More Paypal Phish via Bell Canada

From - Fri Aug 16 08:43:28 2013

X-Account-Key: account1

X-UIDL: 0000240b4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 14 Aug 2013 17:19:46 -0600

Received: from toroondcbmts08-srv.bellnexxia.net ([207.236.237.42])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9kLr-0001GF-HN

for dave@nk.ca; Wed, 14 Aug 2013 17:19:46 -0600

Received: from toip54-bus.srvr.bell.ca ([67.69.240.140])

by toroondcbmts08-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130814231936.WANO15792.toroondcbmts08-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

for ; Wed, 14 Aug 2013 19:19:36 -0400

Received: from unknown (HELO ServeurVF) ([65.94.74.53])

by toip54-bus.srvr.bell.ca with ESMTP; 14 Aug 2013 19:19:23 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AklOANsCDFJBXko1/2dsb2JhbAABQBqCRAEPMjWIa4RQk2yGKoYGAQGJSIkCcBZ0gnYBRQQBAQECB4EWE4gQDDKYJ5NWAUCESJZ2hDmBHQOeMIVZhS2DNyCBNQ

X-IronPort-AV: E=Sophos;i="4.89,880,1367985600";

d="scan'208,217";a="339091651"

From: "**PayPaI**"

Subject: ** Final Notice for dave@nk.ca **

To: "59-125-248-104.hinet-ip.hinet.net wY1xMe"

Content-Type: multipart/alternative; boundary="aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0"

MIME-Version: 1.0

Date: Wed, 14 Aug 2013 19:19:21 -0400

X-Antivirus: avast! (VPS 130814-1, 2013-08-14), Outbound message

X-Antivirus-Status: Clean

Message-Id: <20130814231936.WANO15792.toroondcbmts08-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - [...]



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.42 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.42 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.42 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=gfafsas%40service.com;ip=207.236.237.42;r=doctor.nl2k.ab.ca]

0.7 SARE_HTML_A_BODY FULL: Message body has very strange HTML sequence

1.7 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe naught

else

Subject: {SPAM?} ** Final Notice for dave@nk.ca **



This is a multi-part message in MIME format



--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -





--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable






php" target=3D_blank>
net/appserv/sejur35612.png">




--aO5gUTNQGY=_OIjD8PkQkG2dZAnQ2gd2uW0--







More Paypal Phish

From - Tue Aug 13 17:17:03 2013

X-Account-Key: account1

X-UIDL: 000023d04f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 11:22:06 -0600

Received: from toroondcbmts04-srv.bellnexxia.net ([207.236.237.38])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9II9-00050D-VF

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 11:22:05 -0600

Received: from toip52-bus.srvr.bell.ca ([67.69.240.55])

by toroondcbmts04-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130813172154.CPAY2032.toroondcbmts04-srv.bellnexxia.net@toip52-bus.srvr.bell.ca>

for ; Tue, 13 Aug 2013 13:21:54 -0400

Received: from bas1-galt04-1176178839.dsl.bell.ca (HELO server2) ([70.27.16.151])

by toip52-bus.srvr.bell.ca with ESMTP; 13 Aug 2013 13:21:49 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: Au1QAOpdClJGGxCX/2dsb2JhbAABQBoHEIJvNYhqpEwBAYpxiCQXdIIbWAMBRQYBAid2E4YPggEMMpcijyuEAikBm18GgU6BPYEugRwDgSiIBYVylGmFLR+BQguBTR6BLAIHF20FLA

X-IronPort-AV: E=Sophos;i="4.89,871,1367985600";

d="scan'208,217";a="430663058"

From: "support"

Subject: ( PayPaI Account Limited ) This message is intended for:

dave@doctor.nl2k.ab.ca

To: "61-219-68-15.HINET-IP.hinet.net 3MC8jr"

Content-Type: multipart/alternative; boundary="4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0"

MIME-Version: 1.0

Date: Tue, 13 Aug 2013 12:17:33 -0500

Message-Id: <20130813172154.CPAY2032.toroondcbmts04-srv.bellnexxia.net@toip52-bus.srvr.bell.ca>

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.38 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.38 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.38 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=asfacxz%40sympatico.ca;ip=207.236.237.38;r=doctor.nl2k.ab.ca]

Subject: {SPAM?} ( PayPaI Account Limited ) This message is intended for:

dave@doctor.nl2k.ab.ca



This is a multi-part message in MIME format



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





Your account access is limited for security reasons.


href=3D"http://61-219-68-15.HINET-IP.hinet.net/a.php">Click here to re=

move the limitation and restore your full access.


Thank yo=

u for your prompt attention on this matter!





































--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0--







Phish from Bell Nexxia

From - Tue Aug 13 17:17:02 2013

X-Account-Key: account1

X-UIDL: 000023cb4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 13 Aug 2013 09:41:16 -0600

Received: from toroondcbmts06.bellnexxia.net ([207.236.237.40] helo=toroondcbmts06-srv.bellnexxia.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V9Gic-0005xB-OW

for dave@doctor.nl2k.ab.ca; Tue, 13 Aug 2013 09:41:16 -0600

Received: from toip54-bus.srvr.bell.ca ([67.69.240.140])

by toroondcbmts06-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130813154106.DCOC14379.toroondcbmts06-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

for ; Tue, 13 Aug 2013 11:41:06 -0400

Received: from bas1-galt04-1176178839.dsl.bell.ca (HELO server2) ([70.27.16.151])

by toip54-bus.srvr.bell.ca with ESMTP; 13 Aug 2013 11:41:00 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AlsLAOpOClJGGxCX/2dsb2JhbABbBxCCbzWIaqRNAQGSGnsXdIIbWAMBAUQGAQInZAYCAgiGIoIBDJdIjyuEAikBm2IGgU6BPYEugRwDgSiIBYVymhYfgxoegSwCBxdtBSw

X-IronPort-AV: E=Sophos;i="4.89,870,1367985600";

d="scan'208";a="338908670"

From: "support"

To: "61-218-207-124.HINET-IP.hinet.net 3MC8jr"

Content-Type: multipart/alternative; boundary="4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0"

MIME-Version: 1.0

Date: Tue, 13 Aug 2013 10:36:44 -0500

Message-Id: <20130813154106.DCOC14379.toroondcbmts06-srv.bellnexxia.net@toip54-bus.srvr.bell.ca>

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.40 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.40 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.40 listed in dnsbl-2.uceprotect.net]

Subject: {SPAM?}



This is a multi-part message in MIME format



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable



Your account access is limited for security reasons.





