view your most recent statement.



ATB Financial Online Services

Customer Relations Services





As this e-mail is an automated message, do not reply to this email.





--------------------------------------------------



No virus found in this message.

Checked by AVG - www.avg.com

Version: 2013.0.1901 / Virus Database: 4108/8641 - Release Date...





--BHMyMbFcJk6EwFT9=_43BWynHjms9loep9

Content-Type: text/sanitizer-log; charset="iso-8859-1"

Content-Transfer-Encoding: 8bit

Content-Disposition: attachment; filename="sanitizer.log"



This message has been 'sanitized'. This means that potentially

dangerous content has been rewritten or removed. The following

log describes which actions were taken.



Sanitizer (start="1369242882"):

Part (pos="1908"):

SanitizeFile (filename="unnamed.txt", mimetype="text/plain "):

Match (names="unnamed.txt", rule="2"):

Enforced policy: accept



Rewrote MIME field _type as

>>text/plain_<< (was >>text/plain <<)



Part (pos="2784"):

SanitizeFile (filename="ATB Financial Statements May 2013.html", mimetype="application/octet-stream"):

Match (names="ATB Financial Statements May 2013.html", rule="2"):

Enforced policy: accept



File name doesn't match file contents, defanging.

Replaced mime type with: application/DEFANGED-270217

Replaced file name with: ATB Financial Statements May 2013_html.DEFANGED-270217



Total modifications so far: 2





Anomy 0.0.0 : Sanitizer.pm

$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $



--BHMyMbFcJk6EwFT9=_43BWynHjms9loep9

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-5F7639A2======="



--=======AVGMAIL-5F7639A2=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

Viruses found in the attached files.

 ATB Financial Statements May 2013_html.DEFANGED-270217: Virus found JS=

/Phish. The attachment was moved to the Virus Vault.



Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-5F7639A2=======--



--BHMyMbFcJk6EwFT9=_43BWynHjms9loep9

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-4E1AD8E1======="



--=======AVGMAIL-4E1AD8E1=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-4E1AD8E1=======--



--BHMyMbFcJk6EwFT9=_43BWynHjms9loep9--





.



More Royal Bank of Canada Spam

Posted by Dave Yadallee on
From - Sat May 25 07:47:03 2013

X-Account-Key: account1

X-UIDL: 00001acb4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Received: from localhost by doctor.nl2k.ab.ca

with SpamAssassin (version 3.3.2);

Wed, 22 May 2013 05:39:02 -0600

From: RBC Royal Bank

To: doctor@gallifrey.nk.ca

Subject: [Norton AntiSpam]*SPAM* {Spam?} Online Banking: Your account has been limited!

Date: 22 May 2013 12:48:59 +0200

Message-Id: <20130522124859.41F0E947AE640A67@service.com>

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Flag: YES

X-Spam-Level: ***************

X-Spam-Status: Yes, score=16.0 required=5.0 tests=RCVD_IN_JMF_BR,RCVD_IN_PSBL,

RCVD_IN_UCE_PFSM_1,SPF_FAIL autolearn=unavailable version=3.3.2

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="----------=_519CAE56.AC2A3DB7"

X-Antivirus: AVG for E-mail 10.0.1432 [3184/5854]

X-AVG-ID: ID7C660474-6A5B4E6B

X-Brightmail-Tracker: AAAABhlaoTYdxOgKHcToAR3FBkEdxPnuHcUC9A==



This is a multi-part message in MIME format.



------------=_519CAE56.AC2A3DB7

Content-Type: text/plain; charset=iso-8859-1

Content-Disposition: inline

Content-Transfer-Encoding: 8bit



Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: RBC Royal Bank / Message Center: 1 New Alert Message! 1 New

Alert Message! Customer Service: Your account has been limited! Click to

Resolve Thank you for using Royal Bank of Canada. -- This message has been

scanned for viruses and dangerous content by MailScanner, and is believed

to be clean. [...]



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[82.177.154.4 listed in dnsbl-1.uceprotect.net]

11 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN

[213.21.154.202 listed in hostkarma.junkemailfilter.com]

2.0 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[82.177.154.4 listed in psbl.surriel.com]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=custom%40service.com;ip=213.21.154.202;r=doctor.nl2k.ab.ca]



The original message was not completely plain text, and may be unsafe to

open with some email clients; in particular, it may contain a virus,

or confirm that your address can receive spam. If you wish to view

it, it may be safer to save it to a file and open it with an editor.





