NetKnow Corporate Blog | Entries from Friday, July 19. 2013

Russian Spam

Posted by Dave Yadallee on Friday, July 19. 2013

From - Fri Jul 19 08:41:56 2013

X-Account-Key: account1

X-UIDL: 00001f374f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 19 Jul 2013 08:37:20 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1V0BnQ-0002BB-Sl

for dave@doctor.nl2k.ab.ca; Fri, 19 Jul 2013 08:36:36 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Fri, 19 Jul 2013 08:36:36 -0600

Resent-Message-ID: <20130719143636.GB7820@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from bk.bkhost.ru ([192.232.199.156])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.80.1)

(envelope-from )

id 1V0BjE-0001jP-OW

for sales@nk.ca; Fri, 19 Jul 2013 08:32:19 -0600

Received: from 184.173.221.10-static.reverse.softlayer.com ([184.173.221.10]:4706 helo=PC-20121219NMRW)

by bk.bkhost.ru with esmtp (Exim 4.80.1)

(envelope-from )

id 1V0Bj2-0002b1-HV; Fri, 19 Jul 2013 09:32:04 -0500

Date: Fri, 19 Jul 2013 22:36:03 +0800

From: "Rick"

To: "sales"

Reply-To:

Subject: =?GB2312?B?UGhvdG8gUmV0b3VjaGluZyBTZXJ2aWNlcw==?=

=?GB2312?B?IC0gUGhvdG8gQ3V0IE91dCAtIFBob3RvIA==?=

=?GB2312?B?RWRpdGluZw==?=

MIME-Version: 1.0

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2800.1158

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

Content-Type: text/plain; charset="GB2312"

Content-Transfer-Encoding: base64

Content-Disposition: inline

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - bk.bkhost.ru

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - msn.com

X-Get-Message-Sender-Via: bk.bkhost.ru: acl_c_relayhosts_text_entry: mk780tv@martinpublishing.ru|martinpublishing.ru

X-Antivirus: AVG for E-mail 10.0.1432 [3204/6001]