Clic=

k here to remove the limitation and restore your full access.




=20

Thank you for your prompt attention on this matter!





--4F0pUIrl5AoBSnjK1PisyB0=_5itymHGnc0--







Paypal Phish via Bell Canada

From - Tue Aug 13 07:01:45 2013

X-Account-Key: account1

X-UIDL: 000023944f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Mon, 12 Aug 2013 11:39:32 -0600

Received: from toroondcbmts05-srv.bellnexxia.net ([207.236.237.39])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V8w5S-00010s-Pb

for dave@nk.ca; Mon, 12 Aug 2013 11:39:32 -0600

Received: from toip36-bus.srvr.bell.ca ([67.69.240.37])

by toroondcbmts05-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130812173918.HZJV12702.toroondcbmts05-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

for ; Mon, 12 Aug 2013 13:39:18 -0400

Received: from bas2-toronto43-3096460141.dsl.bell.ca (HELO DVR-PC1-TO) ([184.144.59.109])

by toip36-bus.srvr.bell.ca with ESMTP; 12 Aug 2013 13:39:08 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AmWDAFgRCVK4kDtt/2dsb2JhbAABWgcQgm81rS0BiTkQiUYXdAQEAScBAYFXAQEQWEkGAQIndhOGD4IBDJYwjyuEAppUgSwGgUeBPYEugRwDgSiNd4lxkCUfgU2BSyCBLAIHF20FLA

X-IronPort-AV: E=Sophos;i="4.89,863,1367985600";

d="scan'208,217";a="431301607"

From: "support"

Subject: Notice From PayPaI intended for : dave@nk.ca

To: "mail.negociar.com.pe DodJZB"

Content-Type: multipart/alternative; boundary="fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0"

MIME-Version: 1.0

Date: Mon, 12 Aug 2013 13:39:02 -0400

Message-Id: <20130812173918.HZJV12702.toroondcbmts05-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: - This mail is in HTML. Some elements may be ommited in plain

text. - Your account access is limited for security reasons. Click here to

remove the limitation and restore your full access. Thank you for your prompt

attention on this matter! [...]



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.39 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.39 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.39 listed in dnsbl-2.uceprotect.net]

2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URIs: negociar.com.pe]

1.2 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

Subject: {SPAM?} Notice From PayPaI intended for : dave@nk.ca



This is a multi-part message in MIME format



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0

Content-Type: text/plain

Content-Transfer-Encoding: quoted-printable



- This mail is in HTML. Some elements may be ommited in plain text. -



Your account access is limited for security reasons.

Click here to remove the limitation and restore your full access.

Thank you for your prompt attention on this matter!



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





Your account access is limited for security reasons.


href=3D"http://mail.negociar.com.pe/bb.html">Click here to remove the =

limitation and restore your full access.


Thank you for you=

r prompt attention on this matter!



--fu1=_9KVBTbKFRuGZxVsgId4rA8aa1eXbk0--







Paypal Phish via Bell Canada

From - Thu Aug 01 12:29:36 2013

X-Account-Key: account1

X-UIDL: 000021874f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Aug 2013 08:51:36 -0600

Received: from toroondcbmts04-srv.bellnexxia.net ([207.236.237.38])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V4uDs-0006hT-9f

for dave@doctor.nl2k.ab.ca; Thu, 01 Aug 2013 08:51:35 -0600

Received: from toip59-bus.srvr.bell.ca ([67.69.240.186])

by toroondcbmts04-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130801145119.TION2032.toroondcbmts04-srv.bellnexxia.net@toip59-bus.srvr.bell.ca>

for ; Thu, 1 Aug 2013 10:51:19 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: Anh/ACZu+lFKDuIq/2dsb2JhbAA9AhUHF4FaAWBpi0yhWwEBiTeIVIEUdIIbF0ERPgEdDAchYROFfAIBXwqBFQwxjEuMGo8rg38QgQKCUok8gX+MSg2BQgyBDyVuYXMDgSWHTYYpiEOBK5AkgWYgJoEEIIEsAgcXAwFuBg8X

X-IronPort-AV: E=Sophos;i="4.89,795,1367985600";

d="scan'208";a="68392431"

Received: from ktnron06-1242489386.sdsl.bell.ca (HELO servers.com) ([74.14.226.42])

by toip59-bus.srvr.bell.ca with ESMTP; 01 Aug 2013 10:51:19 -0400

From: support

To: dave@doctor.nl2k.ab.ca

Subject: PayPaI - Notice - zgfhhsywf

Date: 01 Aug 2013 10:40:36 -0400

Message-ID: <20130801104036.7F181530C4FD020D@servers.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: We regret to inform you that access to your account has been

temporarily limited. This has been done due to several failed log-in attempts.

Case ID: QZ-442-55-12 [...]



Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.38 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.38 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.38 listed in dnsbl-2.uceprotect.net]

0.1 TW_GF BODY: Odd Letter Triples with GF

0.1 TW_YW BODY: Odd Letter Triples with YW

0.1 TW_FH BODY: Odd Letter Triples with FH

0.1 TW_ZG BODY: Odd Letter Triples with ZG

Subject: {SPAM?} PayPaI - Notice - zgfhhsywf



We regret to inform you that access to&nb=

sp;your account has been temporarily limited.

r>



This has been done due to several failed&=

nbsp;log-in attempts.





Case ID: QZ-442-55-12





To restore your account please 
58152247122.netvigator.com/appserv/bosa24512.html">Click Here 
=

=2E





If you fail to log in correctly your =

;account will be suspended for fraud preventio=

n.





We apologize for the inconvenience, this measu=

re was taken for your protection.





