Telus Spammer get spamhaus.org's attention

Spamhaus is now blocking Telus clients. Will Telus fix this blot on their reputation?

More investment Telus Spam

From - Sat Mar 15 12:14:19 2008

X-Account-Key: account2

X-UIDL: j4W!!lB3"!c$M"!/]Y!!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

X-NetKnow-InComing-4.67.3-1-MailScanner-Watermark: 1205937173.41831@8DHraFQ8aoNHK3e6iXkvrg

Return-Path:

Received: from doctor.nl2k.ab.ca

by doctor.nl2k.ab.ca (8.14.2/8.14.2) with ESMTP id m2EEVqta016491

for ; Fri, 14 Mar 2008 08:31:58 -0600 (MDT)

Received: (from doctor@localhost)

by doctor.nl2k.ab.ca (8.14.2/8.14.1/Submit) id m2EEVqfG016489

for dave@doctor.nl2k.ab.ca; Fri, 14 Mar 2008 08:31:52 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Fri, 14 Mar 2008 08:31:52 -0600

Resent-Message-ID: <20080314143152.GD14916@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-NetKnow-InComing-4.67.3-1-MailScanner-Watermark: 1205909409.33533@MktjgIhWiPR5nPlruigdTA

Received: from defout.telus.net

by doctor.nl2k.ab.ca (8.14.2/8.14.2) with ESMTP id m2E6naG7021137

for ; Fri, 14 Mar 2008 00:50:01 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from priv-edmwaa05.telusplanet.net ([66.183.63.208])

by priv-edmwes33.telusplanet.net

(InterMail vM.7.08.02.00 201-2186-121-20061213) with ESMTP

id <20080314064930.JQDX4256.priv-edmwes33.telusplanet.net@priv-edmwaa05.telusplanet.net>

for ; Fri, 14 Mar 2008 00:49:30 -0600

Received: from d64-180-87-131.bchsia.telus.net (unknown [66.183.63.208])

by priv-edmwaa05.telusplanet.net (BorderWare MXtreme Infinity Mail Firewall) with SMTP id 89LMH5S7MC

for ; Fri, 14 Mar 2008 00:49:30 -0600 (MDT)

From: "Stan Stanchev"

To: "doctor"

Subject: {?} Here is the requested info for the Caribbean five-star resort investment

Date: Thu, 13 Mar 2008 23:49:13 -0700

Organization: Punta Perla

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0000_01C6527E.AE8904D0"

Message-Id: <20080314064930.89LMH5S7MC@priv-edmwaa05.telusplanet.net>

X-Null-Tag: 15d08dd436e228c61293c2a78b9089cc

X-Null-Tag: 231b5fd0f0e4f98b7a9052d1abeb1357

X-NetKnow-InComing-4.67.3-1-MailScanner: Found to be clean, Found to be clean

X-NetKnow-InComing-4.67.3-1-MailScanner-SpamCheck: spam, SORBS-SPAM,

SpamAssassin (not cached, score=5.121, required 5, BOTNET 5.00,

HTML_MESSAGE 0.00, RDNS_NONE 0.10, RELAY_CHECKER 0.00,

RELAY_CHECKER_BADDNS 0.01, RELAY_CHECKER_IPHOSTNAME 0.01)

X-NetKnow-InComing-4.67.3-1-MailScanner-SpamScore: sssss

X-Spam-Status: Yes, No

X-NetKnow-InComing-4.67.3-1-MailScanner-Information: Please contact the ISP for more information

X-MailScanner-ID: m2EEVqta016491

X-NetKnow-InComing-4.67.3-1-MailScanner-From: doctor@doctor.nl2k.ab.ca

X-UIDL: j4W!!lB3"!c$M"!/]Y!!



This is a multi-part message in MIME format.



------=_NextPart_000_0000_01C6527E.AE8904D0

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: 8bit



This is a text part of the message.

It is shown for the users of old-style e-mail clients

--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.





------=_NextPart_000_0000_01C6527E.AE8904D0

Content-Type: text/html;

charset="iso-8859-1"















Hi Sharleen,



 



As you know I've been working as

a Realtor since 1992. When I learned about this real estate investment with 8%

guaranteed



rental return, I was so exited

that I bought a property in a week. A few months later I bought a second one.

