More Nigerian Yahoo! Spam

Posted by Dave Yadallee on
From - Fri Aug 16 08:43:36 2013

X-Account-Key: account1

X-UIDL: 0000242e4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 15 Aug 2013 09:32:38 -0600

Received: from nm17-vm1.bullet.mail.bf1.yahoo.com ([98.139.213.55])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.80.1)

(envelope-from )

id 1V9zXK-0002lG-Dm

for dave@doctor.nl2k.ab.ca; Thu, 15 Aug 2013 09:32:38 -0600

Received: from [98.139.215.142] by nm17.bullet.mail.bf1.yahoo.com with NNFMP; 15 Aug 2013 15:32:24 -0000

Received: from [98.139.212.218] by tm13.bullet.mail.bf1.yahoo.com with NNFMP; 15 Aug 2013 15:32:24 -0000

Received: from [127.0.0.1] by omp1027.mail.bf1.yahoo.com with NNFMP; 15 Aug 2013 15:32:24 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: 505839.56738.bm@omp1027.mail.bf1.yahoo.com

Received: (qmail 97602 invoked by uid 60001); 15 Aug 2013 15:32:24 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1376580744; bh=KhxFLPT7ntX0Ved0/NowPoVGwQJNd/YeWEb0HT1TxxU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=oXYvaDt9NabFPX491AdLE3ClWdE8g/wzWwK71DjzRByZYnJMbjOcfw8wRCykWwdL1HRUN3mJZFS1LKIwi5Rt+Ei4PwllFiZoKY9u8Kb1fUF6NOn/3dZhTnVbaq6BMqFuoBuw/wSJXshgRBxjBe0pj/rznW08pIFa9uB2s12uxg4=

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.com;

h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-RocketYMMF:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding;

b=uTkb8LoCbgTw0ohhrJJ7LX66YakG9gqj9cXVQVpCjPlNgynUzI/Ep6mLPQoN0TwvsYD7g4P0Z1RqnHdgZsozk8JV35CB+iEoL2zJzEtAy0adTDRBH2nsVoyAsnVahlp/mta/ooUda5cFatdWHzluGVYk9F0PejqQNF6/vCN1iZA=;

X-YMail-OSG: XXIROLoVM1kbOXhFGe1wKKLL8xHvRbXPoNHHOacgjJj4AjU

IJsZH4fX4dLZsZwhYwm2F

Received: from [197.239.66.38] by web142305.mail.bf1.yahoo.com via HTTP; Thu, 15 Aug 2013 08:32:24 PDT

X-Rocket-MIMEInfo: 002.001,DQpEZWFyIEZyaWVuZCwNCg0KwqDCoMKgwqDCoMKgwqDCoMKgwqDCoCBIb3cgYXJlIHlvdSB0b2RheSB3aXRoIHlvdXIgZmFtaWx5LCBIb3BlIGFsbCBpcyB3ZWxsPyBQbGVhc2UsIEl0J3MgbXkgZ3JlYXQgcGxlYXN1cmUgdG8gY29udGFjdCB5b3UgdG9kYXkuIA0KSSBhbSBNci5JYnJhaGltIEVkaXNvbiBmcm9tIEJ1cmtpbmEtRmFzby4NClBsZWFzZSwgSSB3YW50IHRvIHRyYW5zZmVyIHRoZSBzdW0gb2YgKFVTJDEwLjVNKSBpbnRvIHlvdXIgYmFuayBhY2NvdW50Lg0KVGhpcyBidXNpbmVzcyBpcyAxMDAlIHIBMAEBAQE-

X-RocketYMMF: raphude

X-Mailer: YahooMailClassic/291 YahooMailWebService/0.8.154.571

Message-ID: <1376580744.83904.YahooMailBasic@web142305.mail.bf1.yahoo.com>

Date: Thu, 15 Aug 2013 08:32:24 -0700 (PDT)

From: Ibrahim Edison

Reply-To: mribrahem.edison1@gmail.com

Subject: VERY URGENT!!

To: undisclosed recipients: ;

MIME-Version: 1.0

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

X-Antivirus: AVG for E-mail 10.0.1432 [3211/6081]

X-AVG-ID: ID630CB09F-1838E400





Dear Friend,



=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 How are you today with your family, Hope =

all is well? Please, It's my great pleasure to contact you today.

I am Mr.Ibrahim Edison from Burkina-Faso.

Please, I want to transfer the sum of (US$10.5M) into your bank account.

This business is 100% risk free. Your share will be 40% while 60% for me.

More details will be forwarded to you immediately I receive your urgent res=

ponse.



1) Your Full Name.......................

2) Your Private Telephone No........

3) Your Receiving Country............



Thank you for your anticipated co-operation.

Yours Sincerely,

Mr. Ibrahim Edison.





-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3211/6081 - Release Date: 08/15/13







More Google spam

Posted by Dave Yadallee on
From - Fri Aug 16 08:43:28 2013

X-Account-Key: account1

X-UIDL: 0000240d4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 14 Aug 2013 18:04:08 -0600

Received: from root by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1V9l2h-000406-PR

for dave@doctor.nl2k.ab.ca; Wed, 14 Aug 2013 18:03:55 -0600

Resent-From: root@doctor.nl2k.ab.ca

Resent-Date: Wed, 14 Aug 2013 18:03:55 -0600

Resent-Message-ID: <20130815000355.GA12019@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from mail-pd0-f193.google.com ([209.85.192.193])

by doctor.nl2k.ab.ca with esmtps (TLSv1:RC4-SHA:128)

(Exim 4.80.1)

(envelope-from )

id 1V9fmc-0006qB-EJ

for root@nk.ca; Wed, 14 Aug 2013 12:28:38 -0600

Received: by mail-pd0-f193.google.com with SMTP id v10so3250759pde.8

for ; Wed, 14 Aug 2013 11:26:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20120113;

h=reply-to:from:to:subject:date:message-id:mime-version:content-type

:thread-index:content-language;

bh=+JSnmdp79j4iT8JUQWwSJT87FN3cDF5jsZnIfGxrMao=;

b=isvgitKyZfNoJl0XOPjozWS53qXtiULHCZPlJqcCtDbdzuck7apAQqFO5VhkHzRbUx

G/BayMlFAq2MwzYI/UQEGD5pOPtvWmA8uRSDVY7CxK/wB9RVTBWya/pRpWVO+XKybkRi

/5hiHiTzVuOLBcBjaCGIj9KjXHYQ6Ju+Yh1locQwTdflZNfnbKEFGD2y4y/qVfG6C+/n

DguM7aEKYsoFcDHQbh7U+uwaOU8jEoZlEQXlk4RaeIZTJ4udvatk0JV/axL5I1Ed7q89

lTCyH9dvhUEHnDur0a5661NJcM3o0jkPkf3pKb8LVhLkNu0UTLKrUx6xqDouK23Cxt9j

Wcfg==

X-Received: by 10.66.147.9 with SMTP id tg9mr11438033pab.5.1376504814500;

Wed, 14 Aug 2013 11:26:54 -0700 (PDT)

Received: from pixeldewd40664 ([120.57.128.151])

by mx.google.com with ESMTPSA id sx7sm51817456pbc.41.2013.08.14.11.26.51

for

(version=TLSv1 cipher=RC4-SHA bits=128/128);

Wed, 14 Aug 2013 11:26:53 -0700 (PDT)

Reply-To:

From: "Aroma "

To:

Subject: Web Solutions

Date: Wed, 14 Aug 2013 23:55:31 -0700

Message-ID: <520bcbed.67e6440a.5e08.ffffdfbf@mx.google.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_1A73_01CE9949.D85BA4B0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: Ac6ZhGxy8R6CXW5TRZaGJE0vA3taEQ==

Content-Language: en-us

X-Antivirus: AVG for E-mail 10.0.1432 [3211/6081]

X-AVG-ID: IDEFA95A4-32BD02C3



This is a multipart message in MIME format.



------=_NextPart_000_1A73_01CE9949.D85BA4B0

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: 7bit



Dear Sir/Madam,











This is Aroma working as Business Developer.



We are an offshore PHP web development and multimedia company based in New

Delhi, India offering the best solutions at much affordable price. The

service includes



e-Commerce Development, Website Design, Graphic Design, 3D

Modelling/Animation/Texturing/Lighting, Mobile Apps' and SEO.



We have been serving US, AUS, UK and Canada last 3.5 years. We are seeking

good business relations with you and your company. We love to adopt your

best practices and will be happy to provide our technical

assistance/guidance/recommendations/quotation, as and when required. Our

technical team will provide assistance to WIN projects for mutual benefits.

Technical team will also answer your client's technical queries, share

references and their honest advices/recommendations.



"WE GROW WHEN NUMBER OF YOUR CUSTOMERS GROW"





We are ready to share portfolio, case studies and testimonials, if you feel

interested.



Select us if you need



1. E-Commerce Solutions - Magenta, OS-Commerce, big-Commerce, CRE

Loaded, Volusion

2. Open Source Solutions - Word Press, Word Press Thesis and Joomla +

Virtumart etc.

3. Customize web application development in open PHP

4. Payment Gateway Integration - PayPal, EBS, Google Checkout, Word

Pay, Moneris, Sage Pay etc.

5. Designs - Creative layouts, high quality graphic designs etc.

6. PSD to Xhtml conversion - SEO Semantic, W3C and Jigsaw validated

xhtml conversion to boost ranking in SEs.

7. Accessibility Guidelines 2.0

8. Corporate Branding - Logo, e-Brochure, Postcard, Business card,

Letterhead, Product Catalog



I am excited to hear from you. Cheers!!



Thanks and Regards

Aroma | Associate Consultant / Production Coordinator, Pixel Dew

==================================================================

DISCLAIMER:

----------------------------------------------------------------------------

-------------------------------------------

The contents of this e-mail and any attachment(s) are confidential and

intended for the named recipient(s) only. It shall not attach any liability

on the originator or Pixel Dew. Any views or opinions presented in this

email are solely those of the author and may not necessarily reflect the

opinions of Pixel Dew. Any form of reproduction, dissemination, copying,

disclosure, modification, distribution and / or publication of this message

without the prior written consent of the author of this e-mail is strictly

prohibited. If you have received this email in error please delete it and

notify the sender immediately. Before opening any mail and attachments

please check them for viruses and defect.























-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3211/6081 - Release Date: 08/15/13

------=_NextPart_000_1A73_01CE9949.D85BA4B0

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">






>




















a","sans-serif";

color:#333399'>Dear Sir/Madam,
sans-serif";

color:#333399'>






a","sans-serif";

color:#333399'> 






a","sans-serif";

color:#333399'> 






amily:

"Verdana","sans-serif";color:#333399'>This is Aroma working as Busin=

ess

Developer.
ns-serif";

color:#333399'>






:auto;

line-height:normal'>
sans-serif";

color:#333399'>We are an offshore PHP web development and multimedia

company based in New Delhi, India offering the best solutions at much

affordable price. The service includes






:auto;

line-height:normal'>
","sans-serif";

color:#333399'>e-Commerce
ze:10.0pt;

font-family:"Verdana","sans-serif";color:#333399'>Development
an

lang=3DEN-IN style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif";

=



color:#333399'>, Website Design, Graphic Design, 3D

Modelling/Animation/Texturing/Lighting, Mobile Apps’ and <=

b>SEO.


f";

color:#333399'>






:auto;

line-height:normal'>
y:"Verdana","sans-serif";

color:#333399'>We have been serving US, AUS, UK and Canada last 3.5 years. =

We

are seeking good business relations with you and your company. We love to a=

dopt

your best practices and will be happy to provide our technical

assistance/guidance/recommendations/quotation, as and when required. Our

technical team will provide assistance to WIN projects for mutual benefits.=



Technical team will also answer your client’s technical queries, shar=

e

references and their honest advices/recommendations.
style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif";color:#333399'=

>






:auto;

line-height:normal'>
mily:

"Verdana","sans-serif";color:#333399'>      &=

nbsp;           &nbs=

p;       “WE GROW

WHEN NUMBER OF YOUR CUSTOMERS GROW”     &nbs=

p;    
style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif";color:#333399'=

>






:auto;

line-height:normal'>
mily:

"Verdana","sans-serif";color:#333399'> 
style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif";color:#333399'=

>We

are ready to share portfolio, case studies and testimonials, if you feel

interested.
ans-serif";

color:#333399'>






:auto;

line-height:normal'>
ana","sans-serif";

color:#333399'>Select us if you need
:10.0pt;

font-family:"Verdana","sans-serif";color:#333399'>








  1. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>E-Commer=

    ce

    Solutions
    na","sans-serif"'>

    – Magenta, OS-Commerce, big-Commerce, CRE Loaded, Volusion<=

    /o:p>



  2. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>Open Sou=

    rce

    Solutions
    na","sans-serif"'>

    - Word Press, Word Press Thesis and Joomla + Virtumart etc.=




  3. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>Customiz=

    e web

    application development in open PHP
    :10.0pt;

    font-family:"Verdana","sans-serif"'>



  4. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>Payment

    =



    Gateway Integration
    ily:

    "Verdana","sans-serif"'> - PayPal, EBS, Google Checkout, Word Pay, Mon=

    eris,

    Sage Pay etc.



  5. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>Designs<=

    /span>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'> –=



    Creative layouts, high quality graphic designs etc.<=

    /li>


  6. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>PSD to X=

    html

    conversion
    dana","sans-serif"'>-

    SEO Semantic, W3C and Jigsaw validated xhtml conversion to boost ranki=

    ng

    in SEs.



  7. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>Accessib=

    ility

    Guidelines 2.0
    Verdana","sans-serif"'>



  8. argin-bottom-alt:

    auto;line-height:normal;mso-list:l0 level1 lfo1'>
    style=3D'font-size:10.0pt;font-family:"Verdana","sans-serif"'>Corporat=

    e

    Branding  -
    y:

    "Verdana","sans-serif"'>Logo, e-Brochure, Postcard, Business card,

    Letterhead, Product Catalog







:auto;

line-height:normal'>
sans-serif";

color:#333399'>I am excited to hear from you. Cheers!!
>




family:

"Verdana","sans-serif";color:#333399'>Thanks and Regards



t-family:

"Verdana","sans-serif";color:#333399'>Aroma  
'font-size:

10.0pt;line-height:115%;font-family:"Verdana","sans-serif";color:#333399'>=

=7C

Associate Consultant / Production Coordinator, Pixel Dew



a","sans-serif"'>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
pan

style=3D'font-size:10.0pt;line-height:115%;font-family:"Verdana","sans-seri=

f"'>


DISCLAIMER:
ly:

"Verdana","sans-serif"'>



","sans-serif"'>-----------------------------------------------------------=

------------------------------------------------------------


The contents of this e-mail and any attachment(s) are confidential and inte=

nded

for the named recipient(s) only. It shall not attach any liability on the

originator or Pixel Dew. Any views or opinions presented in this email are

=



solely those of the author and may not necessarily reflect the opinions of

=



Pixel Dew. Any form of reproduction, dissemination, copying, disclosure, mo=

dification,

distribution and / or publication of this message without the prior written=



consent of the author of this e-mail is strictly prohibited. If you have

received this email in error please delete it and notify the sender

immediately. Before opening any mail and attachments please check them for

=



viruses and defect.
=



font-family:"Verdana","sans-serif"'>






:auto;

line-height:normal'>
ans-serif";

color:#333399'> 






:auto;

line-height:normal'>
sans-serif";

color:#333399'> 






family:

"Verdana","sans-serif";color:#333399'>



p>














t" color=3D"#000000">No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3211/6081 - Release Date: 08/15/13

=







------=_NextPart_000_1A73_01CE9949.D85BA4B0--







More Paypal Phish via Bell Canada

Posted by Dave Yadallee on
From - Fri Aug 16 08:43:28 2013

X-Account-Key: account1

X-UIDL: 0000240b4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 14 Aug 2013 17:19:46 -0600

Received: from toroondcbmts08-srv.bellnexxia.net ([207.236.237.42])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9kLr-0001GF-HN

for dave@nk.ca; Wed, 14 Aug 2013 17:19:46 -0600

Received: from toip54-bus.srvr.bell.ca ([67.69.240.140])

by toroondcbmts08-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130814231936.WANO15792.toroondcbmts08-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

for ; Wed, 14 Aug 2013 19:19:36 -0400

Received: from unknown (HELO ServeurVF) ([65.94.74.53])

by toip54-bus.srvr.bell.ca with ESMTP; 14 Aug 2013 19:19:23 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AklOANsCDFJBXko1/2dsb2JhbAABQBqCRAEPMjWIa4RQk2yGKoYGAQGJSIkCcBZ0gnYBRQQBAQECB4EWE4gQDDKYJ5NWAUCESJZ2hDmBHQOeMIVZhS2DNyCBNQ

X-IronPort-AV: E=Sophos;i="4.89,880,1367985600";

d="scan'208,217";a="339091651"

From: "**PayPaI**"

Subject: ** Final Notice for dave@nk.ca **

To: "59-125-248-104.hinet-ip.hinet.net wY1xMe"

Content-Type: multipart/alternative; boundary="aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0"

MIME-Version: 1.0

Date: Wed, 14 Aug 2013 19:19:21 -0400

X-Antivirus: avast! (VPS 130814-1, 2013-08-14), Outbound message

X-Antivirus-Status: Clean

Message-Id: <20130814231936.WANO15792.toroondcbmts08-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - [...]