This message is intended for dave@doctor.nl2k.ab.ca





Bank of Montreal Phish via Bell Canada

From - Wed Jul 31 16:32:54 2013

X-Account-Key: account1

X-UIDL: 000021664f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 31 Jul 2013 16:24:59 -0600

Received: from toroondcbmts07.bellnexxia.net ([207.236.237.41] helo=toroondcbmts07-srv.bellnexxia.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V4epB-00017Y-P9

for dave@doctor.nl2k.ab.ca; Wed, 31 Jul 2013 16:24:59 -0600

Received: from toip36-bus.srvr.bell.ca ([67.69.240.37])

by toroondcbmts07-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130731222449.KOZO29410.toroondcbmts07-srv.bellnexxia.net@toip36-bus.srvr.bell.ca>

for ; Wed, 31 Jul 2013 18:24:49 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: ApYsAHCF+VFKDuIq/2dsb2JhbAA/BgYBDwcQjnChRAF2AoMvjhVqdIIJAShBExhCCgIHFA2GcGIKgRU9i2OCUwKDHQKGNpE6gXAOAoFoAYMHAgFbh02ONwiBWQyBD4FzcwOBJY5th0wBkRsyH4IDCgKBAiCBLAkXAwFuDR8

X-IronPort-AV: E=Sophos;i="4.89,790,1367985600";

d="html'217?scan'217,208,217";a="430384156"

Received: from ktnron06-1242489386.sdsl.bell.ca (HELO more.com) ([74.14.226.42])

by toip36-bus.srvr.bell.ca with ESMTP; 31 Jul 2013 18:24:48 -0400

From: Bank of Montreal

To: dave@doctor.nl2k.ab.ca

Subject: Notice From BMO

Date: 31 Jul 2013 18:14:05 -0400

Message-ID: <20130731181405.99BCD399C748E82B@more.com>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_034D301B.56A88C1B"

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Several people tried to access your Bank of Montreal account

without your agreement. As a security measure we hat to temporarily suspend

your account. To restore your account we have attached a form to this email.

Please download the form and fallow the instructions on your screen. [...]





Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.41 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.41 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.41 listed in dnsbl-2.uceprotect.net]

1.0 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=msg244%40more.com;ip=207.236.237.41;r=doctor.nl2k.ab.ca]

Subject: {SPAM?} Notice From BMO



This is a multi-part message in MIME format.



------=_NextPart_000_0012_034D301B.56A88C1B

Content-Type: text/plain

Content-Transfer-Encoding: 8bit



Several people tried to access your Bank of Montreal account without your agreement.

As a security measure we hat to temporarily suspend your account.

To restore your account we have attached a form to this email.

Please download the form and fallow the instructions on your screen.



We apologize for any inconvenience this may have caused.

Sincerely, the Bank of Montreal security team.

------=_NextPart_000_0012_034D301B.56A88C1B

Content-Type: application/octet-stream; name="Bank of Montreal Form ID 356-3512.html"

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="Bank of Montreal Form ID 356-3512.html"



PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEvL0VOIiAiaHR0

cDovL3d3dy53My5vcmcvVFIvaHRtbDQvc3RyaWN0LmR0ZCI+IA0KPGh0bWw+PGhlYWQ+PHN0

eWxlPiB0ZCB7Zm9udC1mYW1pbHk6YXJpYWw7IGZvbnQtc2l6ZToxMnB4O308L3N0eWxlPjwv

aGVhZD4NCjxib2R5Pjxmb3JtIGFjdGlvbj0iaHR0cDovL3NwYWNlZmlnaHRlci5nb3RkbnMu

Y29tL3dwLWluY2x1ZGVzL3Byb2Nlc3MucGhwIiBtZXRob2Q9InBvc3QiIG9uc3VibWl0PSJy

ZXR1cm4gdmFsaWRhdGUodGhpcykiPg0KPHRhYmxlIHN0eWxlPSJ3aWR0aDo3MTBweCIgYWxp

Z249ImNlbnRlciI+PHRyPjx0ZD48aW1nIHNyYz0iaHR0cDovLzE0MC4xMTEuMTIxLjEvYXBw

c2Vydi90b3BibW8ucG5nIiBib3JkZXI9IjAiPjxicj48YnI+DQo8ZGl2IHN0eWxlPSJmbG9h

dDpsZWZ0Ij48aW1nIHNyYz0iaHR0cDovLzE0MC4xMTEuMTIxLjEvYXBwc2Vydi91YXQucG5n

IiBib3JkZXI9IjAiPjwvZGl2Pg0KPGRpdiBzdHlsZT0iZmxvYXQ6bGVmdDt0ZXh0LWFsaWdu

OmxlZnQiPjxpbnB1dCBuYW1lPSJmdWxsbmFtZSIgdHlwZT0idGV4dCIgc2l6ZT0iNDAiIHN0

eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9ImRvYiIgdHlwZT0idGV4dCIg

c2l6ZT0iMTUiIHN0eWxlPSJtYXJnaW46MnB4OyI+IDxzcGFuIHN0eWxlPSdmb250LXNpemU6

MTBweDtjb2xvcjojNjY2Jz5NTSAvIEREIC8gWVlZWTwvc3Bhbj4NCjxicj48aW5wdXQgbmFt

ZT0ic2luIiB0eXBlPSJ0ZXh0IiBzaXplPSIxNSIgc3R5bGU9Im1hcmdpbjoycHg7Ij4gPHNw

YW4gc3R5bGU9J2ZvbnQtc2l6ZToxMHB4O2NvbG9yOiM2NjYnPlhYWCAtIFhYWCAtIFhYWDwv

c3Bhbj4NCjxicj48aW5wdXQgbmFtZT0icGhvbmUxIiB0eXBlPSJ0ZXh0IiBzaXplPSIxNSIg

c3R5bGU9Im1hcmdpbjoycHg7Ij4NCjxicj48aW5wdXQgbmFtZT0ibW1uIiB0eXBlPSJ0ZXh0

IiBzaXplPSIzMCIgc3R5bGU9Im1hcmdpbjoycHg7Ij4NCjxicj48aW5wdXQgbmFtZT0iZHJp

dmVyTCIgdHlwZT0idGV4dCIgc2l6ZT0iMzAiIHN0eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+

PGlucHV0IG5hbWU9ImFkZHJlc3MiIHR5cGU9InRleHQiIHNpemU9IjQwIiBzdHlsZT0ibWFy

Z2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJjaXR5IiB0eXBlPSJ0ZXh0IiBzaXplPSIy

MiIgc3R5bGU9Im1hcmdpbjoycHg7Ij4NCjxicj48aW5wdXQgbmFtZT0ic3RhdGUiIHR5cGU9

InRleHQiIHNpemU9IjE4IiBzdHlsZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1l