X-AVG-ID: ID45B1A9DA-4C89FB95

SGksDQoNCldlIGFyZSBvbmUgb2YgdGhlIGJlc3QgZGlnaXRhbCBpbWFnZXMgcmV0b3VjaGlu

Zy9lZGl0aW5nIHByb2Zlc3Npb25hbHMgbG9jYXRlZCBpbiBDaGluYS4gV2UgcHJvdmlkZSBh

bGwga2luZHMgb2YgaW1hZ2UgZWRpdGluZyBzb2x1dGlvbnMgdG8gZGlmZmVyZW50IGNvbXBh

bmllcyBhbGwgb3ZlciB0aGUgd29ybGQuDQoNCldlIHByb3ZpZGUgYmVzdCBxdWFsaXR5IHNl

cnZpY2UgaW4gYmVzdCBwcmljZS4NCg0KT3VyIGltYWdlIGVkaXRpbmcgc2VydmljZXMgYXJl

OiAtDQoNCiAuIEN1dCBvdXQvbWFza2luZywgY2xpcHBpbmcgcGF0aCwgZGVlcCBldGNoaW5n

LCB0cmFuc3BhcmVudCBiYWNrZ3JvdW5kDQogLiBEdXN0IGNsZWFuaW5nLCBzcG90IGNsZWFu

aW5nDQogLiBDb2xvdXIgY29ycmVjdGlvbiwgYmxhY2sgYW5kIHdoaXRlLCBsaWdodCBhbmQg

c2hhZG93cyBldGMuDQogLiBCZWF1dHkgcmV0b3VjaGluZywgc2tpbiByZXRvdWNoaW5nLCBm

YWNlIHJldG91Y2hpbmcsIGJvZHkgcmV0b3VjaGluZw0KIC4gRmFzaGlvbi9CZWF1dHkgSW1h

Z2UgUmV0b3VjaGluZw0KIC4gUHJvZHVjdCBpbWFnZSBSZXRvdWNoaW5nDQogLiBKZXdlbGxl

cnkgaW1hZ2UgUmV0b3VjaGluZw0KIC4gUmVhbCBlc3RhdGUgaW1hZ2UgUmV0b3VjaGluZw0K

IC4gUG9ydHJhaXQgaW1hZ2UgUmV0b3VjaGluZw0KIC4gUmVzdG9yYXRpb24gYW5kIHJlcGFp

ciBvbGQgaW1hZ2VzDQogLiBXZWRkaW5nICYgRXZlbnQgQWxidW0gRGVzaWduLg0KIC4gVmVj

dG9yIENvbnZlcnNpb24NCg0KWW91IGNhbiB0cnkgdXMgYnkgc2VuZGluZyBhIHNhbXBsZSBp

bWFnZSBmb3IgZnJlZSB0ZXN0IHRvIGp1ZGdlIG91ciBxdWFsaXR5IHdvcmsuDQoNCldlIGFy

ZSB3YWl0aW5nIGZvciB5b3VyIHJlcGx5Lg0KDQpUaGFua3MgJiBSZWdhcmRzLA0KUmljaw0K

Um9uZHJ1YW5pbiBJbWFnaW5nIFByb2Zlc3Npb25hbHMNCkNvbnRhY3Q6IGNvbnRhY3RlZGl0

QDEyNi5jb20NCg0KDQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t

LS0tLS0tLS0tLS0tLQ0KDQpUaGlzIGUtbWFpbCAoYW5kIGFueSBhdHRhY2htZW50cykgaXMg

Y29uZmlkZW50aWFsIGFuZCBtYXkgY29udGFpbg0KcGVyc29uYWwgdmlld3Mgd2hpY2ggYXJl

IG5vdCB0aGUgdmlld3Mgb2YgdXMuIHVubGVzcyBzcGVjaWZpY2FsbHkgc3RhdGVkLiBJZiB5

b3UgaGF2ZSByZWNlaXZlZA0KaXQgaW4gZXJyb3IsIHBsZWFzZSBkZWxldGUgaXQgZnJvbSB5

b3VyIHN5c3RlbSwgZG8gbm90IHVzZSwgY29weSBvcg0KZGlzY2xvc2UgdGhlIGluZm9ybWF0

aW9uIGluIGFueSB3YXkgbm9yIGFjdCBpbiByZWxpYW5jZSBvbiBpdCBhbmQNCm5vdGlmeSB0

aGUgc2VuZGVyIGltbWVkaWF0ZWx5Lg0KDQpVTlNVQlNDUklCRSBJTlNUUlVDVElPTlMNCklm

IHlvdSBkbyBub3Qgd2lzaCB0byByZWNlaXZlIG91ciBuZXdzbGV0dGVyLCBwbHMgc2VuZCBh

ZGRyZXNzIHRvIGltcmVtb3ZlQHllYWgubmV0IGZvciByZW1vdmUuDQpCZWZvcmUgcHJpbnRp

bmcgdGhpbmsgYWJvdXQgdGhlIEVudmlyb25tZW50Lg0KDQoKICAgICAgICAgICAgICAgICAg

ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg

ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg

ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCg0KLS0tLS0NCk5vIHZpcnVz

IGZvdW5kIGluIHRoaXMgbWVzc2FnZS4NCkNoZWNrZWQgYnkgQVZHIC0gd3d3LmF2Zy5jb20N

ClZlcnNpb246IDEwLjAuMTQzMiAvIFZpcnVzIERhdGFiYXNlOiAzMjA0LzYwMDEgLSBSZWxl

YXNlIERhdGU6IDA3LzE4LzEzDQo=

More Nigerian Yahoo! Spam

Posted by Dave Yadallee on Friday, July 19. 2013

From - Fri Jul 19 08:41:56 2013

X-Account-Key: account1

X-UIDL: 00001f364f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 19 Jul 2013 08:36:20 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1V0BnA-00029h-06

for dave@doctor.nl2k.ab.ca; Fri, 19 Jul 2013 08:36:20 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Fri, 19 Jul 2013 08:36:19 -0600

Resent-Message-ID: <20130719143619.GA7820@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from nm39-vm6.bullet.mail.gq1.yahoo.com ([98.136.217.109])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.80.1)

(envelope-from )

id 1V0Bdb-0001Jm-9d

for doctor@nl2k.ab.ca; Fri, 19 Jul 2013 08:26:36 -0600

Received: from [98.137.12.191] by nm39.bullet.mail.gq1.yahoo.com with NNFMP; 19 Jul 2013 14:26:22 -0000

Received: from [98.137.12.231] by tm12.bullet.mail.gq1.yahoo.com with NNFMP; 19 Jul 2013 14:26:22 -0000

Received: from [127.0.0.1] by omp1039.mail.gq1.yahoo.com with NNFMP; 19 Jul 2013 14:26:22 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: 733373.27278.bm@omp1039.mail.gq1.yahoo.com