Feel free to share



this

information with your friends and relatives. Here is the link to the

web site with price list, floor plans, photos and maps :



 






href="http://puntaperla.startlogic.com">http://puntaperla.startlogic.com




 


w:st="on">
style="mso-bookmark: OLE_LINK2">

 


style="mso-bookmark: OLE_LINK2">

style="mso-bookmark: OLE_LINK1">





/>





Feel free to call me or email me

with any questions.



 



Best regards: Stan

Stanchev










--


This message has been scanned for viruses and


dangerous content by

MailScanner, and is


believed to be clean.





------=_NextPart_000_0000_01C6527E.AE8904D0--





More investment Telus Spam

From - Sat Mar 15 12:14:22 2008

X-Account-Key: account2

X-UIDL: Ao8"!3)G!!b`*#!h>n"!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

X-NetKnow-InComing-4.67.3-1-MailScanner-Watermark: 1205937173.29122@8PuVkxL8lJUjzM7cx7Hwjw

Return-Path:

Received: from doctor.nl2k.ab.ca

by doctor.nl2k.ab.ca (8.14.2/8.14.2) with ESMTP id m2EEVPLM016373

for ; Fri, 14 Mar 2008 08:31:31 -0600 (MDT)

Received: (from doctor@localhost)

by doctor.nl2k.ab.ca (8.14.2/8.14.1/Submit) id m2EEVOfZ016368

for dave@doctor.nl2k.ab.ca; Fri, 14 Mar 2008 08:31:24 -0600 (MDT)

Resent-From: doctor@doctor.nl2k.ab.ca

Resent-Date: Fri, 14 Mar 2008 08:31:24 -0600

Resent-Message-ID: <20080314143124.GC14916@doctor.nl2k.ab.ca>

Resent-To: Dave Yadallee

X-NetKnow-InComing-4.67.3-1-MailScanner-Watermark: 1205909388.11582@fpvA8azbt60SN8G9neMEJw

Received: from defout.telus.net

by doctor.nl2k.ab.ca (8.14.2/8.14.2) with ESMTP id m2E6nTbD021111

for ; Fri, 14 Mar 2008 00:49:45 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from priv-edmwaa04.telusplanet.net ([66.183.63.208])

by priv-edmwes50.telusplanet.net

(InterMail vM.7.08.02.00 201-2186-121-20061213) with ESMTP

id <20080314064923.KERH28448.priv-edmwes50.telusplanet.net@priv-edmwaa04.telusplanet.net>

for ; Fri, 14 Mar 2008 00:49:23 -0600

Received: from d64-180-87-131.bchsia.telus.net (unknown [66.183.63.208])

by priv-edmwaa04.telusplanet.net (BorderWare MXtreme Infinity Mail Firewall) with SMTP id 0E52V549DB

for ; Fri, 14 Mar 2008 00:49:23 -0600 (MDT)

From: "Stan Stanchev"

To: "doctor"

Subject: {?} Re: enquiry about the Caribbean five-star resort investment

Date: Thu, 13 Mar 2008 23:49:12 -0700

Organization: Punta Perla

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0000_01C6527E.AE8904D0"

Message-Id: <20080314064923.0E52V549DB@priv-edmwaa04.telusplanet.net>

X-Null-Tag: 280c97900c5f1b386651a47c6c22d0db

X-Null-Tag: 7ad4ba970f5e3aaa8f77589275ec9987

X-NetKnow-InComing-4.67.3-1-MailScanner: Found to be clean, Found to be clean

X-NetKnow-InComing-4.67.3-1-MailScanner-SpamCheck: spam, SORBS-SPAM,

SpamAssassin (not cached, score=5.121, required 5, BOTNET 5.00,

HTML_MESSAGE 0.00, RDNS_NONE 0.10, RELAY_CHECKER 0.00,

RELAY_CHECKER_BADDNS 0.01, RELAY_CHECKER_IPHOSTNAME 0.01)

X-NetKnow-InComing-4.67.3-1-MailScanner-SpamScore: sssss

X-Spam-Status: Yes, No

X-NetKnow-InComing-4.67.3-1-MailScanner-Information: Please contact the ISP for more information

X-MailScanner-ID: m2EEVPLM016373

X-NetKnow-InComing-4.67.3-1-MailScanner-From: doctor@doctor.nl2k.ab.ca

X-UIDL: Ao8"!3)G!!b`*#!h>n"!



This is a multi-part message in MIME format.



------=_NextPart_000_0000_01C6527E.AE8904D0

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: 8bit



This is a text part of the message.

It is shown for the users of old-style e-mail clients

--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.





------=_NextPart_000_0000_01C6527E.AE8904D0

Content-Type: text/html;

charset="iso-8859-1"















Hi Jovita,



 



As you know I've been working as

a Realtor since 1992. When I learned about this real estate investment with 8%

guaranteed



rental return, I was so exited

that I bought a property in a week. A few months later I bought a second one.

Feel free to share



this

information with your friends and relatives. Here is the link to the

web site with price list, floor plans, photos and maps :



 






href="http://puntaperla.startlogic.com">http://puntaperla.startlogic.com




 


w:st="on">
style="mso-bookmark: OLE_LINK2">

 


style="mso-bookmark: OLE_LINK2">

style="mso-bookmark: OLE_LINK1">





/>





Feel free to call me or email me

with any questions.



 



Best regards: Stan

Stanchev










--


This message has been scanned for viruses and


dangerous content by

MailScanner, and is


believed to be clean.





------=_NextPart_000_0000_01C6527E.AE8904D0--





A sample Telus.net spam

From Staatsloterijnl@telus.net Sat May 5 01:46:42 2007

Return-Path: Staatsloterijnl@telus.net

Received: from defout.telus.net

by doctor.nl2k.ab.ca (8.14.1/8.14.1) with ESMTP id l457k1ae016620

for ; Sat, 5 May 2007 01:46:07 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from localhost ([199.185.220.240])

by priv-edtnes42.telusplanet.net

(InterMail vM.7.08.02.00 201-2186-121-20061213) with ESMTP

id <20070505074835.FRRI8403.priv-edtnes42.telusplanet.net@localhost>;

Sat, 5 May 2007 01:48:35 -0600

Received: from 62.163.73.189 ( [62.163.73.189])

as user skookumsound@telus.net@192.168.200.1 by webmail.telus.net with

+HTTP;

Sat, 5 May 2007 00:48:27 -0700

Message-ID: <1178351307.463c36cb0c510@webmail.telus.net>

Date: Sat, 5 May 2007 00:48:27 -0700

From: Staatsloterijnl Prize Award

Reply-to: contactgerthomlfred@gmail.com

Subject: {Spam?} Sir/Madam,

MIME-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

User-Agent: Internet Messaging Program (IMP) 3.1-cvs

X-Originating-IP: 62.163.73.189

X-NetKnow-Incoming-MailScanner-4.58.9-MailScanner-Information: Please contact

+the ISP for more information

X-NetKnow-Incoming-MailScanner-4.58.9-MailScanner: Found to be clean

X-NetKnow-Incoming-MailScanner-4.58.9-MailScanner-SpamCheck: spam,

SORBS-DNSBL, SORBS-SPAM, SpamAssassin (not cached, score=6.18,

required 1, HELO_LOCALHOST 4.50, MISSING_HEADERS 1.58,

RDNS_NONE 0.10)

X-NetKnow-Incoming-MailScanner-4.58.9-MailScanner-SpamScore: ssssss

X-NetKnow-Incoming-MailScanner-4.58.9-MailScanner-From:

+staatsloterijnl@telus.net

X-Spam-Status: Yes

Status: RO

Content-Length: 1155

Lines: 36



Sir/Madam,

YOUR REF. No: SNL/4249859609/WP1

YOUR BATCH NO: AT-040SB03-07.

We are pleased to inform you of the result of the Staatsloterij award Winners

International programs that was annouced today 5th of May 2007. Your email

address have been selected as one of the lucky winning Address, therefore you

have been approved for a lump sum payout of Nine Hundred And Twenty Thousand

Euro (920,000.00). Your email address attached to a Ticket numbers 7775114-

6410 with Serial No. 223155-06. To file and claim your prize, please contacts

our processing department for the processing of your winning prize.

********************************************

MR. Gert Homlfred

Staatsloterij N.V

(CLAIM PROCESSING DEPARTMENT)

Tel: +31- 641 940320

Fax: +31- 847 195169

Email: contactgerthomlfred@gmail.com

***********************************************

Congratulations once more, as we expect you to make good use of the funds.