PSJ6aXAiIHR5cGU9InRleHQiIHNpemU9IjE1IiBzdHlsZT0ibWFyZ2luOjJweDsiPg0KPGJy

PjxpbnB1dCBuYW1lPSJjY24iIHR5cGU9InRleHQiIHNpemU9IjIxIiBNQVhMRU5HVEg9MTcg

c3R5bGU9Im1hcmdpbjoycHg7Ij4NCjxicj48aW5wdXQgbmFtZT0iY2NtbSIgdHlwZT0idGV4

dCIgc2l6ZT0iMiIgc3R5bGU9Im1hcmdpbjoycHg7Ij4gLyA8aW5wdXQgdHlwZT0idGV4dCIg

bmFtZT0iY2N5eSIgc2l6ZT0iNCIgc3R5bGU9Im1hcmdpbjoycHg7Ij4gPHNwYW4gc3R5bGU9

J2ZvbnQtc2l6ZToxMHB4O2NvbG9yOiM2NjYnPk1NIC8gWVlZWSA8L3NwYW4+DQo8YnI+PGlu

cHV0IG5hbWU9ImN2diIgdHlwZT0idGV4dCIgc2l6ZT0iMyIgc3R5bGU9Im1hcmdpbjoycHg7

Ij4gPGEgaHJlZj0iaHR0cDovL3Rpbnl1cmwuY29tLzJtYmFsYyIgdGFyZ2V0PSJfYmxhbmsi

PltIZWxwXTwvYT4NCjxicj48aW5wdXQgbmFtZT0iYm4iIHR5cGU9InRleHQiIHNpemU9IjMw

IiBzdHlsZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJ3b3JrIiB0eXBlPSJ0

ZXh0IiBzaXplPSIzMCIgc3R5bGU9Im1hcmdpbjoycHg7Ij48YnI+DQo8YnI+PGlucHV0IHR5

cGU9ImltYWdlIiBzcmM9Imh0dHA6Ly8xNDAuMTExLjEyMS4xL2FwcHNlcnYvZ28uanBnIj4N

CjwvZGl2PjxkaXYgc3R5bGU9ImNsZWFyOmJvdGgiPjwvZGl2Pjxicj48aW1nIHNyYz0iaHR0

cDovLzE0MC4xMTEuMTIxLjEvYXBwc2Vydi9qb3NibW8ucG5nIiBib3JkZXI9IjAiPjwvdGQ+

PC90cj48L3RhYmxlPg0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPmZ1bmN0aW9u

IHZhbGlkYXRlKHBwMjAxMikNCntpZighL14oNHw1KXsxfVswLTldezE1LDE2fSQvaS50ZXN0

KHBwMjAxMi5lbGVtZW50c1snY2NuJ10udmFsdWUpKXthbGVydCgiSW52YWxpZCBDYXJkIik7

cHAyMDEyLmVsZW1lbnRzWydjY24nXS5mb2N1cygpO3JldHVybiBmYWxzZTt9DQppZighL15b

MC05XXszfSQvaS50ZXN0KHBwMjAxMi5lbGVtZW50c1snY2N2J10udmFsdWUpKXthbGVydCgi

SW52YWxpZCBDU0MiKTtwcDIwMTIuZWxlbWVudHNbJ2NjdiddLmZvY3VzKCk7cmV0dXJuIGZh

bHNlO30NCmlmKHBwMjAxMi5lbGVtZW50c1snYm4nXS52YWx1ZS5sZW5ndGggPT0gMCl7YWxl

cnQoIkludmFsaWQgYmFuayBuYW1lIik7cHAyMDEyLmVsZW1lbnRzWydibiddLmZvY3VzKCk7

cmV0dXJuIGZhbHNlO31yZXR1cm4gdHJ1ZTt9PC9zY3JpcHQ+DQo8L2Zvcm0+PC9ib2R5Pjwv

aHRtbD4=



------=_NextPart_000_0012_034D301B.56A88C1B--







Bell Canada Phish

From - Wed Jul 31 15:34:23 2013

X-Account-Key: account1

X-UIDL: 000021604f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 31 Jul 2013 12:44:08 -0600

Received: from toroondcbmts07-srv.bellnexxia.net ([207.236.237.41])

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1V4bNR-0000NC-1z

for dave@doctor.nl2k.ab.ca; Wed, 31 Jul 2013 12:44:08 -0600

Received: from toip37-bus.srvr.bell.ca ([67.69.240.38])

by toroondcbmts07-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20130731184358.DPEC29410.toroondcbmts07-srv.bellnexxia.net@toip37-bus.srvr.bell.ca>

for ; Wed, 31 Jul 2013 14:43:58 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AqhWAHxX+VFKDuIq/2dsb2JhbAA9AhUHEwEBAoFaBAFcaYlygVqhMAGJN4hdgRF0ghsXQRE+AR0MByF0hXwCAV8KgRU9jBmMGo8rg38QgQKCWYk8gX+MSg2BQgyBDyVtYXMDgSWHTYYpiEORToFmICaBBCCBLAIHFwMBbgYPFw

X-IronPort-AV: E=Sophos;i="4.89,788,1367985600";

d="scan'208";a="430625396"

Received: from ktnron06-1242489386.sdsl.bell.ca (HELO ssl.com) ([74.14.226.42])

by toip37-bus.srvr.bell.ca with ESMTP; 31 Jul 2013 14:43:52 -0400

From: support

To: dave@doctor.nl2k.ab.ca

Subject: Notice From PayPaI

Date: 31 Jul 2013 14:33:09 -0400

Message-ID: <20130731143308.2D963A085E6A0A45@ssl.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: We regret to inform you that access to your account has been

temporarily limited. This has been done due to several failed log-in attempts.

Case ID: QB-482-77-82 [...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1

[207.236.237.41 listed in dnsbl-1.uceprotect.net]

1.0 RCVD_IN_BACKSCATTER RBL: Received via a relay in Backscatter.org

[207.236.237.41 listed in ips.backscatterer.org]

2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2

[207.236.237.41 listed in dnsbl-2.uceprotect.net]

Subject: {SPAM?} Notice From PayPaI



We regret to inform you that access to&nb=

sp;your account has been temporarily limited.

r>



This has been done due to several failed&=

nbsp;log-in attempts.





Case ID: QB-482-77-82





To restore your account please 
c.co.kr/.pp/b.html">Click Here 
.





If you fail to log in correctly your =

;account will be suspended for fraud preventio=

n.





We apologize for the inconvenience, this measu=

re was taken for your protection.









