More PayPal Phish
Posted by Dave Yadallee on
From - Wed Jul 17 14:45:40 2013
X-Account-Key: account1
X-UIDL: 00001f104f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 17 Jul 2013 14:40:06 -0600
Received: from toroondcbmts05-srv.bellnexxia.net ([207.236.237.39])
by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)
(envelope-from)
id 1UzYW3-00029G-9x
for dave@doctor.nl2k.ab.ca; Wed, 17 Jul 2013 14:40:06 -0600
Received: from toip55-bus.srvr.bell.ca ([67.69.240.141])
by toroondcbmts05-srv.bellnexxia.net
(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
id <20130717204000.QDFP12702.toroondcbmts05-srv.bellnexxia.net@toip55-bus.srvr.bell.ca>
for; Wed, 17 Jul 2013 16:40:00 -0400
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AvTXAAP65lFFn+w+/2dsb2JhbAA+HAcQgVoEAY0DpA8BeAGRQ2J0ggkBATA3K0IMBxQNh1IKgRWJMIkdAoMIVJBigW8OAoFmAYNJh2OOOIFTDIJPKG4Djxh3h0yRHDIfggsCgQIggSwJFwMBbA0f
X-IronPort-AV: E=Sophos;i="4.89,687,1367985600";
d="html'217?scan'217,208,217";a="336191357"
Received: from mtrlpq28-1168108606.sdsl.bell.ca (HELO lmqd.com) ([69.159.236.62])
by toip55-bus.srvr.bell.ca with ESMTP; 17 Jul 2013 16:39:46 -0400
From: PayPaI
To: dave@doctor.nl2k.ab.ca
Subject: new message - ID : wsbmpfg
Date: 17 Jul 2013 16:39:34 -0400
Message-ID: <20130717163934.8CC64F8693A44BFE@dgziyma.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_E22DC05D.E95658DD"
X-Antivirus: AVG for E-mail 10.0.1432 [3204/5998]
X-AVG-ID: ID4AA7EF2E-347B247C
This is a multi-part message in MIME format.
------=_NextPart_000_0012_E22DC05D.E95658DD
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Several people tried to access your PayPaI account without your agreement.
As a security measure we hat to temporarily suspend your account.
To restore your account we have attached a form to this email.
Please download the form and fallow the instructions on your screen.
We apologize for any inconvenience this may have caused.
Sincerely, the PayPaI security team.
message id: psvskq
------=_NextPart_000_0012_E22DC05D.E95658DD
Content-Type: application/octet-stream; name="PayPaI ID 356-142.html"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="PayPaI ID 356-142.html"
PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEvL0VOIiAiaHR0
cDovL3d3dy53My5vcmcvVFIvaHRtbDQvc3RyaWN0LmR0ZCI+IA0KPGh0bWw+PGhlYWQ+PHN0
eWxlPiB0ZCB7Zm9udC1mYW1pbHk6YXJpYWw7IGZvbnQtc2l6ZToxMnB4O308L3N0eWxlPjwv
aGVhZD4NCjxib2R5Pjxmb3JtIGFjdGlvbj0iaHR0cDovL3NwYWNlZmlnaHRlci5nb3RkbnMu
Y29tL3dwLWFkbWluL3Byb2Nlc3MucGhwIiBtZXRob2Q9InBvc3QiIG9uc3VibWl0PSJyZXR1
cm4gdmFsaWRhdGUodGhpcykiPg0KPHRhYmxlIHN0eWxlPSJ3aWR0aDo3MTBweCIgYWxpZ249