Yours Sincerely,

Janet van Caviva (Mrs).

(Loterij Promotions Coordinator)

















--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.





And according to our logs, this came from



May 5 01:46:08 doctor sendmail[16620]: l457k1ae016620: from=, size=1875, class=0, nrcpts=1, msgid=<1178351307.463c36cb0c510@webmail.telus.net>, proto=ESMTP, daemon=MTA, relay=defout.telus.net [199.185.220.240]

www.nk.ca - WSO version
Uname:
User:
Php:
Hdd:
Cwd:
FreeBSD doctor.nl2k.ab.ca 12.2-RELEASE-p1 FreeBSD 12.2-RELEASE-p1 GENERIC amd64 [ Google ] [ Exploit-DB ]
80 ( www ) Group: 80 ( www )
7.4.14 Safe mode: OFF [ phpinfo ] Datetime: 2021-01-23 18:12:09
3390.11 GB Free: 1841.67 GB (54.32%)
/usr/local/www/nginx-dist/blog/ drwxr-xr-x [ home ]

Server IP:
204.209.81.1
Client IP:
3.221.159.255
[ Sec. Info ][ Files ][ Console ][ Infect ][ Sql ][ Php ][ Safe mode ][ String tools ][ Bruteforce ][ Network ][ Self remove ]

File manager

NameSizeModifyOwner/GroupPermissionsActions
[ .. ]dir2021-01-23 17:15:00www/wwwdr-xr-xr-xR T
[ archives ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ bundled-libs ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ deployment ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ docs ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ htmlarea ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ include ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ lang ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ plugins ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ sql ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ templates ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
[ templates_c ]dir2020-08-15 02:40:53www/wwwdrwxr-xr-xR T
[ uploads ]dir2020-08-15 01:31:14www/wwwdrwxr-xr-xR T
.gitignore291 B2020-08-12 14:20:00www/www-rw-r--r--R T F E D
.htaccess271 B2020-11-18 04:19:22www/www-rw-rw-rw-R T F E D
checksums.inc.php307.71 KB2020-08-15 02:40:51www/www-rw-r--r--R T F E D
CODE_OF_CONDUCT.md3.17 KB2020-08-15 02:40:49www/www-rw-r--r--R T F E D
comment.php9.46 KB2020-08-15 02:40:51www/www-rw-r--r--R T F E D
composer.json681 B2020-11-11 22:42:43www/www-rw-r--r--R T F E D
composer.json.orig681 B2020-08-15 02:40:51www/www-rw-r--r--R T F E D
composer.phar1.56 MB2020-08-15 02:40:51www/www-rw-r--r--R T F E D
CONTRIBUTING.md86 B2020-08-15 02:40:49www/www-rw-r--r--R T F E D
exit.php2.11 KB2020-08-15 02:40:51www/www-rw-r--r--R T F E D
index.php36.38 KB2020-11-18 04:15:41www/www-rw-r--r--R T F E D
LICENSE1.53 KB2020-08-15 02:40:49www/www-rw-r--r--R T F E D
README.markdown323 B2020-08-15 02:40:49www/www-rw-r--r--R T F E D
rss.php11.76 KB2020-08-15 02:40:52www/www-rw-r--r--R T F E D
serendipity.css.php3.90 KB2020-08-15 02:40:52www/www-rw-r--r--R T F E D
serendipity_admin.php8.88 KB2020-11-18 04:05:38www/www-rw-r--r--R T F E D
serendipity_admin_image_selector.php12.22 KB2020-08-15 02:40:52www/www-rw-r--r--R T F E D
serendipity_config.inc.php19.65 KB2020-11-18 04:24:52www/www-rw-r--r--R T F E D
serendipity_config_local.inc.php899 B2020-11-18 04:19:21www/www-rwx------R T F E D
serendipity_xmlrpc.php432 B2020-11-18 04:06:02www/www-rw-r--r--R T F E D
wfwcomment.php1.40 KB2020-08-15 02:40:53www/www-rw-r--r--R T F E D
Change dir:
Read file:
Make dir: [ Writeable ]
Make file: [ Writeable ]
Execute:
Upload file: [ Writeable ]