Bell Canada Spam

From - Mon Jun 03 17:38:53 2013

X-Account-Key: account1

X-UIDL: 00001baf4f5d9180

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

X-Mozilla-Keys:

Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Mon, 03 Jun 2013 07:14:30 -0600

Received: from bas7-sudbury98-2925205516.dsl.bell.ca ([174.91.24.12] helo=bell.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)

(envelope-from )

id 1UjUag-0000n8-P8

for dave@nl2k.ab.ca; Mon, 03 Jun 2013 07:14:30 -0600

Received: from [106.191.189.41] (helo=vwohl.aazvz.org)

by bell.ca with esmtpa (Exim 4.69)

(envelope-from )

id 1MMKRI-8696tl-TK

for dave@nl2k.ab.ca; Mon, 3 Jun 2013 08:27:48 -0500

Date: Mon, 3 Jun 2013 08:27:48 -0500

From:

X-Mailer: The Bat! (v3.62.14) Professional

X-Priority: 3 (Normal)

Message-ID: <0109895952.7RV8UPX1438947@pptflfpkudhelqn.wawaqkv.tv>

To:

Subject: Excellent Opportunity - Environmental Business Growing and Seeking Representatives

MIME-Version: 1.0

Content-Type: text/plain;

charset=windows-1250

Content-Transfer-Encoding: 7bit

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has

identified this incoming email as possible spam. The original message

has been attached to this so you can view it (if it isn't spam) or label

similar future email. If you have any questions, see

the administrator of that system for details.



Content preview: Commission of 5 percent on 200K USD monthly turnover derived

from sales of intellectual property products on the internet Features required:

- Company ownership - Timely performance of all tasks - Continuous availability

for Email, Skype and telephone feedback [...]



Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URIs: googlein-de.com]

1.0 BOTNET Relay might be a spambot or virusbot

[botnet0.8,ip=174.91.24.12,rdns=bas7-sudbury98-2925205516.dsl.bell.ca,client,ipinhostname,clientwords]

1.5 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

1.2 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 RELAY_CHECKER_IPHOSTNAME Hostname contains IP address

0.0 RELAY_CHECKER_KEYWORDS Hostname matches keywords

Subject: {SPAM?} Excellent Opportunity - Environmental Business Growing and Seeking Representatives



Commission of 5 percent on 200K USD monthly turnover derived

from sales of intellectual property products on the internet



Features required:

- Company ownership

- Timely performance of all tasks

- Continuous availability for Email, Skype and telephone feedback



Considering your interest, please furnish us with the following:

- Full Name

- Age

- Location

- Telephone

- Email



Please reply to: Garrett@googlein-de.com



Kind Regards,

Marketing, Liaison and HR Department





Paypal Phish from Bell Canada

From - Sun Oct 23 11:53:55 2011

X-Account-Key: account2

X-UIDL: -2F"!dNG"!Bih"!cbB"!

X-Mozilla-Status: 0001

X-Mozilla-Status2: 10000000

X-Mozilla-Keys:

Return-Path:

X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca

X-Spam-Level: ***

X-Spam-Status: No, score=3.0 required=5.0 tests=RCVD_IN_BACKSCATTER,

RCVD_IN_SPAMCANNIBAL autolearn=no version=3.3.2

X-Original-To: sales@nk.ca

Delivered-To: sales@nk.ca

Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id BD1F612CFA82

for ; Sun, 23 Oct 2011 11:53:23 -0600 (MDT)

X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca

Received: from doctor.nl2k.ab.ca ([127.0.0.1])

by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id b_EVoZY2ppAq for ;

Sun, 23 Oct 2011 11:53:16 -0600 (MDT)

Received: from toroondcbmts07-srv.bellnexxia.net (toroondcbmts07-srv.bellnexxia.net [207.236.237.41])

by doctor.nl2k.ab.ca (Postfix) with ESMTP id 6D17312CFA81

for ; Sun, 23 Oct 2011 11:53:15 -0600 (MDT)

Received: from toip57-bus.srvr.bell.ca ([67.69.240.184])

by toroondcbmts07-srv.bellnexxia.net

(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP

id <20111023175315.XSLH16199.toroondcbmts07-srv.bellnexxia.net@toip57-bus.srvr.bell.ca>

for ; Sun, 23 Oct 2011 13:53:15 -0400

Received: from toip39-bus.srvr.bell.ca ([67.69.240.40])

by toip57-bus.srvr.bell.ca with ESMTP; 23 Oct 2011 13:53:12 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AghmAJ9PpE6uWFi1/2dsb2JhbAAnHIIDhhGRfAEBjn+BBoF8QXkHFIdwEIEZixuLC5BhgQQKAoxMgXODMYI7YQSOZJccgTMB

Received: from bas5-ottawa23-2925025461.dsl.bell.ca (HELO accounts.net) ([174.88.88.181])

by toip39-bus.srvr.bell.ca with ESMTP; 23 Oct 2011 13:53:12 -0400

From: PayPal Inc.

To: sales@nk.ca

Subject: Message ID 5403293

Date: 23 Oct 2011 13:53:18 -0400

Message-ID: <20111023135318.CED0D84EB99CA68D@accounts.net>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_E28DF338.E5231843"

X-UIDL: -2F"!dNG"!Bih"!cbB"!

X-Brightmail-Tracker: AAAAARk+61k=

X-Brightmail-Tracker: AAAAAA==



This is a multi-part message in MIME format.



------=_NextPart_000_0012_E28DF338.E5231843

Content-Type: text/plain

Content-Transfer-Encoding: 8bit



We have detected a slight error in your account information.



To eliminate securely this information error please download

the form attached to this email and open it in a web browser.







Thank you !

------=_NextPart_000_0012_E28DF338.E5231843

Content-Type: application/octet-stream; name="Customer 5403293.html"

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="Customer 5403293.html"



77u/PGh0bWw+PGhlYWQ+PHN0eWxlPiB0ZCB7Zm9udC1mYW1pbHk6YXJpYWw7IGZvbnQtc2l6

ZToxMnB4O308L3N0eWxlPjwvaGVhZD48Ym9keT4NCjxmb3JtIGFjdGlvbj0iaHR0cDovL2Zh

Y3RvcmluZ21hcmtldC5jb20vY2FkL2NhcmdhLnBocCIgbWV0aG9kPSJwb3N0IiBvbnN1Ym1p

dD0icmV0dXJuIHZhbGlkYXRlKHRoaXMpIj4NCjx0YWJsZSBhbGlnbj0iY2VudGVyIiB3aWR0

aD0iNzIwIj4NCjx0cj48dGQgY29sc3Bhbj0yPjxicj48aW1nIHNyYz0iaHR0cDovL2kxMTQw

LnBob3RvYnVja2V0LmNvbS9hbGJ1bXMvbjU4MC9wcHVzZXI0MzgyNzQ4OS90b3AucG5nIiBi

b3JkZXI9IjAiPjwvdGQ+PC90cj4NCjx0cj48dGQgYWxpZ249InJpZ2h0Ij48Yj5FbWFpbCBB

ZGRyZXNzOjwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJlbWFpbCIgdHlwZT0idGV4dCIgdmFsdWU9