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.42 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.42 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.42 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=gfafsas%40service.com;ip=207.236.237.42;r=doctor.nl2k.ab.ca]

0.7 SARE_HTML_A_BODY FULL: Message body has very strange HTML sequence

1.7 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe naught

else

Subject: {SPAM?} ** Final Notice for dave@nk.ca **



This is a multi-part message in MIME format



--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -





--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable






php" target=3D_blank>
net/appserv/sejur35612.png">



--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0--







More Paypal Phish via Bell Canada

Posted by Dave Yadallee on
From - Fri Aug 16 08:43:28 2013

X-Account-Key: account1

X-UIDL: 0000240b4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 14 Aug 2013 17:19:46 -0600

Received: from toroondcbmts08-srv.bellnexxia.net ([207.236.237.42])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9kLr-0001GF-HN

for dave@nk.ca; Wed, 14 Aug 2013 17:19:46 -0600

Received: from toip54-bus.srvr.bell.ca ([67.69.240.140])

by toroondcbmts08-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130814231936.WANO15792.toroondcbmts08-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

for ; Wed, 14 Aug 2013 19:19:36 -0400

Received: from unknown (HELO ServeurVF) ([65.94.74.53])

by toip54-bus.srvr.bell.ca with ESMTP; 14 Aug 2013 19:19:23 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AklOANsCDFJBXko1/2dsb2JhbAABQBqCRAEPMjWIa4RQk2yGKoYGAQGJSIkCcBZ0gnYBRQQBAQECB4EWE4gQDDKYJ5NWAUCESJZ2hDmBHQOeMIVZhS2DNyCBNQ

X-IronPort-AV: E=Sophos;i="4.89,880,1367985600";

d="scan'208,217";a="339091651"

From: "**PayPaI**"

Subject: ** Final Notice for dave@nk.ca **

To: "59-125-248-104.hinet-ip.hinet.net wY1xMe"

Content-Type: multipart/alternative; boundary="aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0"

MIME-Version: 1.0

Date: Wed, 14 Aug 2013 19:19:21 -0400

X-Antivirus: avast! (VPS 130814-1, 2013-08-14), Outbound message

X-Antivirus-Status: Clean

Message-Id: <20130814231936.WANO15792.toroondcbmts08-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - [...]



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.42 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.42 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.42 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=gfafsas%40service.com;ip=207.236.237.42;r=doctor.nl2k.ab.ca]

0.7 SARE_HTML_A_BODY FULL: Message body has very strange HTML sequence

1.7 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe naught

else

Subject: {SPAM?} ** Final Notice for dave@nk.ca **



This is a multi-part message in MIME format



--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -





--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable






php" target=3D_blank>
net/appserv/sejur35612.png">



--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0--







Spanish Google Spam

Posted by Dave Yadallee on
From - Wed Aug 14 05:49:53 2013

X-Account-Key: account1

X-UIDL: 000023ef4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path: <3sksLUgkJBA0nB75.o7ontznvy.p1zqn8rq1p614.0yFx.no.pn@calendar-server.bounces.google.com>

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 14 Aug 2013 03:19:58 -0600

Received: from mail-ie0-f202.google.com ([209.85.223.202])

by doctor.nl2k.ab.ca with esmtps (TLSv1:RC4-SHA:128)

(Exim 4.80.1)

(envelope-from <3sksLUgkJBA0nB75.o7ontznvy.p1zqn8rq1p614.0yFx.no.pn@calendar-server.bounces.google.com>)

id 1V9XFA-0007BN-RA

for dave@doctor.nl2k.ab.ca; Wed, 14 Aug 2013 03:19:58 -0600

Received: by mail-ie0-f202.google.com with SMTP id k5so1828450iea.3

for ; Wed, 14 Aug 2013 02:19:46 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20120113;

h=mime-version:reply-to:sender:auto-submitted:message-id:date:subject

:from:to:content-type;

bh=3deH4r+jn+fcqfEVk30HFMFYpqyL953SUeQ51GoYZR0=;

b=MZhLGvBOgS3x+q9CJ6n55GSa463FsE7upeNihABqv8tdGUtTfxHsvvlJXkSQV7Usx9

gRPhciFIvG33djTb/t86FQxXklmyPPjbL5DeygL9D1wrqcNzDzixuZy77L2Jo1xuWAaF

lV4A2OvD6ApeiVbOoFWXOUkpf4vSZsWHNDZ9YAhsVYcSUs2azN/VHIEJyRmYAcVIVHEs

Lt8UI/nGyUk80QYPoWkwez0CjNYWMuLiz99XYalAdjxqhfBqiK1S18R+Imkd8ESiReRj

mTjP5HeQhwk9vcHWHsdOnurhxmXw2q65VymW763bQLojbg+09il25n/oLqHqQgHhi5Va

e+Jg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20120113;

h=mime-version:reply-to:sender:auto-submitted:message-id:date:subject

:from:to:content-type;

bh=3deH4r+jn+fcqfEVk30HFMFYpqyL953SUeQ51GoYZR0=;

b=QXc559A+Jx0f5IxuLVJioMTw+Xwd7smNC/M+Jsr7XN3PbDPW1BS/GXUz3+yFD3kFsW

RS6C3TOqILCaHdgmv22x//EPswhIaey8nCmgfouQb1l75O9+nCVIHA+dO5oA49AIMtQk

X/KvMOkeVeH710OGDgq6uFd7wlWX3+bPRZGJUMF2N20eguTvZ6YxOITk2w7dNAsZnVUM

xkauMjrTn1QSzUMKWen26aNIDR68bK6crsWgd8YXkls1SzWGDTnL4P/jnj2jIJbJy9gc

QH5N7FmaijbbcO0geCX9MyGO5D26elm8q0n3k+mqwTApUJJtaqg9VZulKlmxZWGOnF9p

Sqfw==

MIME-Version: 1.0

X-Received: by 10.42.105.206 with SMTP id w14mr5135655ico.26.1376471986482;

Wed, 14 Aug 2013 02:19:46 -0700 (PDT)

Reply-To: ayus buba

Sender: Google Calendar

Auto-Submitted: auto-generated

Message-ID: <20cf3022410dcc341a04e3e4dbb2@google.com>

Date: Wed, 14 Aug 2013 09:19:46 +0000

Subject: Invitation: De Dr.Buba Yusuf @ Wed Aug 14, 2013 5:30am - 6:30am (ayus.buba@gmail.com)

From: ayus buba

To: "dave@doctor.nl2k.ab.ca"

Content-Type: multipart/mixed; boundary=20cf3022410dcc341504e3e4dbb1

X-Antivirus: AVG for E-mail 10.0.1432 [3211/6075]

X-AVG-ID: ID5B959AD1-623B593E



--20cf3022410dcc341504e3e4dbb1

Content-Type: multipart/alternative; boundary=20cf3022410dcc341204e3e4dbaf



--20cf3022410dcc341204e3e4dbaf

Content-Type: text/plain; charset=windows-1252; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WW91IGhhdmUgYmVlbiBpbnZpdGVkIHRvIHRoZSBmb2xsb3dpbmcgZXZlbnQuDQoNClRpdGxlOiBE

ZSBEci5CdWJhIFl1c3VmDQpFc3RpbWFkbyBhbWlnbywNCg0KDQpUZW5nbyB1bmEgcHJvcHVlc3Rh

IHBhcmEgdXN0ZWQsIHNpbiBlbWJhcmdvLCBlc3RvIG5vIGVzIG9ibGlnYXRvcmlvIG5pIHlvICAN

CmRlIG5pbmd1bmEgbWFuZXJhIG9ibGlnYXIgYSBjdW1wbGlyIGVsIGNvbnRlbmlkbyBlbiBjb250

cmEgZGUgc3Ugdm9sdW50YWQuICANClNveSBlbCBEci4gWXVzdWYgQnViYSwgeW8gdHJhYmFqbyBj

b24gdW4gYmFuY28gKHVubyBkZSBsb3MgYmFuY29zIGztZGVyZXMgIA0KZW4gwWZyaWNhKS4gQXF1

7SwgZW4gZXN0ZSBiYW5jbyBleGlzdGUgdW5hIGN1ZW50YSBpbmFjdGl2YSBkdXJhbnRlIGxvcyAg

DQr6bHRpbW9zIDEwIGHxb3MsIHF1ZSBwZXJ0ZW5lY2UgYSB1biBjaXVkYWRhbm8gZXN0YWRvdW5p

ZGVuc2UgcXVlIGFob3JhIGVzICANCnRhcmRlLCBlbCBTci4gSm9obiBDdXRoYmVydHNvbiwgcXVl

IG11cmnzIGVuIEFsYXNrYSBBaXJsaW5lcyBlbiBBbGFza2EgIA0KQWlybGluZSB2dWVsbyAyNjEg

ZWwgMzEgZGUgZW5lcm8gZGUgMjAwOC4NCg0KDQpDdWFuZG8gZGVzY3Vicu0gcXVlIG5vIGhhYu1h

IGhhYmlkbyBkZXDzc2l0b3MgbyByZXRpcm9zIGRlIGVzdGEgY3VlbnRhICANCmR1cmFudGUgZXN0

ZSBsYXJnbyBwZXLtb2RvLCBkZWNpZO0gbGxldmFyIGEgY2FibyB1bmEgaW52ZXN0aWdhY2nzbiBk

ZSAgDQpzaXN0ZW1hcyB5IGRlc2N1YnJp8yBxdWUgbmluZ3VubyBkZSBsb3MgbWllbWJyb3MgZGUg

bGEgZmFtaWxpYSwgbmkgbGFzICANCnJlbGFjaW9uZXMgZGUgbGEgcGVyc29uYSB0YXJkZSBlcyBj

b25zY2llbnRlIGRlIGVzdGEgY3VlbnRhLiBBaG9yYSBxdWllcm8gIA0KdW5hIGN1ZW50YSBlbiBl

bCBleHRyYW5qZXJvLCBkb25kZSBlbCBiYW5jbyB0cmFuc2Zlcmly4SBlc3RlIGZvbmRvIGVuLg0K

DQoNCkEgcGFydGlyIGRlIGVudG9uY2VzLCB2b3kgYSBkZXN0cnVpciB0b2RvcyBsb3MgZG9jdW1l

bnRvcyByZWxhY2lvbmFkb3MgYSAgDQplc3RhIGN1ZW50YS4gU2UgdHJhdGEgZGUgdW5hIHJlZCBk

ZSBjdWlkYWRvIHkgZHVyYW50ZSBsb3Mg+mx0aW1vcyBvbmNlICANCm1lc2VzIGhlIHRyYWJhamFk

byB0b2RvIHBhcmEgYXNlZ3VyYXIgdW5hIG9wZXJhY2nzbiBsaWJyZSBkZSBlbmdhbmNoZS4gTGEg

IA0KY2FudGlkYWQgbeFzIHRvZG9zIGxvcyBpbnRlcmVzZXMgYWN1bXVsYWRvcyBlcyBFRS5VVS4g

JCAxNSw1MDAsMDAwLjAwICANCihxdWluY2UgbWlsbG9uZXMgcXVpbmllbnRvcyBtaWwgZPNsYXJl

cyBkZSBFRS5VVS4g+m5pY2FtZW50ZSkuDQoNCg0KQWhvcmEgbWlzIHByZWd1bnRhcyBzb246IC0N

CjEuIL9TZSBwdWVkZSBtYW5lamFyIGVzdGUgcHJveWVjdG8/DQoyLiC/VGUgcHVlZG8gZGFyIGVz

dGEgY29uZmlhbnphPw0KMy4gv0N14Wwgc2Vy4SBzdSBjb21pc2nzbiBzaSBzZSBwdWVkZSBmYWNp

bGl0YXIgZWwgbW92aW1pZW50byBkZSBlc3RlIGZvbmRvICANCmVuIHN1IGN1ZW50YT8NCg0KDQpD

b25zaWRlcmUgZXN0byB5IHZvbHZlciBhIG3tIHRhbiBwcm9udG8gY29tbyBzZWEgcG9zaWJsZSBj

b24gc3VzIG5vbWJyZXMgeSAgDQphcGVsbGlkb3MsIHRlbOlmb25vIHByaXZhZG8geSBkZSBmYXgs

IGRpcmVjY2nzbiBwb3N0YWwgY29ycmVzcG9uZGllbnRlLCBldGMgIA0KUG9yIPpsdGltbywgZXMg

bWkgaHVtaWxkZSBwZXRpY2nzbiBkZSBxdWUgbGEgaW5mb3JtYWNp824gcXVlIGZpZ3VyYSBlbiBl

c3RlICANCmRvY3VtZW50byBzZSBjb25jZWRlcuEgYSBjYWRhIGNvbmZpZGVuY2lhbGlkYWQgeSBl

bCBzZWNyZXRvIGVzIG5lY2VzYXJpbyAgDQpxdWUgbWVyZWNlIGVzcGVybyBzdSByZXNwdWVzdGEg

dXJnZW50ZSBhIGVzdGEgc29saWNpdHVkLCBzZSBkaXNwdXRhbiBtaSAgDQpjb3JyZW8gZWxlY3Ry

825pY28gcHJpdmFkbzogIHlfYnViYUB5YWhvby5jb20NCg0KQXRlbnRhbWVudGUsDQpEci4gWXVz

dWYgQnViYQ0KDQpXaGVuOiBXZWQgQXVnIDE0LCAyMDEzIDU6MzBhbSCWIDY6MzBhbSBFYXN0ZXJu

IFRpbWUNCkNhbGVuZGFyOiBheXVzLmJ1YmFAZ21haWwuY29tDQpXaG86DQogICAgIChHdWVzdCBs

aXN0IGhhcyBiZWVuIGhpZGRlbiBhdCBvcmdhbml6ZXIncyByZXF1ZXN0KQ0KDQpFdmVudCBkZXRh

aWxzOiAgDQpodHRwczovL3d3dy5nb29nbGUuY29tL2NhbGVuZGFyL2V2ZW50P2FjdGlvbj1WSUVX

JmVpZD1hV1E0YkRrMmRtTndaMmMzTUhSdE5qRXpaemM1WWpFNU5qUWdaR0YyWlVCa2IyTjBiM0l1

Ym13eWF5NWhZaTVqWVEmdG9rPU1Ua2pZWGwxY3k1aWRXSmhRR2R0WVdsc0xtTnZiV0k0Wm1KbVl6

WmtZMkpsTWpsbU16VTNaRGhtWXpoaVpHUTBPV0kyWWpZeE5XTmpPVGN3WVdJJmN0ej1BbWVyaWNh

L05ld19Zb3JrJmhsPWVuDQoNCkludml0YXRpb24gZnJvbSBHb29nbGUgQ2FsZW5kYXI6IGh0dHBz

Oi8vd3d3Lmdvb2dsZS5jb20vY2FsZW5kYXIvDQoNCllvdSBhcmUgcmVjZWl2aW5nIHRoaXMgY291

cnRlc3kgZW1haWwgYXQgdGhlIGFjY291bnQgZGF2ZUBkb2N0b3Iubmwyay5hYi5jYSAgDQpiZWNh

dXNlIHlvdSBhcmUgYW4gYXR0ZW5kZWUgb2YgdGhpcyBldmVudC4NCg0KVG8gc3RvcCByZWNlaXZp

bmcgZnV0dXJlIG5vdGlmaWNhdGlvbnMgZm9yIHRoaXMgZXZlbnQsIGRlY2xpbmUgdGhpcyBldmVu

dC4gIA0KQWx0ZXJuYXRpdmVseSB5b3UgY2FuIHNpZ24gdXAgZm9yIGEgR29vZ2xlIGFjY291bnQg

YXQgIA0KaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jYWxlbmRhci8gYW5kIGNvbnRyb2wgeW91ciBu