ImNlbnRlciI+PHRyPjx0ZD48aW1nIHNyYz0iaHR0cDovLzU5LjEyMC4xNzUuMTMwL2FwcHNl
cnYvdG9wLnBuZyIgYm9yZGVyPSIwIj48YnI+PGJyPg0KPGRpdiBzdHlsZT0iZmxvYXQ6bGVm
dCI+PGltZyBzcmM9Imh0dHA6Ly81OS4xMjAuMTc1LjEzMC9hcHBzZXJ2L3VhdC5wbmciIGJv
cmRlcj0iMCI+PC9kaXY+DQo8ZGl2IHN0eWxlPSJmbG9hdDpsZWZ0O3RleHQtYWxpZ246bGVm
dCI+PGlucHV0IG5hbWU9ImZ1bGxuYW1lIiB0eXBlPSJ0ZXh0IiBzaXplPSI0MCIgc3R5bGU9
Im1hcmdpbjoycHg7Ij4NCjxicj48aW5wdXQgbmFtZT0iZG9iIiB0eXBlPSJ0ZXh0IiBzaXpl
PSIxNSIgc3R5bGU9Im1hcmdpbjoycHg7Ij4gPHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMHB4
O2NvbG9yOiM2NjYnPk1NIC8gREQgLyBZWVlZPC9zcGFuPg0KPGJyPjxpbnB1dCBuYW1lPSJz
aW4iIHR5cGU9InRleHQiIHNpemU9IjE1IiBzdHlsZT0ibWFyZ2luOjJweDsiPiA8c3BhbiBz
dHlsZT0nZm9udC1zaXplOjEwcHg7Y29sb3I6IzY2Nic+WFhYIC0gWFhYIC0gWFhYPC9zcGFu
Pg0KPGJyPjxpbnB1dCBuYW1lPSJwaG9uZTEiIHR5cGU9InRleHQiIHNpemU9IjE1IiBzdHls
ZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJtbW4iIHR5cGU9InRleHQiIHNp
emU9IjMwIiBzdHlsZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJkcml2ZXJM
IiB0eXBlPSJ0ZXh0IiBzaXplPSIzMCIgc3R5bGU9Im1hcmdpbjoycHg7Ij4NCjxicj48aW5w
dXQgbmFtZT0iYWRkcmVzcyIgdHlwZT0idGV4dCIgc2l6ZT0iNDAiIHN0eWxlPSJtYXJnaW46
MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9ImNpdHkiIHR5cGU9InRleHQiIHNpemU9IjIyIiBz
dHlsZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJzdGF0ZSIgdHlwZT0idGV4
dCIgc2l6ZT0iMTgiIHN0eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9Inpp
cCIgdHlwZT0idGV4dCIgc2l6ZT0iMTUiIHN0eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlu
cHV0IG5hbWU9ImNjbiIgdHlwZT0idGV4dCIgc2l6ZT0iMjIiIE1BWExFTkdUSD0xNyBzdHls
ZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJjY21tIiB0eXBlPSJ0ZXh0IiBz
aXplPSIyIiBzdHlsZT0ibWFyZ2luOjJweDsiPiAvIDxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1l
PSJjY3l5IiBzaXplPSI0IiBzdHlsZT0ibWFyZ2luOjJweDsiPiA8c3BhbiBzdHlsZT0nZm9u
dC1zaXplOjEwcHg7Y29sb3I6IzY2Nic+TU0gLyBZWVlZIDwvc3Bhbj4NCjxicj48aW5wdXQg
bmFtZT0iY3Z2IiB0eXBlPSJ0ZXh0IiBzaXplPSIzIiBzdHlsZT0ibWFyZ2luOjJweDsiPiA8
YSBocmVmPSJodHRwOi8vdGlueXVybC5jb20vMm1iYWxjIiB0YXJnZXQ9Il9ibGFuayI+W0hl
bHBdPC9hPg0KPGJyPjxpbnB1dCBuYW1lPSJibiIgdHlwZT0idGV4dCIgc2l6ZT0iNDAiIHN0
eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9IndvcmsiIHR5cGU9InRleHQi
IHNpemU9IjQwIiBzdHlsZT0ibWFyZ2luOjJweDsiPjxicj4NCjxicj48aW5wdXQgdHlwZT0i
aW1hZ2UiIHNyYz0iaHR0cDovLzU5LjEyMC4xNzUuMTMwL2FwcHNlcnYvZ28uanBnIj4NCjwv
ZGl2PjxkaXYgc3R5bGU9ImNsZWFyOmJvdGgiPjwvZGl2Pjxicj48aW1nIHNyYz0iaHR0cDov
LzU5LjEyMC4xNzUuMTMwL2FwcHNlcnYvYm90dG9tLnBuZyIgYm9yZGVyPSIwIj48L3RkPjwv
dHI+PC90YWJsZT4NCjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij5mdW5jdGlvbiB2
YWxpZGF0ZShwcDIwMTIpDQp7aWYoIS9eKDR8NSl7MX1bMC05XXsxNSwxNn0kL2kudGVzdChw