------------=_519CAE56.AC2A3DB7

Content-Type: message/rfc822; x-spam-type=original

Content-Description: original message before SpamAssassin

Content-Disposition: attachment

Content-Transfer-Encoding: 8bit



Return-Path:

X-Original-To: dave@nk.ca

Delivered-To: dave@nk.ca

Received: from gallifrey.nk.ca (gallifrey.nk.ca [204.209.81.3])

(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))

(No client certificate requested)

by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 29FB112CFB17

for ; Wed, 22 May 2013 05:38:55 -0600 (MDT)

Received: from root by gallifrey.nk.ca with local (Exim 4.80.1)

(envelope-from )

id 1Uf7N9-0004OM-Lq

for dave@nk.ca; Wed, 22 May 2013 05:38:23 -0600

Resent-From: "Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem"

Resent-Date: Wed, 22 May 2013 05:38:23 -0600

Resent-Message-ID: <20130522113823.GA16305@gallifrey.nk.ca>

Resent-To: dave@nk.ca

Received: from errea-mx1.niscent.net ([213.21.154.202])

by gallifrey.nk.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1Uf6bM-0003fp-A0

for doctor@gallifrey.nk.ca; Wed, 22 May 2013 04:49:07 -0600

Received: from lapostina.errea.it (lapostina.errea.it [81.113.46.131])

by errea-mx1.niscent.net (Postfix) with ESMTP id 46B5B28DC0

for ; Wed, 22 May 2013 12:48:58 +0200 (CEST)

Received: from service.com ([82.177.154.4]) by lapostina.errea.it with Microsoft SMTPSVC(6.0.3790.4675);

Wed, 22 May 2013 12:48:53 +0200

From: RBC Royal Bank

To: doctor@gallifrey.nk.ca

Subject: {Spam?} Online Banking: Your account has been limited!

Date: 22 May 2013 12:48:59 +0200

Message-ID: <20130522124859.41F0E947AE640A67@service.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-OriginalArrivalTime: 22 May 2013 10:48:53.0432 (UTC) FILETIME=[F38D0380:01CE56D9]

X-NetKnow-OutGoing-4-84-5-3-MailScanner: Found to be clean, Found to be clean

X-NetKnow-OutGoing-4-84-5-3-MailScanner-SpamCheck: spam,

SpamAssassin (not cached, score=6.293, required 1, BAYES_99 3.50,

HTML_IMAGE_ONLY_12 2.06, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.72,

T_REMOTE_IMAGE 0.01)

X-NetKnow-OutGoing-4-84-5-3-MailScanner-SpamScore: ssssss

X-Spam-Status: Yes, No

X-NetKnow-OutGoing-4-84-5-3-MailScanner-Information: Please contact the ISP for more information

X-NetKnow-OutGoing-4-84-5-3-MailScanner-ID: 1Uf7N9-0004OM-Lq

X-NetKnow-OutGoing-4-84-5-3-MailScanner-IP-Protocol: IPv4

X-NetKnow-OutGoing-4-84-5-3-MailScanner-From: root@gallifrey.nk.ca

X-NetKnow-OutGoing-4-84-5-3-MailScanner-Watermark: 1369654704.32354@ivnWx2hlUM3Pg2vlPErDzA

X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca

X-Virus-Status: Clean







RBC Royal Bank / Message Center: 1 New Alert Message!


yalbank_en.gif">






old.gif"> 1 New Alert Message!




=20



ng=3D"0" width=3D"100%">

cellpadding=3D"3" cellspacing=3D"0" width=3D"100%">




Customer Service: Your account has b=

een limited!
oye.dk/wp-content/plugins/sslrbc/www1.royal.com/cgi-bin/rbaccess/index.php"=

>Click to Resolve






=20

Thank you for using Royal Bank of Canada.




--=20


This message has been scanned for viruses and


dangerous content by

MailScanner, and is


believed to be clean.




--=20


This message has been scanned for viruses and


dangerous content by

MailScanner, and is


believed to be clean.







------------=_519CAE56.AC2A3DB7

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-24B33466======="



--=======AVGMAIL-24B33466=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-24B33466=======--



------------=_519CAE56.AC2A3DB7

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-3C2688FD======="



--=======AVGMAIL-3C2688FD=======

Content-Type: text/plain; x-avg=cert; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3184/5854 - Release Date: 05/24/13=



--=======AVGMAIL-3C2688FD=======--



------------=_519CAE56.AC2A3DB7--