RSS

Tag Archives: Suspicious

“eHarmony.com Dating Partner”

POSSIBLE PHISHING ATTACK – ONLINE DATING WEBSITE – PRETENDING TO BE EHARMONY – SPOOFED LINKS

ATTENTION: I’ve been getting fake eHarmony emails sent to my spam filter. I am not, nor have I ever signed up for eHarmony and I received these eHarmony emails the past several days (on my fake scam baiting account, mind you) — I knew immediately that something was phishy. The fact that the URLs weren’t even related to eHarmony, and after looking up the header details I realized this is some type of phishing email. Whether it’s malware, a hacker, a scam, etc, it’s something phishy.
SUBJECT LINE: Singles Looking For Love In 2013

#1 Most Trusted Online Dating Site. Join Now!

©2013 eHarmony, Inc.
If you would no longer wish to receive our special promotions, please click here
or send mail to:
PO Box 3640, Santa Monica, CA 90408

HEADER DETAILS:

Return-Path: <2093192922@portalexport.com>
X-YahooFilteredBulk: 130.93.81.10
Received-SPF: pass (domain of portalexport.com designates 130.93.81.10 as permitted sender)
X-YMailISG: M3AJff0WLDu3gnhmNjiGcWZCDX8VNfF9gVyEVwn0d57lYzYE Qw6i7CSQaV_KniE81oJcBTzfEaYhbhvkkW_3bgeWeNssI0hpTf8pzJVZd4oj DlOjgYNdSbizcBsnGDlAlYOCN3ODZG2M3SCHPtdrCfd2Vkv.uh7LQM7onIIZ EvxzodhiT8tstB4O0meuQ.GeuYvrrsfQ_ykQPIL11z4apR1aDJwKCEP8PjBP NiXMaIWSB6QtdT9r3Nu9RD7FRc_6pNpGJCLqKv6YhG2tAUiA.Z4dU8LaSe.Z 2OSI7J.8etjFW6l1A07wfcOiPhdjpUJfzOKT3gjlPVw0bneSOCbvdf0n0.Ol J53i3G8UtPk._SsOOuRTH0px18vsfKJfAba0qkHMhi4IaS.xyabsVmAj3121 .cFUzW7sBgHPzIHmJwX2hAOHr8n.nzSK05os.fCTkr2VC2dn3adr5CjCK4Cs yTDmaf2XCi7fI_wdhX_VHfQl4n43kCVWkSbr83ioRgw1UxL5OQh648_uW3QA QNZiz09BBkeWzy5hcVIbYeFN6WRAHb554l.AFMQQZSY1F.WzfnoyjbRArlsb 3_YxdMxulbx_UfOHBv2DlGin3XVIA_DASQd3fT.2LlbX02M.sFomz4ikQI5k W4tlvj5kpAYEpDzMjMrSZoz.900y4sxRbFw5kv_dEAZ56_OcfsiD_wTuA6K0 XlRzTlIP27gQ6EoIafDU.GIyYrCNNxBrKCQOXKyTuG7UWLCjf.zAHY5oqjdo sylsaiFmj20f24gNvgwgyUFjwvfC0SAwlCbKIeoXrXVhJDdjQ0ikPMgeeoHg OH7f2Hf6DSdjKB_cFDCPGGbfRscHYLePq_0BmP1zUnM5L1zxzc.EY9CPijgN DsAPkpAoAp5lY7C8GDeqPZOyAvPJuyU2Qt0mmE9q5QiBvRvKlewbvOK7BusZ Z_o5cddS._R1QyJ0J6OfiirXgHbZlGwZGY3VqH2gfGGXZiqrrTVS6uiI0a_F mNiVA5Jdw.Vhose1PnR0ATG3SQJLy0xlgfmCI90TJe3_E6NwubWAWK5YK4OU zwrMdKiLpHu5WM7SHvA8GgPTws4NqwqbYn1gBkNvHgYkTzabyQ7E72vguk7r mCvYXVpJaYrgozv5OGNXnQeCHtL73sQf0IQrQAmkWAIe1pKxBtUS8HkDJki. iNH_vWvqO9_HTPOKGRArVq4FQPKhgoQaS6gXzUpa18fjyytvuzkIjgpnECia dYgtcMwG6TaMfJfnilczjWZ7i19ceCfb26_gGwIqqHEOexzWs42hb3vuiKYd qOStuXI6KVd6Fig5Kkvs5CfzO7NN9d28mgX4EN4UtypmZDvUmY6GSZfX8PHl FqOpIksji3xRa2u1f.Yl6KUArTL0dWTicRIVXiunSnD2uuxuhCUov9fgtuGc b_jAFjk9vsXH27xV
X-Originating-IP: [130.93.81.10]
Authentication-Results: mta1234.mail.ac4.yahoo.com from=; domainkeys=neutral (no sig); from=portalexport.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO ul.portalexport.com) (130.93.81.10) by mta1234.mail.ac4.yahoo.com with SMTP; Wed, 30 Jan 2013 16:25:27 -0800
From: eHarmony.com Dating Partner <mailers@portalexport.com>
Message-id: <72704994_2093192922@portalexport.com>
Subject: Singles Looking For Love In 2013
X-mHn9bGc2TnNqC6Sqp8c: NzI3MDQ5OTRfMjA5MzE5MjkyMl8xNDI1ODY0N180ODMyOV82NzQ5MF8xMjI0NTVfMjY3MV83OTU2Mzk3XzBfNjA5DQ
X-Ver: NzI3MDQ5OTQ
X-CampaignDetail: 72704994
X-Log: 0
Errors-To: errors@portalexport.com
<http://portalexport.com/x/MjA5MzE5MjkyMg|NzI3MDQ5OTQ|cG9ya3lleHBvc2VkQHlhaG9vLmNvbQ|NDI|MTUzMQ|Njc0OTA|MTIyNDU1|NDgzMjk||MA|MA|||Nzk1NjM5Nw|MTQyNTg2NDc|MjY3MQ|MA|NjA5|VQ.html>
Content-Type: multipart/alternative; boundary=”—-_=_NextPart_001_FHVBI9TV.45VYWRRW” 88.198.16.166 173.44.133.82