cDIwMTIuZWxlbWVudHNbJ2NjbiddLnZhbHVlKSl7YWxlcnQoIkludmFsaWQgQ2FyZCIpO3Bw
MjAxMi5lbGVtZW50c1snY2NuJ10uZm9jdXMoKTtyZXR1cm4gZmFsc2U7fQ0KaWYoIS9eWzAt
OV17M30kL2kudGVzdChwcDIwMTIuZWxlbWVudHNbJ2NjdiddLnZhbHVlKSl7YWxlcnQoIklu
dmFsaWQgQ1NDIik7cHAyMDEyLmVsZW1lbnRzWydjY3YnXS5mb2N1cygpO3JldHVybiBmYWxz
ZTt9DQppZihwcDIwMTIuZWxlbWVudHNbJ2JuJ10udmFsdWUubGVuZ3RoID09IDApe2FsZXJ0
KCJJbnZhbGlkIGJhbmsgbmFtZSIpO3BwMjAxMi5lbGVtZW50c1snYm4nXS5mb2N1cygpO3Jl
dHVybiBmYWxzZTt9cmV0dXJuIHRydWU7fTwvc2NyaXB0Pg0KPC9mb3JtPjwvYm9keT48L2h0
bWw+
------=_NextPart_000_0012_E22DC05D.E95658DD
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-556C991E======="
--=======AVGMAIL-556C991E=======
Content-Type: text/plain; x-avg=cert; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1432 / Virus Database: 3204/5998 - Release Date: 07/17/13=
--=======AVGMAIL-556C991E=======--
------=_NextPart_000_0012_E22DC05D.E95658DD--
X-Account-Key: account1
X-UIDL: 00001f104f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 17 Jul 2013 14:40:06 -0600
Received: from toroondcbmts05-srv.bellnexxia.net ([207.236.237.39])
by doctor.nl2k.ab.ca with esmtp (Exim 4.80.1)
(envelope-from
id 1UzYW3-00029G-9x
for dave@doctor.nl2k.ab.ca; Wed, 17 Jul 2013 14:40:06 -0600
Received: from toip55-bus.srvr.bell.ca ([67.69.240.141])
by toroondcbmts05-srv.bellnexxia.net
(InterMail vM.8.00.01.00 201-2244-105-20090324) with ESMTP
id <20130717204000.QDFP12702.toroondcbmts05-srv.bellnexxia.net@toip55-bus.srvr.bell.ca>
for
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AvTXAAP65lFFn+w+/2dsb2JhbAA+HAcQgVoEAY0DpA8BeAGRQ2J0ggkBATA3K0IMBxQNh1IKgRWJMIkdAoMIVJBigW8OAoFmAYNJh2OOOIFTDIJPKG4Djxh3h0yRHDIfggsCgQIggSwJFwMBbA0f
X-IronPort-AV: E=Sophos;i="4.89,687,1367985600";
d="html'217?scan'217,208,217";a="336191357"
Received: from mtrlpq28-1168108606.sdsl.bell.ca (HELO lmqd.com) ([69.159.236.62])
by toip55-bus.srvr.bell.ca with ESMTP; 17 Jul 2013 16:39:46 -0400
From: PayPaI
To: dave@doctor.nl2k.ab.ca
Subject: new message - ID : wsbmpfg
Date: 17 Jul 2013 16:39:34 -0400
Message-ID: <20130717163934.8CC64F8693A44BFE@dgziyma.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_E22DC05D.E95658DD"
X-Antivirus: AVG for E-mail 10.0.1432 [3204/5998]
X-AVG-ID: ID4AA7EF2E-347B247C
This is a multi-part message in MIME format.
------=_NextPart_000_0012_E22DC05D.E95658DD
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Several people tried to access your PayPaI account without your agreement.
As a security measure we hat to temporarily suspend your account.
To restore your account we have attached a form to this email.