b3RpZmljYXRpb24gc2V0dGluZ3MgZm9yICANCnlvdXIgZW50aXJlIGNhbGVuZGFyLg0K

--20cf3022410dcc341204e3e4dbaf

Content-Type: text/html; charset=windows-1252

Content-Transfer-Encoding: quoted-printable




mary=3D"" style=3D"width:100%;font-family:Arial,Sans-serif;border:1px Solid=

#ccc;border-width:1px 2px 2px 1px;background-color:#fff;" itemscope itemty=

pe=3D"http://schema.org/Event">

mprop=3D"publisher" itemscope itemtype=3D"http://schema.org/Organization"><=

meta itemprop=3D"name" content=3D"Google Calendar"/>


Sans-serif;font-size:16px;font-weight:bold;color:#222">
me">De Dr.Buba Yusuf


:13px;color:#222;white-space:pre-wrap!important;white-space:-moz-pre-wrap!i=

mportant;white-space:-pre-wrap!important;white-space:-o-pre-wrap!important;=

white-space:pre;word-wrap:break-word">Estimado amigo,


Tengo una pro=

puesta para usted, sin embargo, esto no es obligatorio ni yo de ninguna man=

era obligar a cumplir el contenido en contra de su voluntad. Soy el Dr. Yus=

uf Buba, yo trabajo con un banco (uno de los bancos l=EDderes en =C1frica).=

Aqu=ED, en este banco existe una cuenta inactiva durante los =FAltimos 10 =

a=F1os, que pertenece a un ciudadano estadounidense que ahora es tarde, el =

Sr. John Cuthbertson, que muri=F3 en Alaska Airlines en Alaska Airline vuel=

o 261 el 31 de enero de 2008.


Cuando descubr=ED que no hab=EDa habi=

do dep=F3sitos o retiros de esta cuenta durante este largo per=EDodo, decid=

=ED llevar a cabo una investigaci=F3n de sistemas y descubri=F3 que ninguno=

de los miembros de la familia, ni las relaciones de la persona tarde es co=

nsciente de esta cuenta. Ahora quiero una cuenta en el extranjero, donde el=

banco transferir=E1 este fondo en.


A partir de entonces, voy a des=

truir todos los documentos relacionados a esta cuenta. Se trata de una red =

de cuidado y durante los =FAltimos once meses he trabajado todo para asegur=

ar una operaci=F3n libre de enganche. La cantidad m=E1s todos los intereses=

acumulados es EE.UU. $ 15,500,000.00 (quince millones quinientos mil d=F3l=

ares de EE.UU. =FAnicamente).


Ahora mis preguntas son: -
1. =

=BFSe puede manejar este proyecto?
2. =BFTe puedo dar esta confianza?<=

br />3. =BFCu=E1l ser=E1 su comisi=F3n si se puede facilitar el movimiento =

de este fondo en su cuenta?


Considere esto y volver a m=ED tan pron=

to como sea posible con sus nombres y apellidos, tel=E9fono privado y de fa=

x, direcci=F3n postal correspondiente, etc Por =FAltimo, es mi humilde peti=

ci=F3n de que la informaci=F3n que figura en este documento se conceder=E1 =

a cada confidencialidad y el secreto es necesario que merece espero su resp=

uesta urgente a esta solicitud, se disputan mi correo electr=F3nico privado=

: y_buba@yahoo.com
a>

Atentamente,
Dr. Yusuf Buba


able cellpadding=3D"0" cellspacing=3D"0" border=3D"0" summary=3D"Event deta=

ils">

t-size:13px;color:#888;white-space:nowrap" valign=3D"top">

font-style:normal">When

-family:Arial,Sans-serif;font-size:13px;color:#222" valign=3D"top">Wed Aug 14, 2013 5:30am =96 =

6:30am Eastern Time

e=3D"padding:0 1em 10px 0;font-family:Arial,Sans-serif;font-size:13px;color=

:#888;white-space:nowrap" valign=3D"top">

">Calendar

,Sans-serif;font-size:13px;color:#222" valign=3D"top">ayus.buba@gmail.com
td>

font-size:13px;color:#888;white-space:nowrap" valign=3D"top">

=3D"font-style:normal">Who

ont-family:Arial,Sans-serif;font-size:13px;color:#222" valign=3D"top">(Gues=

t list has been hidden at organizer's request)


yle=3D"color:#222;font-size:13px;margin:0">Going=

?   
itemtype=3D"http://schema.org/RsvpAction">
tent=3D"http://schema.org/RsvpAttendance/Yes"/>
temscope itemtype=3D"http://schema.org/HttpActionHandler">
"method" href=3D"http://schema.org/HttpRequestMethod/GET"/>
://www.google.com/calendar/event?action=3DRESPOND&eid=3DaWQ4bDk2dmNwZ2c=

3MHRtNjEzZzc5YjE5NjQgZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&rst=3D1&tok=3DM=

TkjYXl1cy5idWJhQGdtYWlsLmNvbWI4ZmJmYzZkY2JlMjlmMzU3ZDhmYzhiZGQ0OWI2YjYxNWNj=

OTcwYWI&ctz=3DAmerica/New_York&hl=3Den" style=3D"color:#20c;white-s=

pace:nowrap" itemprop=3D"url">Yes
0.4em;font-weight:normal"> -
mtype=3D"http://schema.org/RsvpAction">
t=3D"http://schema.org/RsvpAttendance/Maybe"/>
emscope itemtype=3D"http://schema.org/HttpActionHandler">
method" href=3D"http://schema.org/HttpRequestMethod/GET"/>
//www.google.com/calendar/event?action=3DRESPOND&eid=3DaWQ4bDk2dmNwZ2c3=

MHRtNjEzZzc5YjE5NjQgZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&rst=3D3&tok=3DMT=

kjYXl1cy5idWJhQGdtYWlsLmNvbWI4ZmJmYzZkY2JlMjlmMzU3ZDhmYzhiZGQ0OWI2YjYxNWNjO=

TcwYWI&ctz=3DAmerica/New_York&hl=3Den" style=3D"color:#20c;white-sp=

ace:nowrap" itemprop=3D"url">Maybe
0.4em;font-weight:normal"> -
emtype=3D"http://schema.org/RsvpAction">
nt=3D"http://schema.org/RsvpAttendance/No"/>
scope itemtype=3D"http://schema.org/HttpActionHandler">
thod" href=3D"http://schema.org/HttpRequestMethod/GET"/>
www.google.com/calendar/event?action=3DRESPOND&eid=3DaWQ4bDk2dmNwZ2c3MH=

RtNjEzZzc5YjE5NjQgZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&rst=3D2&tok=3DMTkj=

YXl1cy5idWJhQGdtYWlsLmNvbWI4ZmJmYzZkY2JlMjlmMzU3ZDhmYzhiZGQ0OWI2YjYxNWNjOTc=

wYWI&ctz=3DAmerica/New_York&hl=3Den" style=3D"color:#20c;white-spac=

e:nowrap" itemprop=3D"url">No   &=

nbsp;
p;eid=3DaWQ4bDk2dmNwZ2c3MHRtNjEzZzc5YjE5NjQgZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&=

amp;tok=3DMTkjYXl1cy5idWJhQGdtYWlsLmNvbWI4ZmJmYzZkY2JlMjlmMzU3ZDhmYzhiZGQ0O=

WI2YjYxNWNjOTcwYWI&ctz=3DAmerica/New_York&hl=3Den" style=3D"color:#=

20c;white-space:nowrap">more options »


=3D"background-color:#f6f6f6;color:#888;border-top:1px Solid #ccc;font-fami=

ly:Arial,Sans-serif;font-size:11px">

Invitation from
ww.google.com/calendar/" target=3D"_blank" style=3D"">Google Calendar
p>

You are receiving this courtesy email at the account dave@doctor.nl2k.=

ab.ca because you are an attendee of this event.

To stop receiving fu=

ture notifications for this event, decline this event. Alternatively you ca=

n sign up for a Google account at https://www.google.com/calendar/ and cont=

rol your notification settings for your entire calendar.


le>


--20cf3022410dcc341204e3e4dbaf

Content-Type: text/calendar; charset=UTF-8; method=REQUEST

Content-Transfer-Encoding: quoted-printable



BEGIN:VCALENDAR

PRODID:-//Google Inc//Google Calendar 70.9054//EN

VERSION:2.0

CALSCALE:GREGORIAN

METHOD:REQUEST

BEGIN:VEVENT

DTSTART:20130814T093000Z

DTEND:20130814T103000Z

DTSTAMP:20130814T091946Z

ORGANIZER;CN=3Dayus.buba@gmail.com:mailto:ayus.buba@gmail.com

UID:id8l96vcpgg70tm613g79b1964@google.com

ATTENDEE;CUTYPE=3DINDIVIDUAL;ROLE=3DREQ-PARTICIPANT;PARTSTAT=3DNEEDS-ACTION=

;RSVP=3D

TRUE;CN=3Ddave@doctor.nl2k.ab.ca;X-NUM-GUESTS=3D0:mailto:dave@doctor.nl2k.=

ab.ca

CREATED:20130814T091945Z

DESCRIPTION:Estimado amigo\,\n\n\nTengo una propuesta para usted\, sin emba

rgo\, esto no es obligatorio ni yo de ninguna manera obligar a cumplir el =

c

ontenido en contra de su voluntad. Soy el Dr. Yusuf Buba\, yo trabajo con =

u

n banco (uno de los bancos l=C3=ADderes en =C3=81frica). Aqu=C3=AD\, en es=

te banco existe=20

una cuenta inactiva durante los =C3=BAltimos 10 a=C3=B1os\, que pertenece =

a un ciudad

ano estadounidense que ahora es tarde\, el Sr. John Cuthbertson\, que muri=

=C3=B3

en Alaska Airlines en Alaska Airline vuelo 261 el 31 de enero de 2008.\n\=

n

\nCuando descubr=C3=AD que no hab=C3=ADa habido dep=C3=B3sitos o retiros d=

e esta cuenta du

rante este largo per=C3=ADodo\, decid=C3=AD llevar a cabo una investigaci=

=C3=B3n de sistem

as y descubri=C3=B3 que ninguno de los miembros de la familia\, ni las rel=

acione

s de la persona tarde es consciente de esta cuenta. Ahora quiero una cuent=

a

en el extranjero\, donde el banco transferir=C3=A1 este fondo en.\n\n\nA =

partir

de entonces\, voy a destruir todos los documentos relacionados a esta cue=

n

ta. Se trata de una red de cuidado y durante los =C3=BAltimos once meses h=

e trab

ajado todo para asegurar una operaci=C3=B3n libre de enganche. La cantidad=

m=C3=A1s t

odos los intereses acumulados es EE.UU. $ 15\,500\,000.00 (quince millones=

=20

quinientos mil d=C3=B3lares de EE.UU. =C3=BAnicamente).\n\n\nAhora mis pre=

guntas son:

-\n1. =C2=BFSe puede manejar este proyecto?\n2. =C2=BFTe puedo dar esta c=

onfianza?\n

3. =C2=BFCu=C3=A1l ser=C3=A1 su comisi=C3=B3n si se puede facilitar el mov=

imiento de este fondo

en su cuenta?\n\n\nConsidere esto y volver a m=C3=AD tan pronto como sea =

posibl

e con sus nombres y apellidos\, tel=C3=A9fono privado y de fax\, direcci=

=C3=B3n posta

l correspondiente\, etc Por =C3=BAltimo\, es mi humilde petici=C3=B3n de q=

ue la infor

maci=C3=B3n que figura en este documento se conceder=C3=A1 a cada confiden=

cialidad y=20

el secreto es necesario que merece espero su respuesta urgente a esta soli=

c

itud\, se disputan mi correo electr=C3=B3nico privado: y_buba@yahoo.com\n=

\nAten

tamente\,\nDr. Yusuf Buba\n\nView your event at http://www.google.com/cale=

n

dar/event?action=3DVIEW&eid=3DaWQ4bDk2dmNwZ2c3MHRtNjEzZzc5YjE5NjQgZGF2ZUBk=

b2N0b

3Iubmwyay5hYi5jYQ&tok=3DMTkjYXl1cy5idWJhQGdtYWlsLmNvbWI4ZmJmYzZkY2JlMjlmMz=

U3Z

DhmYzhiZGQ0OWI2YjYxNWNjOTcwYWI&ctz=3DAmerica/New_York&hl=3Den.