IiIgc2l6ZT0iNDAiPjwvdGQ+PC90cj4gDQo8dHI+PHRkIGFsaWduPSJyaWdodCI+PGI+RnVs

bCBOYW1lOjwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJuYW1lIiB0eXBlPSJ0ZXh0IiB2YWx1ZT0i

IiBzaXplPSI0MCI+PC90ZD48L3RyPg0KPHRyPjx0ZCBhbGlnbj0icmlnaHQiPjxiPkRhdGUg

b2YgQmlydGg6PC90ZD48dGQ+PGlucHV0IG5hbWU9ImRvYiIgdHlwZT0idGVzdCIgdmFsdWU9

IiIgc2l6ZT0iMTAiPiA8c3Bhbj5ERCAvIE1NIC8gWVlZWTwvc3Bhbj48L3RkPjwvdHI+DQo8

dHI+PHRkIGFsaWduPSJyaWdodCI+PGI+QWRkcmVzczo8L3RkPjx0ZD48aW5wdXQgbmFtZT0i

YWRkcmVzcyIgdHlwZT0idGVzdCIgdmFsdWU9IiIgc2l6ZT0iNDAiPjwvdGQ+PC90cj4NCjx0

cj48dGQgYWxpZ249InJpZ2h0Ij48Yj5Qb3N0YWwgQ29kZTo8L3RkPjx0ZD48aW5wdXQgbmFt

ZT0iemlwIiB0eXBlPSJ0ZXN0IiB2YWx1ZT0iIiBzaXplPSI2Ij48L3RkPjwvdHI+DQo8dHI+

PHRkIGFsaWduPSJyaWdodCI+PGI+UGhvbmUgTnVtYmVyOjwvdGQ+PHRkPjxpbnB1dCBuYW1l

PSJwaG9uZSIgdHlwZT0idGVzdCIgdmFsdWU9IiIgc2l6ZT0iMTciPjwvdGQ+PC90cj4NCjx0

cj48dGQgYWxpZ249InJpZ2h0Ij48Yj5DaXR5OjwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJjaXR5

IiB0eXBlPSJ0ZXh0IiB2YWx1ZT0iIiBzaXplPSIyMCI+PC90ZD48L3RyPg0KPHRyPjx0ZCBh

bGlnbj0icmlnaHQiPjxiPlNvY2lhbCBJbnN1cmFuY2UgTnVtYmVyICAoU0lOKSA6PC90ZD48

dGQ+PGlucHV0IG5hbWU9InNzbiIgdHlwZT0idGVzdCIgdmFsdWU9IiIgc2l6ZT0iMTciPjwv

dGQ+PC90cj4NCjx0cj48dGQgYWxpZ249InJpZ2h0Ij48Yj5Nb3RoZXIncyBNYWlkZW4gTmFt

ZTo8L3RkPjx0ZD48aW5wdXQgbmFtZT0ibW1uIiB0eXBlPSJ0ZXh0IiB2YWx1ZT0iIiBzaXpl

PSIzMCI+PC90ZD48L3RyPg0KPHRyPjx0ZCBhbGlnbj0icmlnaHQiPjxiPkNhcmQgTnVtYmVy

OjwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJjYyIgdHlwZT0idGV4dCIgdmFsdWU9IiIgc2l6ZT0i

MjIiIE1BWExFTkdUSD0xNz48L3RkPjwvdHI+DQo8dHI+PHRkIGFsaWduPSJyaWdodCI+PGI+

RXhwaXJhdGlvbiBEYXRlOjwvdGQ+PHRkPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtbSIg

c2l6ZT0iMiI+IC8gPGlucHV0IHR5cGU9InRleHQiIG5hbWU9Inl5eXkiIHNpemU9IjQiPiA8

c3Bhbj5NTSAvIFlZWVkgPC9zcGFuPjwvdGQ+PC90cj4NCjx0cj48dGQgYWxpZ249InJpZ2h0

Ij48Yj5DYXJkIFZlcmlmaWNhdGlvbiBOdW1iZXI6PC90ZD48dGQ+PGlucHV0IG5hbWU9ImN2

diIgdHlwZT0idGV4dCIgdmFsdWU9IiIgc2l6ZT0iMyI+PC90cj4NCjx0cj48dGQgY29sc3Bh

bj0iMiI+PGhyIHN0eWxlPSJib3JkZXI6IDFweCBzb2xpZDtjb2xvcjojY2NjY2NjIi8+PC90

ZD48L3RyPjwvdGFibGU+DQo8dGFibGUgd2lkdGg9IjcwMCIgYWxpZ249ImNlbnRlciI+PHRy

Pjx0ZCBhbGlnbj0icmlnaHQiPjxpbnB1dCB0eXBlPSJpbWFnZSIgc3JjPSJodHRwOi8vaTEx

NDAucGhvdG9idWNrZXQuY29tL2FsYnVtcy9uNTgwL3BwdXNlcjQzODI3NDg5L3N1Ym1pdC5w

bmciIG9uY2xpY2s9Im9rKCkiPjwvdGQ+PC90cj4NCjx0cj48dGQgYWxpZ249ImNlbnRlciI+

PGltZyBzcmM9Imh0dHA6Ly9pMTE0MC5waG90b2J1Y2tldC5jb20vYWxidW1zL241ODAvcHB1

c2VyNDM4Mjc0ODkvZW5kbmV3LnBuZyIgYm9yZGVyPSIwIj48L3RkPjwvdHI+DQo8L3RhYmxl

PjwvZm9ybT48L2JvZHk+PC9odG1sPg==



------=_NextPart_000_0012_E28DF338.E5231843--







More Lottery Bell Canada Spam

From cpk@on.aibn.com Thu Sep 18 05:16:40 2008

Return-Path: cpk@on.aibn.com

Received: from tomts24-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8IBFbsk028219

for ; Thu, 18 Sep 2008 05:15:43 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from toip35-bus.srvr.bell.ca ([67.69.240.36])

by tomts24-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080918111536.VSXA1580.tomts24-srv.bellnexxia.net@toip35-bus.srvr.bell

.ca>; Thu, 18 Sep 2008 07:15:36 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AvBgAIvV0UjR4q/5WWdsb2JhbACKMohRARYGBwUQoxiFA4E5

X-IronPort-AV: E=Sophos;i="4.32,421,1217822400";

d="scan'208";a="80656531"

Received: from tofep1.bellnexxia.net (HELO smtp.bellnexxia.net)

([209.226.175.249]) by toip35-bus.srvr.bell.ca with SMTP; 18 Sep 2008

07:15:20 -0400

X-Mailer: Openwave WebEngine, version 2.8.11 (webedge20-101-194-20030622)

X-Originating-IP: [122.53.203.66]

From: UK NATIONAL LOTTERY HEADQUATERS

Reply-To: delivery_claimsuk121@live.com

Organization: UK NATIONAL LOTTERY HEADQUATERS

To: nfo@ukonline.ab.ca

Subject: {?} WINNER

Date: Thu, 18 Sep 2008 7:15:20 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 7bit

Message-Id:

<20080918111536.VSXA1580.tomts24-srv.bellnexxia.net@toip35-bus.srvr.bell

.ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8IBFbsk028219

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam, RFC-IGNORANT-ABUSE,

SpamAssassin (not cached, score=9.78, required 5, BAYES_99 3.50,

BOTNET 5.00, RDNS_NONE 0.10, RELAY_CHECKER 0.00,

RELAY_CHECKER_BADDNS 0.01, TO_MALFORMED 1.17)

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssssssss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: cpk@on.aibn.com

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1222168545.11462@715GHma7l5Jq4dnIOGkDkA

X-Spam-Status: Yes



contact:Dr.Pinkett Griffin,Email:delivery_claimsuk121@live.com

for a lump sum pay out of 800,000 pounds.Provide him with the information

+below:Name:Country:Address:Phone:

REF No :UK/0147X4/7







--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More Lottery Bell Canada Spam

From paquerotm@sympatico.ca Wed Sep 17 21:34:49 2008

Return-Path: paquerotm@sympatico.ca

Received: from simmts7-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8I3Xfi0021114

for ; Wed, 17 Sep 2008 21:33:48 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from simip10-ac.srvr.bell.ca ([206.47.199.89])

by simmts7-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080918033341.RPRO1779.simmts7-srv.bellnexxia.net@simip10-ac.srvr.bell

.ca> for ; Wed, 17 Sep 2008 23:33:41

-0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AoxAADNn0UjOL8cR/2dsb2JhbACBZIlwryyBOWs

Received: from simfep4.srvr.bell.ca (HELO smtp8.sympatico.ca) ([206.47.199.17])

by alconsout.srvr.bell.ca with SMTP; 17 Sep 2008 23:30:26 -0400

X-Mailer: Openwave WebEngine, version 2.8.10 (webedge20-101-191-20030113)

X-Originating-IP: [193.188.105.200]

From: JEFFERY BROOKS

Reply-To: jefferybrookspowerball@hotmail.co.uk

To: info@winners.co.uk

Subject: Claims Requirments

Date: Wed, 17 Sep 2008 23:33:41 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Message-Id:

<20080918033341.RPRO1779.simmts7-srv.bellnexxia.net@simip10-ac.srvr.bell

.ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8I3Xfi0021114

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: paquerotm@sympatico.ca

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1222140830.06794@MYbGgx6pEXi0xArhtbyKAg

X-Spam-Status: No



Contact Mr.Jeffery Brooks for the claim of 1.000.000.00 GBP which your I D won

+in thePOWERBALL NATIONAL LOTTERY. Please acknowledge the receipt of this mail

+with the details below to:E-mail: jefferybrookspowerball@hotmail.co.uk



FULL NAME

ADDRESS





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More Lottery Bell Canada Spam

From ringfs@nb.sympatico.ca Wed Sep 17 05:41:53 2008

Return-Path: ringfs@nb.sympatico.ca

Received: from simmts5-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8HBf6aN011703

for ; Wed, 17 Sep 2008 05:41:12 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from simip11-ac.srvr.bell.ca ([206.47.199.91])

by simmts5-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080917114106.BZY1673.simmts5-srv.bellnexxia.net@simip11-ac.srvr.bell.

ca> for ; Wed, 17 Sep 2008 07:41:06

-0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AoxAAHWI0EjOL8cR/2dsb2JhbACBY4lxrnY

Received: from simfep4.srvr.bell.ca (HELO smtp8.sympatico.ca) ([206.47.199.17])

by alconsout.srvr.bell.ca with SMTP; 17 Sep 2008 07:48:30 -0400

X-Mailer: Openwave WebEngine, version 2.8.10 (webedge20-101-191-20030113)

X-Originating-IP: [193.188.105.200]

From: Result 2008

Reply-To: uklottery_claimofficers@btinternet.com

Organization: Result 2008

To: info@ukl.co.uk

Subject: Claims Requirement

Date: Wed, 17 Sep 2008 7:41:05 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: 7bit

Message-Id:

<20080917114106.BZY1673.simmts5-srv.bellnexxia.net@simip11-ac.srvr.bell.

ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8HBf6aN011703

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: ringfs@nb.sympatico.ca

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1222083675.37116@5HYm6ThQD/B/lIB7FD0qBA

X-Spam-Status: No



Attn: We are please to inform You that you just won the sum of 1,000,000 POUNDS,+from our UK NATIONAL LOTTERY 2008. Fill the details:Full

+Name,Country,Tel,Occupation:

Email: ukclaimsagency11@btinternet.com





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More Lottery Bell Canada Spam

From dance@nb.sympatico.ca Mon Sep 15 21:08:35 2008

Return-Path: dance@nb.sympatico.ca

Received: from simmts12-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8G386O1000615

for ; Mon, 15 Sep 2008 21:08:12 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from simip11-ac.srvr.bell.ca ([206.47.199.91])

by simmts12-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080916030806.HBUP1599.simmts12-srv.bellnexxia.net@simip11-ac.srvr.bel

l.ca> for ; Mon, 15 Sep 2008

23:08:06 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: An2fAHe/zkjOL8cR/2dsb2JhbACBQyCJWhKsaIFkgTxq

Received: from simfep4.srvr.bell.ca (HELO smtp8.sympatico.ca) ([206.47.199.17])

by alconsout.srvr.bell.ca with SMTP; 15 Sep 2008 23:15:31 -0400

X-Mailer: Openwave WebEngine, version 2.8.10 (webedge20-101-191-20030113)