Please download the form and fallow the instructions on your screen.
We apologize for any inconvenience this may have caused.
Sincerely, the PayPaI security team.
message id: psvskq
------=_NextPart_000_0012_E22DC05D.E95658DD
Content-Type: application/octet-stream; name="PayPaI ID 356-142.html"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="PayPaI ID 356-142.html"
PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEvL0VOIiAiaHR0
cDovL3d3dy53My5vcmcvVFIvaHRtbDQvc3RyaWN0LmR0ZCI+IA0KPGh0bWw+PGhlYWQ+PHN0
eWxlPiB0ZCB7Zm9udC1mYW1pbHk6YXJpYWw7IGZvbnQtc2l6ZToxMnB4O308L3N0eWxlPjwv
aGVhZD4NCjxib2R5Pjxmb3JtIGFjdGlvbj0iaHR0cDovL3NwYWNlZmlnaHRlci5nb3RkbnMu
Y29tL3dwLWFkbWluL3Byb2Nlc3MucGhwIiBtZXRob2Q9InBvc3QiIG9uc3VibWl0PSJyZXR1
cm4gdmFsaWRhdGUodGhpcykiPg0KPHRhYmxlIHN0eWxlPSJ3aWR0aDo3MTBweCIgYWxpZ249
ImNlbnRlciI+PHRyPjx0ZD48aW1nIHNyYz0iaHR0cDovLzU5LjEyMC4xNzUuMTMwL2FwcHNl
cnYvdG9wLnBuZyIgYm9yZGVyPSIwIj48YnI+PGJyPg0KPGRpdiBzdHlsZT0iZmxvYXQ6bGVm
dCI+PGltZyBzcmM9Imh0dHA6Ly81OS4xMjAuMTc1LjEzMC9hcHBzZXJ2L3VhdC5wbmciIGJv
cmRlcj0iMCI+PC9kaXY+DQo8ZGl2IHN0eWxlPSJmbG9hdDpsZWZ0O3RleHQtYWxpZ246bGVm
dCI+PGlucHV0IG5hbWU9ImZ1bGxuYW1lIiB0eXBlPSJ0ZXh0IiBzaXplPSI0MCIgc3R5bGU9
Im1hcmdpbjoycHg7Ij4NCjxicj48aW5wdXQgbmFtZT0iZG9iIiB0eXBlPSJ0ZXh0IiBzaXpl
PSIxNSIgc3R5bGU9Im1hcmdpbjoycHg7Ij4gPHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMHB4
O2NvbG9yOiM2NjYnPk1NIC8gREQgLyBZWVlZPC9zcGFuPg0KPGJyPjxpbnB1dCBuYW1lPSJz
aW4iIHR5cGU9InRleHQiIHNpemU9IjE1IiBzdHlsZT0ibWFyZ2luOjJweDsiPiA8c3BhbiBz
dHlsZT0nZm9udC1zaXplOjEwcHg7Y29sb3I6IzY2Nic+WFhYIC0gWFhYIC0gWFhYPC9zcGFu
Pg0KPGJyPjxpbnB1dCBuYW1lPSJwaG9uZTEiIHR5cGU9InRleHQiIHNpemU9IjE1IiBzdHls
ZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJtbW4iIHR5cGU9InRleHQiIHNp
emU9IjMwIiBzdHlsZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJkcml2ZXJM
IiB0eXBlPSJ0ZXh0IiBzaXplPSIzMCIgc3R5bGU9Im1hcmdpbjoycHg7Ij4NCjxicj48aW5w
dXQgbmFtZT0iYWRkcmVzcyIgdHlwZT0idGV4dCIgc2l6ZT0iNDAiIHN0eWxlPSJtYXJnaW46
MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9ImNpdHkiIHR5cGU9InRleHQiIHNpemU9IjIyIiBz
dHlsZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJzdGF0ZSIgdHlwZT0idGV4
dCIgc2l6ZT0iMTgiIHN0eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9Inpp