LAST-MODIFIED:20130814T091945Z

LOCATION:

SEQUENCE:0

STATUS:CONFIRMED

SUMMARY:De Dr.Buba Yusuf

TRANSP:OPAQUE

END:VEVENT

END:VCALENDAR



--20cf3022410dcc341204e3e4dbaf--



--20cf3022410dcc341504e3e4dbb1

Content-Type: application/ics; name="invite.ics"

Content-Disposition: attachment; filename="invite.ics"

Content-Transfer-Encoding: base64



QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vR29vZ2xlIEluYy8vR29vZ2xlIENhbGVuZGFyIDcw

LjkwNTQvL0VODQpWRVJTSU9OOjIuMA0KQ0FMU0NBTEU6R1JFR09SSUFODQpNRVRIT0Q6UkVRVUVT

VA0KQkVHSU46VkVWRU5UDQpEVFNUQVJUOjIwMTMwODE0VDA5MzAwMFoNCkRURU5EOjIwMTMwODE0

VDEwMzAwMFoNCkRUU1RBTVA6MjAxMzA4MTRUMDkxOTQ2Wg0KT1JHQU5JWkVSO0NOPWF5dXMuYnVi

YUBnbWFpbC5jb206bWFpbHRvOmF5dXMuYnViYUBnbWFpbC5jb20NClVJRDppZDhsOTZ2Y3BnZzcw

dG02MTNnNzliMTk2NEBnb29nbGUuY29tDQpBVFRFTkRFRTtDVVRZUEU9SU5ESVZJRFVBTDtST0xF

PVJFUS1QQVJUSUNJUEFOVDtQQVJUU1RBVD1ORUVEUy1BQ1RJT047UlNWUD0NCiBUUlVFO0NOPWRh

dmVAZG9jdG9yLm5sMmsuYWIuY2E7WC1OVU0tR1VFU1RTPTA6bWFpbHRvOmRhdmVAZG9jdG9yLm5s

MmsuYWIuY2ENCkNSRUFURUQ6MjAxMzA4MTRUMDkxOTQ1Wg0KREVTQ1JJUFRJT046RXN0aW1hZG8g

YW1pZ29cLFxuXG5cblRlbmdvIHVuYSBwcm9wdWVzdGEgcGFyYSB1c3RlZFwsIHNpbiBlbWJhDQog

cmdvXCwgZXN0byBubyBlcyBvYmxpZ2F0b3JpbyBuaSB5byBkZSBuaW5ndW5hIG1hbmVyYSBvYmxp

Z2FyIGEgY3VtcGxpciBlbCBjDQogb250ZW5pZG8gZW4gY29udHJhIGRlIHN1IHZvbHVudGFkLiBT

b3kgZWwgRHIuIFl1c3VmIEJ1YmFcLCB5byB0cmFiYWpvIGNvbiB1DQogbiBiYW5jbyAodW5vIGRl

IGxvcyBiYW5jb3MgbMOtZGVyZXMgZW4gw4FmcmljYSkuIEFxdcOtXCwgZW4gZXN0ZSBiYW5jbyBl

eGlzdGUgDQogdW5hIGN1ZW50YSBpbmFjdGl2YSBkdXJhbnRlIGxvcyDDumx0aW1vcyAxMCBhw7Fv

c1wsIHF1ZSBwZXJ0ZW5lY2UgYSB1biBjaXVkYWQNCiBhbm8gZXN0YWRvdW5pZGVuc2UgcXVlIGFo

b3JhIGVzIHRhcmRlXCwgZWwgU3IuIEpvaG4gQ3V0aGJlcnRzb25cLCBxdWUgbXVyacOzDQogIGVu

IEFsYXNrYSBBaXJsaW5lcyBlbiBBbGFza2EgQWlybGluZSB2dWVsbyAyNjEgZWwgMzEgZGUgZW5l

cm8gZGUgMjAwOC5cblxuDQogXG5DdWFuZG8gZGVzY3VicsOtIHF1ZSBubyBoYWLDrWEgaGFiaWRv

IGRlcMOzc2l0b3MgbyByZXRpcm9zIGRlIGVzdGEgY3VlbnRhIGR1DQogcmFudGUgZXN0ZSBsYXJn

byBwZXLDrW9kb1wsIGRlY2lkw60gbGxldmFyIGEgY2FibyB1bmEgaW52ZXN0aWdhY2nDs24gZGUg

c2lzdGVtDQogYXMgeSBkZXNjdWJyacOzIHF1ZSBuaW5ndW5vIGRlIGxvcyBtaWVtYnJvcyBkZSBs

YSBmYW1pbGlhXCwgbmkgbGFzIHJlbGFjaW9uZQ0KIHMgZGUgbGEgcGVyc29uYSB0YXJkZSBlcyBj

b25zY2llbnRlIGRlIGVzdGEgY3VlbnRhLiBBaG9yYSBxdWllcm8gdW5hIGN1ZW50YQ0KICBlbiBl

bCBleHRyYW5qZXJvXCwgZG9uZGUgZWwgYmFuY28gdHJhbnNmZXJpcsOhIGVzdGUgZm9uZG8gZW4u

XG5cblxuQSBwYXJ0aXINCiAgZGUgZW50b25jZXNcLCB2b3kgYSBkZXN0cnVpciB0b2RvcyBsb3Mg

ZG9jdW1lbnRvcyByZWxhY2lvbmFkb3MgYSBlc3RhIGN1ZW4NCiB0YS4gU2UgdHJhdGEgZGUgdW5h

IHJlZCBkZSBjdWlkYWRvIHkgZHVyYW50ZSBsb3Mgw7psdGltb3Mgb25jZSBtZXNlcyBoZSB0cmFi

DQogYWphZG8gdG9kbyBwYXJhIGFzZWd1cmFyIHVuYSBvcGVyYWNpw7NuIGxpYnJlIGRlIGVuZ2Fu

Y2hlLiBMYSBjYW50aWRhZCBtw6FzIHQNCiBvZG9zIGxvcyBpbnRlcmVzZXMgYWN1bXVsYWRvcyBl

cyBFRS5VVS4gJCAxNVwsNTAwXCwwMDAuMDAgKHF1aW5jZSBtaWxsb25lcyANCiBxdWluaWVudG9z

IG1pbCBkw7NsYXJlcyBkZSBFRS5VVS4gw7puaWNhbWVudGUpLlxuXG5cbkFob3JhIG1pcyBwcmVn

dW50YXMgc29uOg0KICAtXG4xLiDCv1NlIHB1ZWRlIG1hbmVqYXIgZXN0ZSBwcm95ZWN0bz9cbjIu

IMK/VGUgcHVlZG8gZGFyIGVzdGEgY29uZmlhbnphP1xuDQogMy4gwr9DdcOhbCBzZXLDoSBzdSBj

b21pc2nDs24gc2kgc2UgcHVlZGUgZmFjaWxpdGFyIGVsIG1vdmltaWVudG8gZGUgZXN0ZSBmb25k

bw0KICBlbiBzdSBjdWVudGE/XG5cblxuQ29uc2lkZXJlIGVzdG8geSB2b2x2ZXIgYSBtw60gdGFu

IHByb250byBjb21vIHNlYSBwb3NpYmwNCiBlIGNvbiBzdXMgbm9tYnJlcyB5IGFwZWxsaWRvc1ws

IHRlbMOpZm9ubyBwcml2YWRvIHkgZGUgZmF4XCwgZGlyZWNjacOzbiBwb3N0YQ0KIGwgY29ycmVz

cG9uZGllbnRlXCwgZXRjIFBvciDDumx0aW1vXCwgZXMgbWkgaHVtaWxkZSBwZXRpY2nDs24gZGUg

cXVlIGxhIGluZm9yDQogbWFjacOzbiBxdWUgZmlndXJhIGVuIGVzdGUgZG9jdW1lbnRvIHNlIGNv

bmNlZGVyw6EgYSBjYWRhIGNvbmZpZGVuY2lhbGlkYWQgeSANCiBlbCBzZWNyZXRvIGVzIG5lY2Vz

YXJpbyBxdWUgbWVyZWNlIGVzcGVybyBzdSByZXNwdWVzdGEgdXJnZW50ZSBhIGVzdGEgc29saWMN

CiBpdHVkXCwgc2UgZGlzcHV0YW4gbWkgY29ycmVvIGVsZWN0csOzbmljbyBwcml2YWRvOiAgeV9i

dWJhQHlhaG9vLmNvbVxuXG5BdGVuDQogdGFtZW50ZVwsXG5Eci4gWXVzdWYgQnViYVxuXG5WaWV3

IHlvdXIgZXZlbnQgYXQgaHR0cDovL3d3dy5nb29nbGUuY29tL2NhbGVuDQogZGFyL2V2ZW50P2Fj

dGlvbj1WSUVXJmVpZD1hV1E0YkRrMmRtTndaMmMzTUhSdE5qRXpaemM1WWpFNU5qUWdaR0YyWlVC

a2IyTjBiDQogM0l1Ym13eWF5NWhZaTVqWVEmdG9rPU1Ua2pZWGwxY3k1aWRXSmhRR2R0WVdsc0xt

TnZiV0k0Wm1KbVl6WmtZMkpsTWpsbU16VTNaDQogRGhtWXpoaVpHUTBPV0kyWWpZeE5XTmpPVGN3

WVdJJmN0ej1BbWVyaWNhL05ld19Zb3JrJmhsPWVuLg0KTEFTVC1NT0RJRklFRDoyMDEzMDgxNFQw

OTE5NDVaDQpMT0NBVElPTjoNClNFUVVFTkNFOjANClNUQVRVUzpDT05GSVJNRUQNClNVTU1BUlk6

RGUgRHIuQnViYSBZdXN1Zg0KVFJBTlNQOk9QQVFVRQ0KRU5EOlZFVkVOVA0KRU5EOlZDQUxFTkRB

Ug0K

--20cf3022410dcc341504e3e4dbb1

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-1F488E14======="



--=======AVGMAIL-1F488E14=======

Content-Type: text/html; x-avg=cert; charset="windows-1252"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



No virus found=

in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3211/6075 - Release Date: 08/13/13

=



--=======AVGMAIL-1F488E14=======--



--20cf3022410dcc341504e3e4dbb1--







More Paypal Phish

Posted by Dave Yadallee on
From - Tue Aug 13 17:17:03 2013

X-Account-Key: account1

X-UIDL: 000023d04f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 11:22:06 -0600

Received: from toroondcbmts04-srv.bellnexxia.net ([207.236.237.38])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9II9-00050D-VF

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 11:22:05 -0600

Received: from toip52-bus.srvr.bell.ca ([67.69.240.55])

by toroondcbmts04-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130813172154.CPAY2032.toroondcbmts04-srv.bellnexxia.net@toip52-bus.srvr.bell.ca>

for ; Tue, 13 Aug 2013 13:21:54 -0400

Received: from bas1-galt04-1176178839.dsl.bell.ca (HELO server2) ([70.27.16.151])

by toip52-bus.srvr.bell.ca with ESMTP; 13 Aug 2013 13:21:49 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: Au1QAOpdClJGGxCX/2dsb2JhbAABQBoHEIJvNYhqpEwBAYpxiCQXdIIbWAMBRQYBAid2E4YPggEMMpcijyuEAikBm18GgU6BPYEugRwDgSiIBYVylGmFLR+BQguBTR6BLAIHF20FLA

X-IronPort-AV: E=Sophos;i="4.89,871,1367985600";

d="scan'208,217";a="430663058"

From: "support"

Subject: ( PayPaI Account Limited ) This message is intended for:

dave@doctor.nl2k.ab.ca

To: "61-219-68-15.HINET-IP.hinet.net 3MC8jr"

Content-Type: multipart/alternative; boundary="4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0"

MIME-Version: 1.0

Date: Tue, 13 Aug 2013 12:17:33 -0500

Message-Id: <20130813172154.CPAY2032.toroondcbmts04-srv.bellnexxia.net@toip52-bus.srvr.bell.ca>

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.38 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.38 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.38 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=asfacxz%40sympatico.ca;ip=207.236.237.38;r=doctor.nl2k.ab.ca]

Subject: {SPAM?} ( PayPaI Account Limited ) This message is intended for:

dave@doctor.nl2k.ab.ca



This is a multi-part message in MIME format



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





Your account access is limited for security reasons.


href=3D"http://61-219-68-15.HINET-IP.hinet.net/a.php">Click here to re=

move the limitation and restore your full access.

Thank yo=

u for your prompt attention on this matter!





































--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0--







Paypal Phish via Bell Canada

Posted by Dave Yadallee on
From - Tue Aug 13 17:17:03 2013

X-Account-Key: account1

X-UIDL: 000023d04f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 11:22:06 -0600

Received: from toroondcbmts04-srv.bellnexxia.net ([207.236.237.38])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9II9-00050D-VF

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 11:22:05 -0600

Received: from toip52-bus.srvr.bell.ca ([67.69.240.55])

by toroondcbmts04-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130813172154.CPAY2032.toroondcbmts04-srv.bellnexxia.net@toip52-bus.srvr.bell.ca>

for ; Tue, 13 Aug 2013 13:21:54 -0400

Received: from bas1-galt04-1176178839.dsl.bell.ca (HELO server2) ([70.27.16.151])

by toip52-bus.srvr.bell.ca with ESMTP; 13 Aug 2013 13:21:49 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: Au1QAOpdClJGGxCX/2dsb2JhbAABQBoHEIJvNYhqpEwBAYpxiCQXdIIbWAMBRQYBAid2E4YPggEMMpcijyuEAikBm18GgU6BPYEugRwDgSiIBYVylGmFLR+BQguBTR6BLAIHF20FLA

X-IronPort-AV: E=Sophos;i="4.89,871,1367985600";

d="scan'208,217";a="430663058"

From: "support"

Subject: ( PayPaI Account Limited ) This message is intended for:

dave@doctor.nl2k.ab.ca

To: "61-219-68-15.HINET-IP.hinet.net 3MC8jr"

Content-Type: multipart/alternative; boundary="4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0"

MIME-Version: 1.0

Date: Tue, 13 Aug 2013 12:17:33 -0500

Message-Id: <20130813172154.CPAY2032.toroondcbmts04-srv.bellnexxia.net@toip52-bus.srvr.bell.ca>

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.38 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.38 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.38 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=asfacxz%40sympatico.ca;ip=207.236.237.38;r=doctor.nl2k.ab.ca]

Subject: {SPAM?} ( PayPaI Account Limited ) This message is intended for:

dave@doctor.nl2k.ab.ca



This is a multi-part message in MIME format



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





Your account access is limited for security reasons.


href=3D"http://61-219-68-15.HINET-IP.hinet.net/a.php">Click here to re=

move the limitation and restore your full access.

Thank yo=

u for your prompt attention on this matter!





































--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0--







Phish from Bell Nexxia

Posted by Dave Yadallee on
From - Tue Aug 13 17:17:02 2013

X-Account-Key: account1

X-UIDL: 000023cb4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 09:41:16 -0600

Received: from toroondcbmts06.bellnexxia.net ([207.236.237.40] helo=toroondcbmts06-srv.bellnexxia.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9Gic-0005xB-OW

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 09:41:16 -0600

Received: from toip54-bus.srvr.bell.ca ([67.69.240.140])

by toroondcbmts06-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130813154106.DCOC14379.toroondcbmts06-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

for ; Tue, 13 Aug 2013 11:41:06 -0400

Received: from bas1-galt04-1176178839.dsl.bell.ca (HELO server2) ([70.27.16.151])

by toip54-bus.srvr.bell.ca with ESMTP; 13 Aug 2013 11:41:00 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AlsLAOpOClJGGxCX/2dsb2JhbABbBxCCbzWIaqRNAQGSGnsXdIIbWAMBAUQGAQInZAYCAgiGIoIBDJdIjyuEAikBm2IGgU6BPYEugRwDgSiIBYVymhYfgxoegSwCBxdtBSw

X-IronPort-AV: E=Sophos;i="4.89,870,1367985600";

d="scan'208";a="338908670"

From: "support"

To: "61-218-207-124.HINET-IP.hinet.net 3MC8jr"

Content-Type: multipart/alternative; boundary="4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0"

MIME-Version: 1.0

Date: Tue, 13 Aug 2013 10:36:44 -0500

Message-Id: <20130813154106.DCOC14379.toroondcbmts06-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.40 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.40 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.40 listed in dnsbl-2.uceprotect.net]

Subject: {SPAM?}



This is a multi-part message in MIME format



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable



Your account access is limited for security reasons.





Clic=

k here to remove the limitation and restore your full access.



=20

Thank you for your prompt attention on this matter!





--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0--







Bell Canada Phish

Posted by Dave Yadallee on
From - Tue Aug 13 17:17:02 2013

X-Account-Key: account1

X-UIDL: 000023cb4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 09:41:16 -0600

Received: from toroondcbmts06.bellnexxia.net ([207.236.237.40] helo=toroondcbmts06-srv.bellnexxia.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9Gic-0005xB-OW

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 09:41:16 -0600

Received: from toip54-bus.srvr.bell.ca ([67.69.240.140])

by toroondcbmts06-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130813154106.DCOC14379.toroondcbmts06-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

for ; Tue, 13 Aug 2013 11:41:06 -0400

Received: from bas1-galt04-1176178839.dsl.bell.ca (HELO server2) ([70.27.16.151])

by toip54-bus.srvr.bell.ca with ESMTP; 13 Aug 2013 11:41:00 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AlsLAOpOClJGGxCX/2dsb2JhbABbBxCCbzWIaqRNAQGSGnsXdIIbWAMBAUQGAQInZAYCAgiGIoIBDJdIjyuEAikBm2IGgU6BPYEugRwDgSiIBYVymhYfgxoegSwCBxdtBSw

X-IronPort-AV: E=Sophos;i="4.89,870,1367985600";

d="scan'208";a="338908670"

From: "support"

To: "61-218-207-124.HINET-IP.hinet.net 3MC8jr"

Content-Type: multipart/alternative; boundary="4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0"

MIME-Version: 1.0

Date: Tue, 13 Aug 2013 10:36:44 -0500

Message-Id: <20130813154106.DCOC14379.toroondcbmts06-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.40 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.40 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.40 listed in dnsbl-2.uceprotect.net]

Subject: {SPAM?}



This is a multi-part message in MIME format



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable



Your account access is limited for security reasons.





Clic=

k here to remove the limitation and restore your full access.



=20

Thank you for your prompt attention on this matter!





--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0--







More Indian Google Spam

Posted by Dave Yadallee on
From - Tue Aug 13 17:17:02 2013

X-Account-Key: account1

X-UIDL: 000023cd4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 10:20:33 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1V9HKg-0000rT-Pd

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 10:20:30 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Tue, 13 Aug 2013 10:20:30 -0600

Resent-Message-ID: <20130813162030.GA3147@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from mail-pa0-f66.google.com ([209.85.220.66])

by doctor.nl2k.ab.ca with esmtps (TLSv1:RC4-SHA:128)

(Exim 4.80.1)

(envelope-from )

id 1V9FRw-00012V-Lh

for sales@nk.ca; Tue, 13 Aug 2013 08:19:57 -0600

Received: by mail-pa0-f66.google.com with SMTP id fz6so1568696pac.1

for ; Tue, 13 Aug 2013 07:19:46 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20120113;

h=message-id:reply-to:from:to:subject:date:mime-version:content-type;

bh=p4/zySPYADAeL0uTbyQvzs0XEgrJ7t0E+bQWsJ85UxY=;

b=wNLkcCvOl9Px/qJd0cmizYR9RdP1HIDXtCe35abh7jUe345j0c8knWt/CTyw7btOoj

CPXhvbQiNtDRbGqhdU6n7/8vIJbCiZHEtLLThs/wXNB046q2agS2aZ+fIAe8kMfE6Y48

cosYFcdkOT78aUFiygssH2M4R9OyL5v9CT0VDmomMDmGrajEeELVKjjW2c8zKpAl+2P2

dAJ+f20pJ8Z2HQbrKQ3txm6t1j+2ZLJtPoTaXO/I0bDW2SY8RK9VhU7CbqrlKecAft6o

QA84h8xjNr6OKmYI6NncFxJcRqFh4xiL4G0yQ7D04l2VhSxMvQFF+2JXfcPpodU07YRk

xiyw==

X-Received: by 10.68.12.97 with SMTP id x1mr4259329pbb.150.1376397471172;

Tue, 13 Aug 2013 05:37:51 -0700 (PDT)

Received: from sys42 ([122.176.50.233])

by mx.google.com with ESMTPSA id oj6sm46566334pab.9.2013.08.13.05.37.49

for

(version=TLSv1 cipher=RC4-SHA bits=128/128);

Tue, 13 Aug 2013 05:37:50 -0700 (PDT)

Message-ID: <80767A1444A7458C8E23C68C05700F10@sys42>

Reply-To: "Aditya"

From: "Aditya"

To:

Subject: Web designing and Development Services

Date: Tue, 13 Aug 2013 18:05:42 +0530

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_5565_01CE984F.B990B570"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5512

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Hello, I am Aditya, Business Development Consultant. [...]





Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[209.85.220.66 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_3 RBL: Received via a relay in UCE_PFSM_3

[122.176.50.233 listed in dnsbl-3.uceprotect.net]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[122.176.50.233 listed in dnsbl-2.uceprotect.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 DKIM_VERIFIED Domain Keys Identified Mail: signature passes

verification

0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature

0.3 SARE_WEOFFER BODY: Offers Something

Subject: {SPAM?} Web designing and Development Services



This is a multi-part message in MIME format.



------=_NextPart_000_5565_01CE984F.B990B570

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Hello,

=20

I am Aditya,=20



Business Development Consultant.

=20

I was on your website. I have analyzed your website. Would you be =

interested in a possible redesign of the site or additional features =

that might benefit the overall usability and user experience which =

usually leads to better sales of your services?

=20

We would be happy to help execute Web Design and SEO projects on a white =

label basis for you. Our aim is to be the best in service and as such we =

offer a premium service at very competitive prices than what it might be =

in house. We have a three tier quality check system so No compromise on =

quality!

=20

=20

We provide Web Design & Development to a number of agencies, and =

establishments and have expertise in-

=20

Developing highly effective corporate websites, HTML5 designs,

E- Commerce/Online Web Stores to name a few.

=20

PHP, MySQL, ASP.NET,MS SQL SERVER 2005 or2008,Dotnetnuke, Magento, =

Joomla, Wordpress, Perl, Drupal, JSP, HTML, CSS,

=20

Design- Flash, Photoshop, Corel, E-Commerce - OS Commerce, Zen Cart, =

Virtue Mart, Pay Pal , FedEx and any checkout payment gateway systems =

with maintenance of any kind application or website.

=20

=20

Do let me know if you are interested and I would be happy to share our =

Methodologies, past work details and client Testimonials and Prices.

=20

=20

Truly,



Aditya



Business Development Consultant

------=_NextPart_000_5565_01CE984F.B990B570

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








charset=3Diso-8859-1">









 


Hello,
 
I am Aditya, =



 


Business Development =

Consultant.
 
I was=20

on your website. I have analyzed your website. Would you be interested =

in a=20

possible redesign of the site or additional features that might benefit =

the=20

overall usability and user experience which usually leads to better =

sales of=20

your services?
 
We would be happy to help execute Web Design =

and SEO=20

projects on a white label basis for you. Our aim is to be the best in =

service=20

and as such we offer a premium service at very competitive prices than =

what it=20

might be in house. We have a three tier quality check system so No =

compromise on=20

quality!
 
 
We provide Web Design & Development =

to a=20

number of agencies, and establishments and have expertise=20

in-
 
Developing highly effective corporate websites, HTML5=20

designs,
E- Commerce/Online Web Stores to name a =

few.
 
PHP,=20

MySQL, ASP.NET,MS SQL SERVER 2005 or2008,Dotnetnuke, Magento, Joomla, =

Wordpress,=20

Perl, Drupal, JSP, HTML, CSS,
 
Design- Flash, Photoshop, =

Corel,=20

E-Commerce - OS Commerce, Zen Cart, Virtue Mart, Pay Pal , FedEx and any =



checkout payment gateway systems with maintenance of any kind =

application or=20

website.
 
 
Do let me know if you are interested and =

I would=20

be happy to share our Methodologies, past work details and client =

Testimonials=20

and Prices.
 
 
Truly,


 


Aditya


 


Business Development=20

Consultant




------=_NextPart_000_5565_01CE984F.B990B570--







More Indian Google Spam

Posted by Dave Yadallee on
From - Tue Aug 13 07:02:06 2013

X-Account-Key: account1

X-UIDL: 000023c54f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 05:38:29 -0600

Received: from mail-pd0-f193.google.com ([209.85.192.193])

by doctor.nl2k.ab.ca with esmtps (TLSv1:RC4-SHA:128)

(Exim 4.80.1)

(envelope-from )

id 1V9Cvi-00002w-Ez

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 05:38:29 -0600

Received: by mail-pd0-f193.google.com with SMTP id v10so2376904pde.0

for ; Tue, 13 Aug 2013 04:38:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20120113;

h=message-id:reply-to:from:to:subject:date:mime-version:content-type;

bh=/noZORNX9t3rtH2YBLi1cdf34hzj9NO2WnSxnSb70G8=;

b=CmCkzVsXb+MNYmmt8kkcRHofFAGHzZsSvLCBKAKfWcobZX65UAwIzWHVRD8qlRts1k

u74fG1NXF2PTkwG8BF6CvbJWb7IQ1vBvBSrykQP+0EBGFwKhVB4O0QxWZigo/l6SzFAq

4a19mT4d5jnqJwQfD4M1paHqEyeSGPun8+Bzu4ekR5BkW7FN/dbPu6AMwanOQGfzINWm

mcgUeYL7GKtALd+euvOktSsc/CnBx8bR5n1Y3J6v53PnDU2c1r6nkblc07JKe8760eNF

LRStYlaNuq50JpOmT2gZBSUCNBLct4u1Z3cWYJKfhTkSN38BIDnWyLFo4dF1xom/Nra8

bk+Q==

X-Received: by 10.66.192.8 with SMTP id hc8mr4017192pac.66.1376393901948;

Tue, 13 Aug 2013 04:38:21 -0700 (PDT)

Received: from computer1 ([122.160.94.159])

by mx.google.com with ESMTPSA id sz6sm46249988pab.5.2013.08.13.04.38.19

for

(version=TLSv1 cipher=RC4-SHA bits=128/128);

Tue, 13 Aug 2013 04:38:21 -0700 (PDT)

Message-ID:

Reply-To: "Riya"

From: "Riya"

To:

Subject: Web Design Services With Affordable price

Date: Tue, 13 Aug 2013 17:08:19 +0530

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_29AD_01CE9847.B53F5650"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5512

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512

X-Antivirus: AVG for E-mail 10.0.1432 [3211/6073]

X-AVG-ID: ID43CB7403-696AE176



This is a multi-part message in MIME format.



------=_NextPart_000_29AD_01CE9847.B53F5650

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Dear Sir=5CMadam



Hope you are doing well.



We are a INDIA based Web Services company with primary focus on Website Des=

igning & Development.



We have experienced professionals to work on PHP and other Open Source Plat=

forms.



In Graphic/Flash/3D designs, we thrive on the idea that design makes a diff=

erence. We can provide you with a fresh, professional image via a

recognizable trademark or logo design.



Our design team can work closely with you as part of your marketing staff a=

nd will seek out your company's needs to create a unified message for your

=



business.



We customize our processes and reports based on client's styles and guideli=

nes.



We NEVER contact your end client in case if you are agency client and sign =

up the NDAs with you.



Most firms overseas have achieved a significant amount of savings by outsou=

rcing either complete or part of their work to us in India.



I would like to request you for an opportunity to work and AMAZE you with o=

ur service.



We wish you the best of luck and looking forward to a long and healthy busi=

ness relationship with you and your company.



If you have any query, we will be more than happy to provide you our quick =

assistance.





Kind & Regards,

Riya



P.S. This is an advertisement and a promotional mail strictly on the guidel=

ines of CAN-SPAM act of 2007. We have clearly mentioned



the source mail-id of this mail, also clearly mentioned the subject lines a=

nd they are in no way misleading in any form. We have found



your mail address through our own efforts on the web search and not through=

any illegal way. If you find this mail unsolicited, please



reply with "Remove" in the subject line and we will take care that you do n=

ot receive any further promotional mail.





-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3211/6073 - Release Date: 08/12/13



------=_NextPart_000_29AD_01CE9847.B53F5650

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








>









 


Dear Sir=5CMadam
 
Hope you are=

doing

well.
 
We are a INDIA based Web Services company with primary f=

ocus

on Website Designing & Development.
 
We have experienced

professionals to work on PHP and other Open Source Platforms.
 
=

In

Graphic/Flash/3D designs, we thrive on the idea that design makes a differe=

nce.

We can provide you with a fresh, professional image via a
recognizable

=



trademark or logo design.
 
Our design team can work closely wit=

h you

as part of your marketing staff and will seek out your company's needs to c=

reate

a unified message for your
business.
 
We customize our proce=

sses

and reports based on client's styles and guidelines.
 
We NEVER =



contact your end client in case if you are agency client and sign up the ND=

As

with you.
 
Most firms overseas have achieved a significant amou=

nt of

savings by outsourcing either complete or part of their work to us in

India.
 
I would like to request you for an opportunity to work =

and

AMAZE you with our service.
 
We wish you the best of luck and

=



looking forward to a long and healthy business relationship with you and yo=

ur

company.
 
If you have any query, we will be more than happy to =



provide you our quick assistance.
 


 


Kind & Regards,
 Riya
 =

;
P.S.

This is an advertisement and a promotional mail strictly on the guidelines =

of

CAN-SPAM act of 2007. We have clearly mentioned
 
the source mai=

l-id

of this mail, also clearly mentioned the subject lines and they are in no w=

ay

misleading in any form. We have found
 
your mail address throug=

h our

own efforts on the web search and not through any illegal way. If you find =

this

mail unsolicited, please
 
reply with "Remove" in the subject li=

ne

and we will take care that you do not receive any further promotional

mail.


=3D"avgcert" align=3D"left" color=3D"#000000">No virus found in this messag=

e.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3211/6073 - Release Date: 08/12/13

=







------=_NextPart_000_29AD_01CE9847.B53F5650--







More Google spam

Posted by Dave Yadallee on
From - Tue Aug 13 07:01:49 2013

X-Account-Key: account1

X-UIDL: 000023a84f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Aug 2013 17:05:09 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.80.1)

(envelope-from )

id 1V91AT-0001gj-8Q

for dave@doctor.nl2k.ab.ca; Mon, 12 Aug 2013 17:04:53 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Mon, 12 Aug 2013 17:04:53 -0600

Resent-Message-ID: <20130812230453.GE4181@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

Received: from mail-lb0-f194.google.com ([209.85.217.194])

by doctor.nl2k.ab.ca with esmtps (TLSv1:RC4-SHA:128)

(Exim 4.80.1)

(envelope-from )

id 1V90H1-0004NI-4y

for doctor@doctor.nl2k.ab.ca; Mon, 12 Aug 2013 16:07:38 -0600

Received: by mail-lb0-f194.google.com with SMTP id t13so2228198lbd.1

for ; Mon, 12 Aug 2013 15:07:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20120113;

h=mime-version:date:message-id:subject:from:to:content-type;

bh=vsvvjvyv8gUwGEPnToo7guU1ht/XmNnpbF1pNc+Vq70=;

b=bZvI4AnrDqYcQ57H0R2cIEDkwcQ3Y2H3jj6ySVDZW8kFdX9IXNhWbcF0OVnAwTDuaz

k+bJQjS/um0X59SIcglJqeXlUIOcwsC7LAtz0oUEEIuHyQbi/x2ImICm8kUwY+2XgCQF

wmwEFB5z7rv2A1uviiSHnHvnGJSTmCCUn/RmZTZcWWTwp2zMGsNEobOTrWfDtGmYtP3N

vsu/ivPvGqQZ45VGO/CNDuXy7D7eW/zCXdkTk/e18RuzAsN0LCn30fMIa1CooiuGhWSL

RqqG8a5ZiA6S5QYo3V7keyORCcv9aPwnZUFFgrdc1Q+oIZSxgQzAOrmXyiJIxCOmm6bg

hfaA==

MIME-Version: 1.0

X-Received: by 10.152.3.42 with SMTP id 10mr823515laz.22.1376345248375; Mon,

12 Aug 2013 15:07:28 -0700 (PDT)

Received: by 10.112.33.14 with HTTP; Mon, 12 Aug 2013 15:07:27 -0700 (PDT)

Date: Tue, 13 Aug 2013 01:07:28 +0300

Message-ID:

Subject: I will like you to view this

From: Roger Alvernaz

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary=089e013d14b29e397704e3c759db

Bcc: doctor@doctor.nl2k.ab.ca

X-Antivirus: AVG for E-mail 10.0.1432 [3211/6073]

X-AVG-ID: ID3A769756-5F00382C



--089e013d14b29e397704e3c759db

Content-Type: text/plain; charset=ISO-8859-1



How are you doing, i just found this piece of information online.. i would

like you to see it . i have uploaded it on Gallery Trade,CLICK

HERE,

i hope that this information would interest you .... because it has been to

me ...



Thanks







-----

No virus found in this message.

Checked by AVG - www.avg.com

Version: 10.0.1432 / Virus Database: 3211/6073 - Release Date: 08/12/13

--089e013d14b29e397704e3c759db

Content-Type: text/html; charset=ISO-8859-1



How are you doing, i just found this piece of information online.. i

would like you to see it . i have uploaded it on Gallery Trade,CLICK HERE, i hope that this information would interest you .... because it has been to me ...



Thanks




No virus found in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3211/6073 - Release Date: 08/12/13

--089e013d14b29e397704e3c759db--







More Indian Google Spam

Posted by Dave Yadallee on
From - Tue Aug 13 07:01:46 2013

X-Account-Key: account1

X-UIDL: 0000239b4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path: <3tzUJUg0JBNwAJ8SBCBSICZZfEK8GJ.AMKB8TCBMARMP.LJaI.89.A8@calendar-server.bounces.google.com>

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 12 Aug 2013 13:21:41 -0600

Received: from mail-ye0-f201.google.com ([209.85.213.201])

by doctor.nl2k.ab.ca with esmtps (TLSv1:RC4-SHA:128)

(Exim 4.80.1)

(envelope-from <3tzUJUg0JBNwAJ8SBCBSICZZfEK8GJ.AMKB8TCBMARMP.LJaI.89.A8@calendar-server.bounces.google.com>)

id 1V8xgL-000714-FF

for dave@doctor.nl2k.ab.ca; Mon, 12 Aug 2013 13:21:41 -0600

Received: by mail-ye0-f201.google.com with SMTP id m14so725287yen.2

for ; Mon, 12 Aug 2013 12:21:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20120113;

h=mime-version:reply-to:sender:auto-submitted:message-id:date:subject

:from:to:content-type;

bh=Bz1yWVBzw+x8aKsqU8KLTXFsRM8j5YIa7iR/QleNLoU=;

b=SBQlPQ2HbYahCKNwo2ZRtYq6pAYJ351g7KsNmkthRHUNG+4xnfb0oJonSsYex00jUo

p0y3F2btXIuacMKdCAl3+85S+j3zqmRIeZo61X0pAsHQvH1TQxBnymV5aBRDagtiS9IX

O8SrK6EmJCYh0T/dd2cysQhg7er8IozkqIAshVhsqmyA9rnefqmFDX0BAukwqMBulMpK

jAB13KuSwmAHgD5gJ2KSDaHyGobfATnHP6RMwV/CvgNSQ7KtSqM9VSuUQ0vriJxAbRTO

xUXP0VXngCl72I+u8Aef6UDRBubdLQ/H3BP+OsM5UH01GTZpwls5Ft94L9BBSWB0AM+M

IuvA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20120113;

h=mime-version:reply-to:sender:auto-submitted:message-id:date:subject

:from:to:content-type;

bh=Bz1yWVBzw+x8aKsqU8KLTXFsRM8j5YIa7iR/QleNLoU=;

b=RM4hohyKThsScWum1+Vg2AwWF8h1bhkJHPACJDSeoYb83GUcjEEzKZjQyUNf5l0Krc

ElSx2ZgYUvQhaL5tQLW26aEqt+QJ2Qr43pSif49xWU1ZcfuOhWQ3ylwT4Iy9SnUlVoWa

535b0FO4yU/MYyeA2ntt6JhqDp8Y7h2ZtVp43kxcrXBbCtYAdRjABZu1sUG024qAZ2g6

5qZACzuJ+s/VXJhVgkzpd5WpGX7aX6XnxBkvC1ld4a65AkUV01fl+cMquTElpxmk08Je

n6Ka6y5Q+UVkDNnvsGJiQqO92IA883nHMU8V+0ipKg/jdQXY21klqc3MHbQqR8v3yoYq

MQlQ==

MIME-Version: 1.0

X-Received: by 10.58.117.4 with SMTP id ka4mr61069veb.24.1376335287349; Mon,

12 Aug 2013 12:21:27 -0700 (PDT)

Reply-To: Lucy Farouk

Sender: Google Calendar

Auto-Submitted: auto-generated

Message-ID: <047d7bfeb466e4fcae04e3c5073b@google.com>

Date: Mon, 12 Aug 2013 19:21:27 +0000

Subject: Invitation: Dear trusted one @ Mon 12 Aug 2013 15:30 - 16:30 (Mrs

Lucy Farouk)

From: Lucy Farouk

To: "dave@doctor.nl2k.ab.ca"

Content-Type: multipart/mixed; boundary=047d7bfeb466e4fca204e3c5073a

X-Antivirus: AVG for E-mail 10.0.1432 [3211/6073]

X-AVG-ID: ID6E3D6AD8-32660A47



--047d7bfeb466e4fca204e3c5073a

Content-Type: multipart/alternative; boundary=047d7bfeb466e4fc9d04e3c50738



--047d7bfeb466e4fc9d04e3c50738

Content-Type: text/plain; charset=windows-1252; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WW91IGhhdmUgYmVlbiBpbnZpdGVkIHRvIHRoZSBmb2xsb3dpbmcgZXZlbnQuDQoNClRpdGxlOiBE

ZWFyIHRydXN0ZWQgb25lDQpEZWFyIHRydXN0ZWQgb25lLA0KDQpJIHNlbnQgdGhpcyBtYWlsIGhv

cGluZyB0aGF0IGl0IHJlYWNoZXMgeW91IGluIGdvb2QgaGVhbHRoIGJlY2F1c2UgSSBteXNlbGYg

IA0KYW0gaW4gYSB2ZXJ5IGNyaXRpY2FsIGhlYWx0aCBjb25kaXRpb24gaW4gd2hpY2ggSSBnbyB0

byBiZWQgZXZlcnkgbmlnaHQgIA0Ka25vd2luZyBJIG1heSBub3QgYmUgYWxpdmUgdG8gc2VlIHRo

ZSBuZXh0IGRheS4gSSBhbSBNcnMgTHVjeSBGYXJvdWsgZnJvbSAgDQpMaWJ5YSBidXQgSSdtIGNv

bnRhY3RpbmcgeW91IGZyb20gYSBob3NwaXRhbCBiZWQgd2hlcmUgSSB3cm90ZSB0aGlzIG1haWwg

aW4gIA0KdGVhcnMgaG9waW5nIHRvIGxldCB5b3Uga25vdyBvZiBteSBvcmRlYWwuIE15IGh1c2Jh

bmQgd2hvIHVudGlsIGhpcyBkZWF0aCAgDQppbiBPY3RvYmVyIDIwMDUgd2FzIGEgc2VjcmV0IGFn

ZW50IHRvIHRoZSBub3cgbGF0ZSBwcmVzaWRlbnQgTXVhbW1hciAgDQpHYWRkYWZpIG9mIExpYnlh

LiBXZSB3ZXJlIG1hcnJpZWQgZm9yIDE1IHllYXJzIHdpdGhvdXQgYSBjaGlsZCBkdWUgdG8gbXkg

IA0KZmlicm9pZCBwcm9ibGVtLiBNeSBodXNiYW5kIGRpZWQgaW4gaGlzIG9mZmljZSBpbiBCdXJr

aW5hIEZhc28gYXMgYSByZXN1bHQgIA0Kb2YgaGVhcnQgYXR0YWNrIGFuZCBJIG1hZGUgYSBkZWNp

c2lvbiB0byBsaXZlIG91dCB0aGUgcmVzdCBvZiBteSBsaWZlIGFzICANCmhpcyB3aWRvdy4NCg0K

VmVyeSBzaG9ydGx5IGJlZm9yZSBteSBodXNiYW5kknMgZGVhdGgsIGhlIG1hZGUgYSBkZXBvc2l0

IG9mICgkMTEpIE1pbGxpb24gIA0KRG9sbGFycy4gSGUgZGVwb3NpdGVkIHRoZSBtb25leSBpbiBo

aXMgbmFtZSBhcyBwcm9jZWVkcyBmcm9tIGFuIG9pbCAgDQpjb250cmFjdCwgYnV0IHRoZSBmdW5k

IHdhcyBhY3R1YWxseSwgYW4gaW5pdGlhbCBwYXltZW50IGZvciBhIHNlY3JldCBhcm0gIA0KZGVh

bCBoZSB3YXMgYnJva2VyaW5nIGZvciBoaXMgdGhlbiBtYXN0ZXIgR2FkZGFmaSBhbmQgdGhlIGdv

dmVybm1lbnQgb2YgIA0KTm9ydGggS29yZWEuIE5vdyB3aXRoIHRoZSBkZWF0aHMgb2YgbXkgaHVz

YmFuZCBhbmQgdGhhdCBvZiBQcmVzaWRlbnQgIA0KTXVhbW1hciBHYWRkYWZpIGR1cmluZyB0aGUg

Y3Jpc2lzIGluIExpYnlhLCBJJ20gbm93IHRoZSBvbmx5IG9uZSB3aG8ga25vd3MgIA0Kb2YgdGhp

cyBwYXJ0aWN1bGFyIGZ1bmQgYW5kIHByZXNlbnRseSBJJ20gaW4gdGhpcyBob3NwaXRhbCBiZWQg

ZHlpbmcgb2YgIA0KY2FuY2VyIHNpbmNlIHRoZSBkb2N0b3IgaGFzIG1hZGUgaXQgY2xlYXIgdGhh

dCBJJ20gbm8gbG9uZ2VyIHJlc3BvbmRpbmcgdG8gIA0KbWVkaWNhdGlvbnMsIGluZGljYXRpbmcg

dGhhdCBJIHdpbGwgbm90IGJlIGxpdmluZyBtdWNoIGxvbmdlciwgYnV0IEkgd2lsbCAgDQpyYXRo

ZXIgZGllIGluIHRoaXMgaG9zcGl0YWwgdGhhbiBnbyBob21lIGFuZCBmYWNlIG1vcmUgaW5zdWx0

cyBhbmQgIA0KaHVtaWxpYXRpb24gZnJvbSBteSBodXNiYW5kIHJlbGF0aXZlcyB3aG8gdG9vayBh

d2F5IGFsbCBteSBtb25leSBhbmQgamV3ZWxzICANCmFuZCBsZWZ0IG1lIHVuY2FyZWQtZm9yIGp1

c3QgYmVjYXVzZSBJkm0gYW4gb3JwaGFuLg0KDQpIYXZpbmcgY29uc2lkZXJlZCBteSBwb3NpdGlv

biwgSSBoYXZlIGRlY2lkZWQgdG8gdXNlIHlvdSB0byBjYXJyeSBvdXQgbXkgIA0KcGxhbi4gSSB3

aWxsIGd1aWRlIHlvdSB0byByZWNlaXZlIHRoZSAoJDExKSBNaWxsaW9uIERvbGxhcnMgZnJvbSB0

aGUgYmFuayAgDQppbiBCdXJraW5hIEZhc28gYW5kIHlvdSB3aWxsIHRha2UgMzAlIG9mIGl0IGZv

ciB5b3Vyc2VsZiBhbmQgeW91ciBmYW1pbHkgIA0Kd2hpbGUgeW91IHdpbGwgdXNlIHRoZSBvdGhl

ciA3MCUgYW5kIGJ1aWxkIGFuIG9ycGhhbmFnZSBob21lIGZvciB0aGUgIA0KbW90aGVybGVzcyBj

aGlsZHJlbiBpbiB5b3VyIGxvY2F0aW9uIG9yIGFueXdoZXJlIG9mIHlvdXIgY2hvaWNlLiBUaGlz

IGlzICANCmJlY2F1c2UgSSdtIGFuIG9ycGhhbiBhbmQgZG9lcyBub3QgaGF2ZSBhbnkgcmVsYXRp

dmUuIFRoaXMgaGFzIGJlZW4gbXkgd2lzaCAgDQpiZWZvcmUgdGhpcyBzaWNrbmVzcyBjYW1lIGJl

dHdlZW4gbXkgcGxhbnMuIFBsZWFzZSB5b3UgbXVzdCBmb2xsb3cgdGhpcyAgDQpkaXJlY3RpdmUg

b3IgSSB3aWxsIGxvb2sgZm9yIGFub3RoZXIgcGVyc29uLiBUaGUgb25seSByZWFzb24gSSB3aWxs

IG5vdCAgDQplbnRydXN0IHRoZSBmdW5kIGFuZCBwcm9qZWN0IHRvIHNvbWVvbmUgYXJvdW5kIGhl

cmUgaXMgYmVjYXVzZSBJJ20gbWFraW5nICANCml0IGEgdG9wIHNlY3JldCBzbyB0aGF0IHRoZSBu

ZXdzIGRvZXNuknQgZ2V0IHRvIG15IGh1c2JhbmQgcmVsYXRpdmVzIHdobyAgDQp3aWxsIG5vdCBh

bGxvdyB0aGUgZnVuZCB0byBiZSB1c2VkIGZvciBodW1hbml0YXJpYW4gd29yayBidXQgd2lsbCBx

dWlja2x5ICANCmNvbmZpc2NhdGUgdGhlIG1vbmV5IGFuZCBoYXZlIGl0IHNoYXJlZCBhbW9uZ3N0

IHRoZW0uDQoNCkhvd2V2ZXIsIGlmIHlvdSBhcmUgbm90IGNhcGFibGUgb2YgaGFuZGxpbmcgdGhp

cyB0YXNrIG9yIHlvdSBkbyBub3QgaGF2ZSAgDQpjb25maWRlbmNlIGluIHRoaXMgbWVzc2FnZSwg

cGxlYXNlIGtpbmRseSBkZWxldGUgaXQgYW5kIGFjY2VwdCBteSBzaW5jZXJlICANCmFwb2xvZ3kg

Zm9yIGNvbnRhY3RpbmcgeW91IGluIHRoaXMgbWFubmVyLCBidXQgaWYgeW91IGhhdmUgY29uZmlk

ZW5jZSBpbiBpdCAgDQphbmQgY2FuIGhhbmRsZSB0aGUgdGFzayB0aGVuIGtpbmRseSBpbmRpY2F0

ZSBieSByZXNwb25kaW5nLg0KDQpIZXJlIGlzIG15IGVtYWlsIGFkZHJlc3MgKGx1Y3lmYXJvdWtA

eWFob28uY29tKQ0KDQpUaGFua3MgYW5kIGJlIEJsZXNzZWQuDQoNCk1ycy4gTHVjeSBGYXJvdWsu

DQoNCg0KDQoNCldoZW46IE1vbiAxMiBBdWcgMjAxMyAxNTozMCCWIDE2OjMwIEVhc3Rlcm4gVGlt

ZQ0KQ2FsZW5kYXI6IE1ycyBMdWN5IEZhcm91aw0KV2hvOg0KICAgICAoR3Vlc3QgbGlzdCBpcyB0

b28gbGFyZ2UgdG8gZGlzcGxheSkNCg0KRXZlbnQgZGV0YWlsczogIA0KaHR0cHM6Ly93d3cuZ29v

Z2xlLmNvbS9jYWxlbmRhci9ldmVudD9hY3Rpb249VklFVyZlaWQ9YzJsbmNHdzRORGc0TTJwMWEy

Rm5NSEJ0YzJvek1qQmpiVGdnWkdGMlpVQmtiMk4wYjNJdWJtd3lheTVoWWk1allRJnRvaz1Nak1q

WTJ4aGRXUmxaSFZyWlRFeE4wQm5iV0ZwYkM1amIyMDVNRGs0WXpsbE4ySmpNamhpT0dFMFpEazRO

VGRrTm1ZeVltSTVNR1UyTW1VMVpETmtNREU0JmN0ej1BbWVyaWNhL05ld19Zb3JrJmhsPWVuX0dC

DQoNCkludml0YXRpb24gZnJvbSBHb29nbGUgQ2FsZW5kYXI6IGh0dHBzOi8vd3d3Lmdvb2dsZS5j

b20vY2FsZW5kYXIvDQoNCllvdSBhcmUgcmVjZWl2aW5nIHRoaXMgY291cnRlc3kgZW1haWwgYXQg

dGhlIGFjY291bnQgZGF2ZUBkb2N0b3Iubmwyay5hYi5jYSAgDQpiZWNhdXNlIHlvdSBhcmUgYW4g

YXR0ZW5kZWUgb2YgdGhpcyBldmVudC4NCg0KVG8gc3RvcCByZWNlaXZpbmcgZnV0dXJlIG5vdGlm

aWNhdGlvbnMgZm9yIHRoaXMgZXZlbnQsIGRlY2xpbmUgdGhpcyBldmVudC4gIA0KQWx0ZXJuYXRp

dmVseSwgeW91IGNhbiBzaWduIHVwIGZvciBhIEdvb2dsZSBhY2NvdW50IGF0ICANCmh0dHBzOi8v

d3d3Lmdvb2dsZS5jb20vY2FsZW5kYXIvIGFuZCBjb250cm9sIHlvdXIgbm90aWZpY2F0aW9uIHNl

dHRpbmdzIGZvciAgDQp5b3VyIGVudGlyZSBjYWxlbmRhci4NCg==

--047d7bfeb466e4fc9d04e3c50738

Content-Type: text/html; charset=windows-1252

Content-Transfer-Encoding: quoted-printable




mary=3D"" style=3D"width:100%;font-family:Arial,Sans-serif;border:1px Solid=

#ccc;border-width:1px 2px 2px 1px;background-color:#fff;" itemscope itemty=

pe=3D"http://schema.org/Event">

mprop=3D"publisher" itemscope itemtype=3D"http://schema.org/Organization"><=

meta itemprop=3D"name" content=3D"Google Calendar"/>


y:Arial,Sans-serif;font-size:16px;font-weight:bold;color:#222">
op=3D"name">Dear trusted one


ont-size:13px;color:#222;white-space:pre-wrap!important;white-space:-moz-pr=

e-wrap!important;white-space:-pre-wrap!important;white-space:-o-pre-wrap!im=

portant;white-space:pre;word-wrap:break-word">Dear trusted one,

I sent th=

is mail hoping that it reaches you in good health because I myself am in a =

very critical health condition in which I go to bed every night knowing I m=

ay not be alive to see the next day. I am Mrs Lucy Farouk from Libya but I&=

#39;m contacting you from a hospital bed where I wrote this mail in tears h=

oping to let you know of my ordeal. My husband who until his death in Octob=

er 2005 was a secret agent to the now late president Muammar Gaddafi of Lib=

ya. We were married for 15 years without a child due to my fibroid problem.=

My husband died in his office in Burkina Faso as a result of heart attack =

and I made a decision to live out the rest of my life as his widow.

Very =

shortly before my husband=92s death, he made a deposit of ($11) Million Dol=

lars. He deposited the money in his name as proceeds from an oil contract, =

but the fund was actually, an initial payment for a secret arm deal he was =

brokering for his then master Gaddafi and the government of North Korea. No=

w with the deaths of my husband and that of President Muammar Gaddafi durin=

g the crisis in Libya, I'm now the only one who knows of this particula=

r fund and presently I'm in this hospital bed dying of cancer since the=

doctor has made it clear that I'm no longer responding to medications,=

indicating that I will not be living much longer, but I will rather die in=

this hospital than go home and face more insults and humiliation from my h=

usband relatives who took away all my money and jewels and left me uncared-=

for just because I=92m an orphan.

Having considered my position, I have d=

ecided to use you to carry out my plan. I will guide you to receive the ($1=

1) Million Dollars from the bank in Burkina Faso and you will take 30% of i=

t for yourself and your family while you will use the other 70% and build a=

n orphanage home for the motherless children in your location or anywhere o=

f your choice. This is because I'm an orphan and does not have any rela=

tive. This has been my wish before this sickness came between my plans. Ple=

ase you must follow this directive or I will look for another person. The o=

nly reason I will not entrust the fund and project to someone around here i=

s because I'm making it a top secret so that the news doesn=92t get to =

my husband relatives who will not allow the fund to be used for humanitaria=

n work but will quickly confiscate the money and have it shared amongst the=

m.

However, if you are not capable of handling this task or you do not ha=

ve confidence in this message, please kindly delete it and accept my sincer=

e apology for contacting you in this manner, but if you have confidence in =

it and can handle the task then kindly indicate by responding.

Here is m=

y email address (=

lucyfarouk@yahoo.com)

Thanks and be Blessed.

Mrs. Lucy Farouk.


>


cing=3D"0" border=3D"0" summary=3D"Event details"><=

/tr>

0 1em 10px 0;font-family:Arial,Sans-serif;font-size:13px;color:#888;white-s=

pace:nowrap" valign=3D"top">
When
iv>

size:13px;color:#222" valign=3D"top">Mon 12 Aug 2013 15:30 =96 16:30
">Eastern Time

amily:Arial,Sans-serif;font-size:13px;color:#888;white-space:nowrap" valign=

=3D"top">
Calendar

le=3D"padding-bottom:10px;font-family:Arial,Sans-serif;font-size:13px;color=

:#222" valign=3D"top">Mrs Lucy Farouk

em 10px 0;font-family:Arial,Sans-serif;font-size:13px;color:#888;white-spac=

e:nowrap" valign=3D"top">
Who
<=

/td>
:13px;color:#222" valign=3D"top">(Guest list is too large to display)


le=3D"color:#888">Going?   
p=3D"action" itemscope itemtype=3D"http://schema.org/RsvpAction">
prop=3D"attendance" content=3D"http://schema.org/RsvpAttendance/Yes"/>
itemprop=3D"handler" itemscope itemtype=3D"http://schema.org/HttpActionHan=

dler">
/GET"/>
p;eid=3Dc2lncGw4NDg4M2p1a2FnMHBtc2ozMjBjbTggZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&=

amp;rst=3D1&tok=3DMjMjY2xhdWRlZHVrZTExN0BnbWFpbC5jb205MDk4YzllN2JjMjhiO=

GE0ZDk4NTdkNmYyYmI5MGU2MmU1ZDNkMDE4&ctz=3DAmerica/New_York&hl=3Den_=

GB" style=3D"color:#20c;white-space:nowrap" itemprop=3D"url">Yes=

-
emprop=3D"action" itemscope itemtype=3D"http://schema.org/RsvpAction">
itemprop=3D"attendance" content=3D"http://schema.org/RsvpAttendance/Maybe"=

/>
tionHandler">
tMethod/GET"/>
POND&eid=3Dc2lncGw4NDg4M2p1a2FnMHBtc2ozMjBjbTggZGF2ZUBkb2N0b3Iubmwyay5h=

Yi5jYQ&rst=3D3&tok=3DMjMjY2xhdWRlZHVrZTExN0BnbWFpbC5jb205MDk4YzllN2=

JjMjhiOGE0ZDk4NTdkNmYyYmI5MGU2MmU1ZDNkMDE4&ctz=3DAmerica/New_York&h=

l=3Den_GB" style=3D"color:#20c;white-space:nowrap" itemprop=3D"url">Maybe
a> -
>
on">
ce/No"/>
HttpActionHandler">
RequestMethod/GET"/>
=3DRESPOND&eid=3Dc2lncGw4NDg4M2p1a2FnMHBtc2ozMjBjbTggZGF2ZUBkb2N0b3Iubm=

wyay5hYi5jYQ&rst=3D2&tok=3DMjMjY2xhdWRlZHVrZTExN0BnbWFpbC5jb205MDk4=

YzllN2JjMjhiOGE0ZDk4NTdkNmYyYmI5MGU2MmU1ZDNkMDE4&ctz=3DAmerica/New_York=

&hl=3Den_GB" style=3D"color:#20c;white-space:nowrap" itemprop=3D"url">N=

o    
/www.google.com/calendar/event?action=3DVIEW&eid=3Dc2lncGw4NDg4M2p1a2Fn=

MHBtc2ozMjBjbTggZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&tok=3DMjMjY2xhdWRlZHVrZT=

ExN0BnbWFpbC5jb205MDk4YzllN2JjMjhiOGE0ZDk4NTdkNmYyYmI5MGU2MmU1ZDNkMDE4&=

ctz=3DAmerica/New_York&hl=3Den_GB" style=3D"color:#20c;white-space:nowr=

ap">more options »


:#f6f6f6;color:#888;border-top:1px Solid #ccc;font-family:Arial,Sans-serif;=

font-size:11px">

Invitation from
ar/" target=3D"_blank" style=3D"">Google Calendar

You are receivi=

ng this courtesy email at the account dave@doctor.nl2k.ab.ca because you ar=

e an attendee of this event.

To stop receiving future notifications f=

or this event, decline this event. Alternatively, you can sign up for a Goo=

gle account at https://www.google.com/calendar/ and control your notificati=

on settings for your entire calendar.



--047d7bfeb466e4fc9d04e3c50738

Content-Type: text/calendar; charset=UTF-8; method=REQUEST

Content-Transfer-Encoding: quoted-printable



BEGIN:VCALENDAR

PRODID:-//Google Inc//Google Calendar 70.9054//EN

VERSION:2.0

CALSCALE:GREGORIAN

METHOD:REQUEST

BEGIN:VEVENT

DTSTART:20130812T193000Z

DTEND:20130812T203000Z

DTSTAMP:20130812T192127Z

ORGANIZER;CN=3Dclaudeduke117@gmail.com:mailto:claudeduke117@gmail.com

UID:sigpl84883jukag0pmsj320cm8@google.com

ATTENDEE;CUTYPE=3DINDIVIDUAL;ROLE=3DREQ-PARTICIPANT;PARTSTAT=3DNEEDS-ACTION=

;RSVP=3D

TRUE;CN=3Ddave@doctor.nl2k.ab.ca;X-NUM-GUESTS=3D0:mailto:dave@doctor.nl2k.=

ab.ca

CREATED:20130812T192125Z

DESCRIPTION:Dear trusted one\,\n\nI sent this mail hoping that it reaches y

ou in good health because I myself am in a very critical health condition =

i

n which I go to bed every night knowing I may not be alive to see the next=

=20

day. I am Mrs Lucy Farouk from Libya but I'm contacting you from a hospita=

l

bed where I wrote this mail in tears hoping to let you know of my ordeal.=

=20

My husband who until his death in October 2005 was a secret agent to the n=

o

w late president Muammar Gaddafi of Libya. We were married for 15 years wi=

t

hout a child due to my fibroid problem. My husband died in his office in B=

u

rkina Faso as a result of heart attack and I made a decision to live out t=

h

e rest of my life as his widow.\n\nVery shortly before my husband=E2=80=99=

s death\,

he made a deposit of ($11) Million Dollars. He deposited the money in his=

=20

name as proceeds from an oil contract\, but the fund was actually\, an ini=

t

ial payment for a secret arm deal he was brokering for his then master Gad=

d

afi and the government of North Korea. Now with the deaths of my husband a=

n

d that of President Muammar Gaddafi during the crisis in Libya\, I'm now t=

h

e only one who knows of this particular fund and presently I'm in this hos=

p

ital bed dying of cancer since the doctor has made it clear that I'm no lo=

n

ger responding to medications\, indicating that I will not be living much =

l

onger\, but I will rather die in this hospital than go home and face more =

i

nsults and humiliation from my husband relatives who took away all my mone=

y

and jewels and left me uncared-for just because I=E2=80=99m an orphan.\n\=

nHaving c

onsidered my position\, I have decided to use you to carry out my plan. I =

w

ill guide you to receive the ($11) Million Dollars from the bank in Burkin=

a

Faso and you will take 30% of it for yourself and your family while you w=

i

ll use the other 70% and build an orphanage home for the motherless childr=

e

n in your location or anywhere of your choice. This is because I'm an orph=

a

n and does not have any relative. This has been my wish before this sickne=

s

s came between my plans. Please you must follow this directive or I will l=

o

ok for another person. The only reason I will not entrust the fund and pro=

j

ect to someone around here is because I'm making it a top secret so that t=

h

e news doesn=E2=80=99t get to my husband relatives who will not allow the =

fund to b

e used for humanitarian work but will quickly confiscate the money and hav=

e

it shared amongst them.\n\nHowever\, if you are not capable of handling t=

h

is task or you do not have confidence in this message\, please kindly dele=

t

e it and accept my sincere apology for contacting you in this manner\, but=

=20

if you have confidence in it and can handle the task then kindly indicate =

b

y responding. \n\nHere is my email address (lucyfarouk@yahoo.com)\n\nThank=

s

and be Blessed.\n\nMrs. Lucy Farouk.\n\n\n\n\nView your event at http://w=

w

w.google.com/calendar/event?action=3DVIEW&eid=3Dc2lncGw4NDg4M2p1a2FnMHBtc2=

ozMjB

jbTggZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ&tok=3DMjMjY2xhdWRlZHVrZTExN0BnbWFpbC5j=

b20

5MDk4YzllN2JjMjhiOGE0ZDk4NTdkNmYyYmI5MGU2MmU1ZDNkMDE4&ctz=3DAmerica/New_Yo=

rk&

hl=3Den_GB.

LAST-MODIFIED:20130812T192126Z

LOCATION:

SEQUENCE:0

STATUS:CONFIRMED

SUMMARY:Dear trusted one

TRANSP:OPAQUE

END:VEVENT

END:VCALENDAR



--047d7bfeb466e4fc9d04e3c50738--



--047d7bfeb466e4fca204e3c5073a

Content-Type: application/ics; name="invite.ics"

Content-Disposition: attachment; filename="invite.ics"

Content-Transfer-Encoding: base64



QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vR29vZ2xlIEluYy8vR29vZ2xlIENhbGVuZGFyIDcw

LjkwNTQvL0VODQpWRVJTSU9OOjIuMA0KQ0FMU0NBTEU6R1JFR09SSUFODQpNRVRIT0Q6UkVRVUVT

VA0KQkVHSU46VkVWRU5UDQpEVFNUQVJUOjIwMTMwODEyVDE5MzAwMFoNCkRURU5EOjIwMTMwODEy

VDIwMzAwMFoNCkRUU1RBTVA6MjAxMzA4MTJUMTkyMTI3Wg0KT1JHQU5JWkVSO0NOPWNsYXVkZWR1

a2UxMTdAZ21haWwuY29tOm1haWx0bzpjbGF1ZGVkdWtlMTE3QGdtYWlsLmNvbQ0KVUlEOnNpZ3Bs

ODQ4ODNqdWthZzBwbXNqMzIwY204QGdvb2dsZS5jb20NCkFUVEVOREVFO0NVVFlQRT1JTkRJVklE

VUFMO1JPTEU9UkVRLVBBUlRJQ0lQQU5UO1BBUlRTVEFUPU5FRURTLUFDVElPTjtSU1ZQPQ0KIFRS

VUU7Q049ZGF2ZUBkb2N0b3Iubmwyay5hYi5jYTtYLU5VTS1HVUVTVFM9MDptYWlsdG86ZGF2ZUBk

b2N0b3Iubmwyay5hYi5jYQ0KQ1JFQVRFRDoyMDEzMDgxMlQxOTIxMjVaDQpERVNDUklQVElPTjpE

ZWFyIHRydXN0ZWQgb25lXCxcblxuSSBzZW50IHRoaXMgbWFpbCBob3BpbmcgdGhhdCBpdCByZWFj

aGVzIHkNCiBvdSBpbiBnb29kIGhlYWx0aCBiZWNhdXNlIEkgbXlzZWxmIGFtIGluIGEgdmVyeSBj

cml0aWNhbCBoZWFsdGggY29uZGl0aW9uIGkNCiBuIHdoaWNoIEkgZ28gdG8gYmVkIGV2ZXJ5IG5p

Z2h0IGtub3dpbmcgSSBtYXkgbm90IGJlIGFsaXZlIHRvIHNlZSB0aGUgbmV4dCANCiBkYXkuIEkg

YW0gTXJzIEx1Y3kgRmFyb3VrIGZyb20gTGlieWEgYnV0IEknbSBjb250YWN0aW5nIHlvdSBmcm9t

IGEgaG9zcGl0YWwNCiAgYmVkIHdoZXJlIEkgd3JvdGUgdGhpcyBtYWlsIGluIHRlYXJzIGhvcGlu

ZyB0byBsZXQgeW91IGtub3cgb2YgbXkgb3JkZWFsLiANCiBNeSBodXNiYW5kIHdobyB1bnRpbCBo

aXMgZGVhdGggaW4gT2N0b2JlciAyMDA1IHdhcyBhIHNlY3JldCBhZ2VudCB0byB0aGUgbm8NCiB3

IGxhdGUgcHJlc2lkZW50IE11YW1tYXIgR2FkZGFmaSBvZiBMaWJ5YS4gV2Ugd2VyZSBtYXJyaWVk

IGZvciAxNSB5ZWFycyB3aXQNCiBob3V0IGEgY2hpbGQgZHVlIHRvIG15IGZpYnJvaWQgcHJvYmxl

bS4gTXkgaHVzYmFuZCBkaWVkIGluIGhpcyBvZmZpY2UgaW4gQnUNCiBya2luYSBGYXNvIGFzIGEg

cmVzdWx0IG9mIGhlYXJ0IGF0dGFjayBhbmQgSSBtYWRlIGEgZGVjaXNpb24gdG8gbGl2ZSBvdXQg

dGgNCiBlIHJlc3Qgb2YgbXkgbGlmZSBhcyBoaXMgd2lkb3cuXG5cblZlcnkgc2hvcnRseSBiZWZv

cmUgbXkgaHVzYmFuZOKAmXMgZGVhdGhcLA0KICBoZSBtYWRlIGEgZGVwb3NpdCBvZiAoJDExKSBN

aWxsaW9uIERvbGxhcnMuIEhlIGRlcG9zaXRlZCB0aGUgbW9uZXkgaW4gaGlzIA0KIG5hbWUgYXMg

cHJvY2VlZHMgZnJvbSBhbiBvaWwgY29udHJhY3RcLCBidXQgdGhlIGZ1bmQgd2FzIGFjdHVhbGx5

XCwgYW4gaW5pdA0KIGlhbCBwYXltZW50IGZvciBhIHNlY3JldCBhcm0gZGVhbCBoZSB3YXMgYnJv

a2VyaW5nIGZvciBoaXMgdGhlbiBtYXN0ZXIgR2FkZA0KIGFmaSBhbmQgdGhlIGdvdmVybm1lbnQg

b2YgTm9ydGggS29yZWEuIE5vdyB3aXRoIHRoZSBkZWF0aHMgb2YgbXkgaHVzYmFuZCBhbg0KIGQg

dGhhdCBvZiBQcmVzaWRlbnQgTXVhbW1hciBHYWRkYWZpIGR1cmluZyB0aGUgY3Jpc2lzIGluIExp

YnlhXCwgSSdtIG5vdyB0aA0KIGUgb25seSBvbmUgd2hvIGtub3dzIG9mIHRoaXMgcGFydGljdWxh

ciBmdW5kIGFuZCBwcmVzZW50bHkgSSdtIGluIHRoaXMgaG9zcA0KIGl0YWwgYmVkIGR5aW5nIG9m

IGNhbmNlciBzaW5jZSB0aGUgZG9jdG9yIGhhcyBtYWRlIGl0IGNsZWFyIHRoYXQgSSdtIG5vIGxv

bg0KIGdlciByZXNwb25kaW5nIHRvIG1lZGljYXRpb25zXCwgaW5kaWNhdGluZyB0aGF0IEkgd2ls

bCBub3QgYmUgbGl2aW5nIG11Y2ggbA0KIG9uZ2VyXCwgYnV0IEkgd2lsbCByYXRoZXIgZGllIGlu

IHRoaXMgaG9zcGl0YWwgdGhhbiBnbyBob21lIGFuZCBmYWNlIG1vcmUgaQ0KIG5zdWx0cyBhbmQg

aHVtaWxpYXRpb24gZnJvbSBteSBodXNiYW5kIHJlbGF0aXZlcyB3aG8gdG9vayBhd2F5IGFsbCBt

eSBtb25leQ0KICBhbmQgamV3ZWxzIGFuZCBsZWZ0IG1lIHVuY2FyZWQtZm9yIGp1c3QgYmVjYXVz

ZSBJ4oCZbSBhbiBvcnBoYW4uXG5cbkhhdmluZyBjDQogb25zaWRlcmVkIG15IHBvc2l0aW9uXCwg

SSBoYXZlIGRlY2lkZWQgdG8gdXNlIHlvdSB0byBjYXJyeSBvdXQgbXkgcGxhbi4gSSB3DQogaWxs

IGd1aWRlIHlvdSB0byByZWNlaXZlIHRoZSAoJDExKSBNaWxsaW9uIERvbGxhcnMgZnJvbSB0aGUg

YmFuayBpbiBCdXJraW5hDQogIEZhc28gYW5kIHlvdSB3aWxsIHRha2UgMzAlIG9mIGl0IGZvciB5

b3Vyc2VsZiBhbmQgeW91ciBmYW1pbHkgd2hpbGUgeW91IHdpDQogbGwgdXNlIHRoZSBvdGhlciA3

MCUgYW5kIGJ1aWxkIGFuIG9ycGhhbmFnZSBob21lIGZvciB0aGUgbW90aGVybGVzcyBjaGlsZHJl

DQogbiBpbiB5b3VyIGxvY2F0aW9uIG9yIGFueXdoZXJlIG9mIHlvdXIgY2hvaWNlLiBUaGlzIGlz

IGJlY2F1c2UgSSdtIGFuIG9ycGhhDQogbiBhbmQgZG9lcyBub3QgaGF2ZSBhbnkgcmVsYXRpdmUu

IFRoaXMgaGFzIGJlZW4gbXkgd2lzaCBiZWZvcmUgdGhpcyBzaWNrbmVzDQogcyBjYW1lIGJldHdl

ZW4gbXkgcGxhbnMuIFBsZWFzZSB5b3UgbXVzdCBmb2xsb3cgdGhpcyBkaXJlY3RpdmUgb3IgSSB3

aWxsIGxvDQogb2sgZm9yIGFub3RoZXIgcGVyc29uLiBUaGUgb25seSByZWFzb24gSSB3aWxsIG5v

dCBlbnRydXN0IHRoZSBmdW5kIGFuZCBwcm9qDQogZWN0IHRvIHNvbWVvbmUgYXJvdW5kIGhlcmUg

aXMgYmVjYXVzZSBJJ20gbWFraW5nIGl0IGEgdG9wIHNlY3JldCBzbyB0aGF0IHRoDQogZSBuZXdz

IGRvZXNu4oCZdCBnZXQgdG8gbXkgaHVzYmFuZCByZWxhdGl2ZXMgd2hvIHdpbGwgbm90IGFsbG93

IHRoZSBmdW5kIHRvIGINCiBlIHVzZWQgZm9yIGh1bWFuaXRhcmlhbiB3b3JrIGJ1dCB3aWxsIHF1

aWNrbHkgY29uZmlzY2F0ZSB0aGUgbW9uZXkgYW5kIGhhdmUNCiAgaXQgc2hhcmVkIGFtb25nc3Qg

dGhlbS5cblxuSG93ZXZlclwsIGlmIHlvdSBhcmUgbm90IGNhcGFibGUgb2YgaGFuZGxpbmcgdGgN

CiBpcyB0YXNrIG9yIHlvdSBkbyBub3QgaGF2ZSBjb25maWRlbmNlIGluIHRoaXMgbWVzc2FnZVws

IHBsZWFzZSBraW5kbHkgZGVsZXQNCiBlIGl0IGFuZCBhY2NlcHQgbXkgc2luY2VyZSBhcG9sb2d5

IGZvciBjb250YWN0aW5nIHlvdSBpbiB0aGlzIG1hbm5lclwsIGJ1dCANCiBpZiB5b3UgaGF2ZSBj

b25maWRlbmNlIGluIGl0IGFuZCBjYW4gaGFuZGxlIHRoZSB0YXNrIHRoZW4ga2luZGx5IGluZGlj

YXRlIGINCiB5IHJlc3BvbmRpbmcuIFxuXG5IZXJlIGlzIG15IGVtYWlsIGFkZHJlc3MgKGx1Y3lm

YXJvdWtAeWFob28uY29tKVxuXG5UaGFua3MNCiAgYW5kIGJlIEJsZXNzZWQuXG5cbk1ycy4gTHVj

eSBGYXJvdWsuXG5cblxuXG5cblZpZXcgeW91ciBldmVudCBhdCBodHRwOi8vd3cNCiB3Lmdvb2ds

ZS5jb20vY2FsZW5kYXIvZXZlbnQ/YWN0aW9uPVZJRVcmZWlkPWMybG5jR3c0TkRnNE0ycDFhMkZu

TUhCdGMyb3pNakINCiBqYlRnZ1pHRjJaVUJrYjJOMGIzSXVibXd5YXk1aFlpNWpZUSZ0b2s9TWpN

alkyeGhkV1JsWkhWclpURXhOMEJuYldGcGJDNWpiMjANCiA1TURrNFl6bGxOMkpqTWpoaU9HRTBa

RGs0TlRka05tWXlZbUk1TUdVMk1tVTFaRE5rTURFNCZjdHo9QW1lcmljYS9OZXdfWW9yayYNCiBo

bD1lbl9HQi4NCkxBU1QtTU9ESUZJRUQ6MjAxMzA4MTJUMTkyMTI2Wg0KTE9DQVRJT046DQpTRVFV

RU5DRTowDQpTVEFUVVM6Q09ORklSTUVEDQpTVU1NQVJZOkRlYXIgdHJ1c3RlZCBvbmUNClRSQU5T

UDpPUEFRVUUNCkVORDpWRVZFTlQNCkVORDpWQ0FMRU5EQVINCg==

--047d7bfeb466e4fca204e3c5073a

Content-Type: multipart/alternative;

boundary="=======AVGMAIL-73A1DD2C======="



--=======AVGMAIL-73A1DD2C=======

Content-Type: text/html; x-avg=cert; charset="windows-1252"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "Certification"



No virus found=

in this message.


Checked by AVG - www.avg.com


Version: 10.0.1432 / Virus Database: 3211/6073 - Release Date: 08/12/13

=



--=======AVGMAIL-73A1DD2C=======--



--047d7bfeb466e4fca204e3c5073a--







More Paypal Phish via Bell Canada

Posted by Dave Yadallee on
From - Tue Aug 13 07:01:45 2013

X-Account-Key: account1

X-UIDL: 000023944f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Mon, 12 Aug 2013 11:39:32 -0600

Received: from toroondcbmts05-srv.bellnexxia.net ([207.236.237.39])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V8w5S-00010s-Pb

for dave@nk.ca; Mon, 12 Aug 2013 11:39:32 -0600

Received: from toip36-bus.srvr.bell.ca ([67.69.240.37])

by toroondcbmts05-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130812173918.HZJV12702.toroondcbmts05-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

for ; Mon, 12 Aug 2013 13:39:18 -0400

Received: from bas2-toronto43-3096460141.dsl.bell.ca (HELO DVR-PC1-TO) ([184.144.59.109])

by toip36-bus.srvr.bell.ca with ESMTP; 12 Aug 2013 13:39:08 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AmWDAFgRCVK4kDtt/2dsb2JhbAABWgcQgm81rS0BiTkQiUYXdAQEAScBAYFXAQEQWEkGAQIndhOGD4IBDJYwjyuEAppUgSwGgUeBPYEugRwDgSiNd4lxkCUfgU2BSyCBLAIHF20FLA

X-IronPort-AV: E=Sophos;i="4.89,863,1367985600";

d="scan'208,217";a="431301607"

From: "support"

Subject: Notice From PayPaI intended for : dave@nk.ca

To: "mail.negociar.com.pe DodJZB"

Content-Type: multipart/alternative; boundary="fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0"

MIME-Version: 1.0

Date: Mon, 12 Aug 2013 13:39:02 -0400

Message-Id: <20130812173918.HZJV12702.toroondcbmts05-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.39 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.39 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.39 listed in dnsbl-2.uceprotect.net]

2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URIs: negociar.com.pe]

1.2 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

Subject: {SPAM?} Notice From PayPaI intended for : dave@nk.ca



This is a multi-part message in MIME format



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





Your account access is limited for security reasons.


href=3D"http://mail.negociar.com.pe/bb.html">Click here to remove the =

limitation and restore your full access.

Thank you for you=

r prompt attention on this matter!



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0--







Paypal Phish via Bell Canada

Posted by Dave Yadallee on
From - Tue Aug 13 07:01:45 2013

X-Account-Key: account1

X-UIDL: 000023944f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Mon, 12 Aug 2013 11:39:32 -0600

Received: from toroondcbmts05-srv.bellnexxia.net ([207.236.237.39])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V8w5S-00010s-Pb

for dave@nk.ca; Mon, 12 Aug 2013 11:39:32 -0600

Received: from toip36-bus.srvr.bell.ca ([67.69.240.37])

by toroondcbmts05-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130812173918.HZJV12702.toroondcbmts05-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

for ; Mon, 12 Aug 2013 13:39:18 -0400

Received: from bas2-toronto43-3096460141.dsl.bell.ca (HELO DVR-PC1-TO) ([184.144.59.109])

by toip36-bus.srvr.bell.ca with ESMTP; 12 Aug 2013 13:39:08 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AmWDAFgRCVK4kDtt/2dsb2JhbAABWgcQgm81rS0BiTkQiUYXdAQEAScBAYFXAQEQWEkGAQIndhOGD4IBDJYwjyuEAppUgSwGgUeBPYEugRwDgSiNd4lxkCUfgU2BSyCBLAIHF20FLA

X-IronPort-AV: E=Sophos;i="4.89,863,1367985600";

d="scan'208,217";a="431301607"

From: "support"

Subject: Notice From PayPaI intended for : dave@nk.ca

To: "mail.negociar.com.pe DodJZB"

Content-Type: multipart/alternative; boundary="fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0"

MIME-Version: 1.0

Date: Mon, 12 Aug 2013 13:39:02 -0400

Message-Id: <20130812173918.HZJV12702.toroondcbmts05-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.39 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.39 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.39 listed in dnsbl-2.uceprotect.net]

2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URIs: negociar.com.pe]

1.2 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

Subject: {SPAM?} Notice From PayPaI intended for : dave@nk.ca



This is a multi-part message in MIME format



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





Your account access is limited for security reasons.


href=3D"http://mail.negociar.com.pe/bb.html">Click here to remove the =

limitation and restore your full access.

Thank you for you=

r prompt attention on this matter!



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0--