Received: (qmail 96840 invoked by uid 60001); 19 Jul 2013 14:26:22 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1374243982; bh=2+YJ1jmwBxGKYkmlEgcX7PETIRD466cVDm9CHK8XP6U=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=ZXwytXasCXo7t2DRhAK9bbih1DcxLiybCX4nUjhW56tTlvfQ4zF2EWcdQiol9u/J8vWtl1NVdviBGeM0Qnl9r8QYsV+x6KPkDNNlAu1V5BhjxmUdclq5iiPSIIWHmXgKDvXt1rVFCfcIUIPTReC/lRH2zN6ItFjwgViRo8A+EOA=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.com;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;

b=NcLbeSPR9O/0u10EI7yVtLMUPh8K6+eazdeRa+XCmeMdtDc/WebP54In9d1OFWfCu5yuSvotb28yAurKyHQWs4gy5UuzYJqHuZWraD0quwqObRtSWJN8gmqF9gA7vRwdMjWJfcYWg7PiKur95qjBe0It7zadUPwyiqDkftfLJzs=;

X-YMail-OSG: ERin.GgVM1mZbcKLuX1zqStiUwNqbXt6UXlCfN9vzDeyj4x

uFOI1ar1nuCXZNIU-

Received: from [41.138.108.105] by web163901.mail.gq1.yahoo.com via HTTP; Fri, 19 Jul 2013 07:26:21 PDT

X-Rocket-MIMEInfo: 002.001,CgrCoApEZWFyIEZyaWVuZCwKCgpMZXQgbWUgc3RhcnQgYnkgaW50cm9kdWNpbmcgbXlzZWxmLCBJIGFtwqAgTXIgTWF6YXIgSWRyaXMuTWFuYWdlciBvZiBCYW5rIE9mIEFmcmljYSBCdXJraW5hIEZhc28uCgoKSSBhbSB3cml0aW5nIHlvdSB0aGlzIGxldHRlciBiYXNlZCBvbiB0aGUgbGF0ZXN0IGRldmVsb3BtZW50IGF0IG15IERlcGFydG1lbnQgd2hpY2ggSSB3aWxsIGxpa2UgdG8gYnJpbmcgdG8geW91ciBwZXJzb25hbCBlZGlmaWNhdGlvbi4oJDYuNTAwbWlsbGlvbiBEb2xsYXJzKSB0cmFuc2ZlciBjbGEBMAEBAQE-

X-RocketYMMF: jamila_br

X-Mailer: YahooMailWebService/0.8.149.560

Message-ID: <1374243981.95906.YahooMailNeo@web163901.mail.gq1.yahoo.com>

Date: Fri, 19 Jul 2013 07:26:21 -0700 (PDT)

From: mazaridris

Reply-To: mazaridris

Subject: Dear Friend,

To: undisclosed recipients: ;

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="-1137503753-137298287-1374243981=:95906"

X-Antivirus: AVG for E-mail 10.0.1432 [3204/6001]

X-AVG-ID: ID5CEFA401-364B0D0

---1137503753-137298287-1374243981=:95906

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable

=C2=A0

Dear Friend,

Let me start by introducing myself, I am=C2=A0 Mr M=

azar Idris.Manager of Bank Of Africa Burkina Faso.

I am writing you this =

letter based on the latest development at my Department which I will like t=

o bring to your personal edification.($6.500million Dollars) transfer claim=

s, please it is only known between me and you keep it secret.

=C2=A0This =

is a legitimate transaction and I agreed to offer you 40% of this money as =

my foreign partner after confirmation of the fund in your bank account I wi=

ll come down to your country for sharing of the fund with you and also to h=

ave investment in your country, If you are interested, do get back to me wi=

th the following data=E2=80=99s below. And let it be a top secret, not inte=

rested kingly delete it out.

=C2=A0

(1)Your full Name=E2=80=A6=E2=80=A6=E2=

=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6..

(2)Your full residential addre=

ss.......

(3)Your occupation.....

(4)Your re City........

(5)Country of ori=

gin=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6..

(6)Your Mobile phone....=

.....

(7)Your age........

(8)Your marital status.....

(9) Sex=E2=80=A6=E2=

=80=A6.

=C2=A0

As soon as I receive these data's, I will forward to you the=

application form which you will send to the bank.

=C2=A0

Thanks,

Yours,

Fa=

ithfully,

Mr Mazar Idris.

-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3204/6001 - Release Date: 07/18/13

---1137503753-137298287-1374243981=:95906

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

mes new roman, new york, times, serif;font-size:12pt">

iv>

Dear Friend,

Let me start by int=

roducing myself, I am Mr Mazar Idris.Manager of Bank Of Africa Burkin=

a Faso.

I am writing you this letter based on the latest =

development at my Department which I will like to bring to your personal ed=

ification.($6.500million Dollars) transfer claims, please it is only known =

between me and you keep it secret.

This =

is a legitimate transaction and I agreed to offer you 40% of this money as =

my foreign partner after confirmation of the fund in your bank account I wi=

ll come down to your country for sharing of the fund with you and also to h=

ave investment in your country, If you are interested, do get back to me wi=

th the following data=E2=80=99s below. And let it be a top secret, not

interested kingly delete it out.

(1)Your full Name=E2=80=A6=

=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6..
(2)Your full re=

sidential address.......
(3)Your occupation.....
(4)Your re City.....=

...
(5)Country of origin=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6..<=

br>(6)Your Mobile phone.........
(7)Your age........
(8)Your marital =

status.....
(9) Sex=E2=80=A6=E2=80=A6.

As soon as I receive=

these data's, I will forward to you the application form which you will se=

nd to the bank.

Thanks,
Yours,
Faithfully,

Mr Mazar Idris.

ize=3D"1">

No v=

irus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3204/6001 - Release Date: 07/18/13

=

---1137503753-137298287-1374243981=:95906--

IRS Phish

Posted by Dave Yadallee on Friday, July 19. 2013

From - Fri Jul 19 07:51:55 2013

X-Account-Key: account1

X-UIDL: 00001f324f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 19 Jul 2013 07:49:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1V0B39-0006OM-Uy

for dave@doctor.nl2k.ab.ca; Fri, 19 Jul 2013 07:48:47 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Fri, 19 Jul 2013 07:48:47 -0600

Resent-Message-ID: <20130719134847.GB22737@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from relay1.transip.nl ([80.69.67.19])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V07y5-0003yf-EY

for archive@nl2k.ab.ca; Fri, 19 Jul 2013 04:31:31 -0600

Received: from webapp0.transip.nl (mysql.transip.nl [95.170.70.112])

by relay1.transip.nl (Postfix) with ESMTP id 393CB24FC82;

Fri, 19 Jul 2013 12:31:15 +0200 (CEST)

Received: from webapp0.transip.nl (localhost [127.0.0.1])

by webapp0.transip.nl (Postfix) with ESMTP id 342E51830C4E;

Fri, 19 Jul 2013 12:31:15 +0200 (CEST)

X-Virus-Scanned: amavisd-new at webapp0.transip.nl

Received: from webapp0.transip.nl ([127.0.0.1])

by webapp0.transip.nl (webapp0.transip.nl [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id OlYQOwdD1mU1; Fri, 19 Jul 2013 12:31:15 +0200 (CEST)

Received: from webmail.transip.nl (localhost [127.0.0.1])

by webapp0.transip.nl (Postfix) with ESMTP id C70741830C49;

Fri, 19 Jul 2013 12:31:12 +0200 (CEST)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_ee20905cbeee7ae16124fd9f374d568d"

Date: Fri, 19 Jul 2013 05:31:12 -0500

From: Claudia smith

To: undisclosed-recipients:;

Subject: Shipment delivery

Message-ID:

X-Sender: cphillips@goldenlog.net

User-Agent: TransIP Webmail

X-Antivirus: AVG for E-mail 10.0.1432 [3204/6001]

X-AVG-ID: ID6AEC921F-4B1A563F

--=_ee20905cbeee7ae16124fd9f374d568d

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=UTF-8

Dear Recipient ,

This is an automatically generated email from

Dynamex logistic- Please do not reply to it.

A collection will be made

on 22-July-2013 09:16 for delivery to you, via Overnight service, by

Dynamex Logistics on behalf of Internal Revenue Service IRS.

The

delivery deadline time is set for 24-July-2013 16:00

If you have a

query regarding this email please contact (310) 371-2300 Quoting

Reference #75566DF

You can use the following link to track this order

DOWNLOAD TRACKING DETAILS [1]

Links:

------

[1]

http://www.onlinetransferencia.com/download/trackingdetails/Delivery.zip

-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3204/6001 - Release Date: 07/18/13

--=_ee20905cbeee7ae16124fd9f374d568d

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8