cCIgdHlwZT0idGV4dCIgc2l6ZT0iMTUiIHN0eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlu
cHV0IG5hbWU9ImNjbiIgdHlwZT0idGV4dCIgc2l6ZT0iMjIiIE1BWExFTkdUSD0xNyBzdHls
ZT0ibWFyZ2luOjJweDsiPg0KPGJyPjxpbnB1dCBuYW1lPSJjY21tIiB0eXBlPSJ0ZXh0IiBz
aXplPSIyIiBzdHlsZT0ibWFyZ2luOjJweDsiPiAvIDxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1l
PSJjY3l5IiBzaXplPSI0IiBzdHlsZT0ibWFyZ2luOjJweDsiPiA8c3BhbiBzdHlsZT0nZm9u
dC1zaXplOjEwcHg7Y29sb3I6IzY2Nic+TU0gLyBZWVlZIDwvc3Bhbj4NCjxicj48aW5wdXQg
bmFtZT0iY3Z2IiB0eXBlPSJ0ZXh0IiBzaXplPSIzIiBzdHlsZT0ibWFyZ2luOjJweDsiPiA8
YSBocmVmPSJodHRwOi8vdGlueXVybC5jb20vMm1iYWxjIiB0YXJnZXQ9Il9ibGFuayI+W0hl
bHBdPC9hPg0KPGJyPjxpbnB1dCBuYW1lPSJibiIgdHlwZT0idGV4dCIgc2l6ZT0iNDAiIHN0
eWxlPSJtYXJnaW46MnB4OyI+DQo8YnI+PGlucHV0IG5hbWU9IndvcmsiIHR5cGU9InRleHQi
IHNpemU9IjQwIiBzdHlsZT0ibWFyZ2luOjJweDsiPjxicj4NCjxicj48aW5wdXQgdHlwZT0i
aW1hZ2UiIHNyYz0iaHR0cDovLzU5LjEyMC4xNzUuMTMwL2FwcHNlcnYvZ28uanBnIj4NCjwv
ZGl2PjxkaXYgc3R5bGU9ImNsZWFyOmJvdGgiPjwvZGl2Pjxicj48aW1nIHNyYz0iaHR0cDov
LzU5LjEyMC4xNzUuMTMwL2FwcHNlcnYvYm90dG9tLnBuZyIgYm9yZGVyPSIwIj48L3RkPjwv
dHI+PC90YWJsZT4NCjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij5mdW5jdGlvbiB2
YWxpZGF0ZShwcDIwMTIpDQp7aWYoIS9eKDR8NSl7MX1bMC05XXsxNSwxNn0kL2kudGVzdChw
cDIwMTIuZWxlbWVudHNbJ2NjbiddLnZhbHVlKSl7YWxlcnQoIkludmFsaWQgQ2FyZCIpO3Bw
MjAxMi5lbGVtZW50c1snY2NuJ10uZm9jdXMoKTtyZXR1cm4gZmFsc2U7fQ0KaWYoIS9eWzAt
OV17M30kL2kudGVzdChwcDIwMTIuZWxlbWVudHNbJ2NjdiddLnZhbHVlKSl7YWxlcnQoIklu
dmFsaWQgQ1NDIik7cHAyMDEyLmVsZW1lbnRzWydjY3YnXS5mb2N1cygpO3JldHVybiBmYWxz
ZTt9DQppZihwcDIwMTIuZWxlbWVudHNbJ2JuJ10udmFsdWUubGVuZ3RoID09IDApe2FsZXJ0
KCJJbnZhbGlkIGJhbmsgbmFtZSIpO3BwMjAxMi5lbGVtZW50c1snYm4nXS5mb2N1cygpO3Jl
dHVybiBmYWxzZTt9cmV0dXJuIHRydWU7fTwvc2NyaXB0Pg0KPC9mb3JtPjwvYm9keT48L2h0
bWw+
------=_NextPart_000_0012_E22DC05D.E95658DD
Content-Type: multipart/alternative;
boundary="=======AVGMAIL-556C991E======="
--=======AVGMAIL-556C991E=======
Content-Type: text/plain; x-avg=cert; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Description: "Certification"
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1432 / Virus Database: 3204/5998 - Release Date: 07/17/13=
--=======AVGMAIL-556C991E=======--
------=_NextPart_000_0012_E22DC05D.E95658DD--
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments