More Apple Phish

From - Thu Mar 13 13:56:00 2014

X-Account-Key: account2

X-UIDL: 0005723a501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: sales@nk.ca

Delivery-date: Thu, 13 Mar 2014 13:55:51 -0600

Received: from comweb03.comaxess.net ([88.190.39.17])

by doctor.nl2k.ab.ca with esmtps (TLSv1.1:DHE-RSA-AES256-SHA:256)

(Exim 4.82)

(envelope-from )

id 1WOBj6-00011K-Lt

for sales@nk.ca; Thu, 13 Mar 2014 13:55:49 -0600

Received: by comweb03.comaxess.net (Postfix, from userid 10083)

id E7E3B5343656; Thu, 13 Mar 2014 20:54:07 +0100 (CET)

To: sales@nk.ca

Subject: Your Apple ID will expire

X-PHP-Originating-Script: 10083:mailler.php

From: Apple

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="eb05110e60ed41e94959ef001e20d5ae"

Message-Id: <20140313195407.E7E3B5343656@comweb03.comaxess.net>

Date: Thu, 13 Mar 2014 20:54:07 +0100 (CET)



This is a multi-part message in MIME format.

--eb05110e60ed41e94959ef001e20d5ae

Content-type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: 8bit

























































































































Dear Customer,










































We inform you that your Apple ID will expire within 48 mins H.
























it is imperative to conduct an audit of your information is present, otherwise your ID will be destroyed.










































Just click the link below and log in using your Apple ID and password: Vérify Now >



























use and protect personal information you provide, please visit Apple's Privacy Policy is-à-is its customers.
























TM and copyright © 2014 Apple Inc. 1 Infinite Loop, MS 83-DM, Cupertino, CA 95014, United Kingdom.


All rights reserved / Stay Informed / Privacy Statement / My Apple ID






















More TD Phish

From - Thu Mar 13 10:07:28 2014

X-Account-Key: account2

X-UIDL: 00057233501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Mar 2014 10:07:14 -0600

Received: from host.teamidiot.com ([50.28.4.80])

by doctor.nl2k.ab.ca with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)

(Exim 4.82)

(envelope-from )

id 1WO89T-00038u-MQ

for aboo@doctor.nl2k.ab.ca; Thu, 13 Mar 2014 10:07:11 -0600

Received: from [178.78.114.137] (port=2423 helo=bing.com)

by host.teamidiot.com with esmtpa (Exim 4.80.1)

(envelope-from )

id 1WO89K-0002iG-DN

for aboo@doctor.nl2k.ab.ca; Thu, 13 Mar 2014 10:06:26 -0600

From: td.com.survey

To: aboo@doctor.nl2k.ab.ca

Subject: You are the only winner of a substantial bonus! Only today!

Date: 13 Mar 2014 16:09:26 +0000

Message-ID: <20140313160926.D01411EF94D8859A@from.header.has.no.domain>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - host.teamidiot.com

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - bing.com

X-Get-Message-Sender-Via: host.teamidiot.com: authenticated_id: info@MYCARDSROCK.COM

X-Source:

X-Source-Args:

X-Source-Dir:








sans-serif" size=3D2>
vetica, sans-serif">





size=3D3>You were chosen by chance to participate in a short and easy surve=

y.
To start the weekend well, TD Canada Trust offers a bonus of&nbs=

p;$200 in exchange for 5 minutes spent on our website and complete the surve=

y.
Please follow the website to complete survey




=3D"Times New Roman" size=3D3>Survey 200 bonus


ONT>




Apple iTunes Phish

From - Thu Mar 13 07:15:27 2014

X-Account-Key: account2

X-UIDL: 0005722b501fb806

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: aboo@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Mar 2014 07:15:12 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.82)

(envelope-from )

id 1WO522-0001Er-Ud

for aboo@doctor.nl2k.ab.ca; Thu, 13 Mar 2014 06:46:42 -0600

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Thu, 13 Mar 2014 06:46:42 -0600

Resent-Message-ID: <20140313124642.GC29058@doctor.nl2k.ab.ca>

Resent-To: See root

Received: from cpanel-1.hostnet.lv ([89.111.24.122])

by doctor.nl2k.ab.ca with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256)

(Exim 4.82)

(envelope-from )

id 1WO4wW-0006AL-Up

for doctor@nl2k.ab.ca; Thu, 13 Mar 2014 06:41:44 -0600

Received: from simplika by cpanel-1.hostnet.lv with local (Exim 4.82)

(envelope-from )

id 1WO4wH-0006ny-I6

for doctor@nl2k.ab.ca; Thu, 13 Mar 2014 14:40:45 +0200

To: doctor@nl2k.ab.ca

Subject: Update your account details on iTunes.

X-PHP-Script: www.simplika.com/wp-content/plugins/11.php for 91.232.96.5

From: Apple

Reply-To: app@apple.ca

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: 8bit

Message-Id:

Date: Thu, 13 Mar 2014 14:40:45 +0200

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cpanel-1.hostnet.lv

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [595 598] / [47 12]

X-AntiAbuse: Sender Address Domain - cpanel-1.hostnet.lv

X-Get-Message-Sender-Via: cpanel-1.hostnet.lv: authenticated_id: simplika/only user confirmed/virtual account not confirmed

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "gallifrey.nk.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Our security check detected multiple unwanted login attepmts

on your account. You need to update your iTunes account details for better

security. Click the link below to update your account details: Click Here

to Update [...]



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.6 TVD_PH_SUBJ_ACCOUNTS_POST TVD_PH_SUBJ_ACCOUNTS_POST

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.5 TVD_PH_SEC BODY: Message has a phrase standard for phishing mails

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Update your account details on iTunes.



Our security check detected multiple unwanted login attepmts on your

account.



You need to update your iTunes account details for better security.


Click the link below to update your account details:


Click Here to Update






We are sorry for any problems caused by our security check.



iTunes team.