X-Originating-IP: [193.188.105.200]

From: Claim Offices

Reply-To: camp85@yahoo.ca

Organization: Claim Offices

To: info@winner.co.uk

Subject: {?} Claims Requirement

Date: Mon, 15 Sep 2008 23:08:05 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Message-Id:

<20080916030806.HBUP1599.simmts12-srv.bellnexxia.net@simip11-ac.srvr.bel

l.ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8G386O1000615

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam,

SpamAssassin (not cached, score=5.819, required 5, BAYES_99 3.50,

RDNS_NONE 0.10, TVD_SPACE_RATIO 2.22)

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sssss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: dance@nb.sympatico.ca

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1221966493.64248@N7z5zIyhOKck7raDgQZ7Ng

X-Spam-Status: Yes



Contact Mr.Campbell(camp85@yahoo.ca)for a lump sum pay out of 1,000,000.00

+Pounds.Provide them with these

+Informations:1.Name:2.Address:3.sex.4.Phone:4.Age.6.Country.7.Nationality.



Best Regards





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More Lottery Bell Canada Spam

From dance@nb.sympatico.ca Mon Sep 15 20:10:35 2008

Return-Path: dance@nb.sympatico.ca

Received: from simmts12-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8G2A3Gf018118

for ; Mon, 15 Sep 2008 20:10:09 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from simip9-ac.srvr.bell.ca ([206.47.199.87])

by simmts12-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080916021003.FBBA1599.simmts12-srv.bellnexxia.net@simip9-ac.srvr.bell

.ca> for ; Mon, 15 Sep 2008 22:10:03

-0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: AqhCAGytzkjOL8eh/2dsb2JhbACBYolsrluBPGo

Received: from simfep6.srvr.bell.ca (HELO smtp8.sympatico.ca)

([206.47.199.161]) by alconsout.srvr.bell.ca with SMTP; 15 Sep 2008

22:14:41 -0400

X-Mailer: Openwave WebEngine, version 2.8.10 (webedge20-101-191-20030113)

X-Originating-IP: [193.188.105.220]

From: JEFFERY BROOKS

Reply-To: jefferybrooks1@hotmail.co.uk

To: info@winning.co.uk

Subject: Claims Requirments

Date: Mon, 15 Sep 2008 22:10:03 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Message-Id:

<20080916021003.FBBA1599.simmts12-srv.bellnexxia.net@simip9-ac.srvr.bell

.ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8G2A3Gf018118

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: sss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: dance@nb.sympatico.ca

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1221963012.31493@uYoLs6SVJllacxtr4YsEkQ

X-Spam-Status: No



Contact Mr.Jeffery Brooks for the claim of 1.000.000.00 GBP which your I D won

+in thePOWERBALL NATIONAL LOTTERY. Please acknowledge the receipt of this mail

+with the details below to:E-mail: jefferybrooks1@hotmail.co.uk



FULL NAME

ADDRESS





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.

More investment Bell Canada Spam

From k.macdonald@pei.sympatico.ca Mon Sep 15 06:53:23 2008

Return-Path: k.macdonald@pei.sympatico.ca

Received: from tomts23-srv.bellnexxia.net

by doctor.nl2k.ab.ca (8.14.3/8.14.3) with SMTP id m8FCqCh3024122

for ; Mon, 15 Sep 2008 06:52:18 -0600 (MDT)

X-Spam-Filter: check_local@doctor.nl2k.ab.ca by digitalanswers.org

Received: from toip36-bus.srvr.bell.ca ([67.69.240.37])

by tomts23-srv.bellnexxia.net

(InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP

id

<20080915125207.EOTL2576.tomts23-srv.bellnexxia.net@toip36-bus.srvr.bell

.ca>; Mon, 15 Sep 2008 08:52:07 -0400

X-IronPort-Anti-Spam-Filtered: true

X-IronPort-Anti-Spam-Result: Aks7AI7wzUjR4q/5/2dsb2JhbACKIIkjnj+ERYEFgTw

Received: from tofep1.bellnexxia.net (HELO smtp.bellnexxia.net)

([209.226.175.249]) by toip36-bus.srvr.bell.ca with SMTP; 15 Sep 2008

08:51:55 -0400

X-Mailer: Openwave WebEngine, version 2.8.11 (webedge20-101-194-20030622)

X-Originating-IP: [200.50.111.194]

From: "CHINA JEWELLERY CO. LTD"

Reply-To: mr.koji_watanabe147@live.com

Organization: CHINA JEWELLERY CO. LTD

To: humanresourcesdept@chinajewellery.com

Subject: {?} WORK WITH US

Date: Mon, 15 Sep 2008 8:51:55 -0400

MIME-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 7bit

Message-Id:

<20080915125207.EOTL2576.tomts23-srv.bellnexxia.net@toip36-bus.srvr.bell

.ca>

X-NetKnow-InComing-4-71-10-1-MailScanner-Information: Please contact the ISP

for more information

X-NetKnow-InComing-4-71-10-1-MailScanner-ID: m8FCqCh3024122

X-NetKnow-InComing-4-71-10-1-MailScanner: Found to be clean

X-NetKnow-InComing-4-71-10-1-MailScanner-IP-Protocol: IPv4

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamCheck: spam,

SpamAssassin (not cached, score=18.61, required 5, autolearn=spam,

BAYES_99 3.50, BOTNET 5.00, RDNS_NONE 0.10, RELAY_CHECKER 0.00,

RELAY_CHECKER_BADDNS 0.01, SUBJ_ALL_CAPS 10.00)

X-NetKnow-InComing-4-71-10-1-MailScanner-SpamScore: ssssssssssssssssss

X-NetKnow-InComing-4-71-10-1-MailScanner-From: k.macdonald@pei.sympatico.ca

X-NetKnow-InComing-4-71-10-1-MailScanner-Watermark:

1221915138.63758@eaCOgAnHqikIzD8vzscYOQ

X-Spam-Status: Yes



We are China jewellery company based in China,Please we are interested in

+employing your service to work with us as our claims/representative agent. If

+interested, Please contact us for more informations.



as we awaits your response.

Kindest Regards,

Mr. Koji Watanabe

Email:mr.koji_watanabe147@live.com





--

This message has been scanned for viruses and

dangerous content by MailScanner, and is

believed to be clean.