 eHarmony.com Dating Partner mailers@portalexport.com 130.93.81.10

 The links came in forms of images pretending to be eHarmony but the actual URLs were http://www.portalexport.com.br/negocios.htm <> http://webmail.portalexport.com.br/index.php?lang=Latvian — Which is a ”business consultant” looking for partners to buy and sell items. It’s not even a English website, never mind an English dating website like eHarmony. The actual URL can’t be copy and pasted because it came in the form of an image but it started off like portalexport.com/…/with_a_bunch_of_numbers_and_letters

__ __ __ __

SUBJECT LINE: Singles Looking For Love In 2013

©2013 eHarmony, Inc.
If you would no longer wish to receive our special promotions, please click here
or send mail to:
PO Box 3640, Santa Monica, CA 90408

HEADER DETAILS:

Return-Path: <2093192922@devicedigest.com>
X-YahooFilteredBulk: 130.93.80.179
Received-SPF: pass (domain of devicedigest.com designates 130.93.80.179 as permitted sender)
X-YMailISG: qP4_qdIWLDsuod7JBnqDQpOfP0SPPxPAdYLhMttsbbbZhvJ9 fTFBcUBRm31.ArzlDqoCIlKINNvCIZPP.YYUpu38eWQuf1B.f7NKGjT7t_sd dx2s5ERWR8ymbEo8pXEaYNEaZEgtG_imXHo6Cnq1d4OemJo6.fPkm8YH_uVB ET0R1GYNVy5KoonXIyfDW9mtrMRtNj2nfuMJp2qHFgItr2hH0dOfoe08OPvG om5jmFe7TP8l16Rv0r5Ljt5L.X9gPwAiGV5VxLGnhZ49zhl9.upfGLsU9uCl 0GQAGSt8lIUoUBZ0w.Q6MNpIq33IY2fMPHnQjaz3yVk8U3Sv7ZLgvxVo7Tw8 st6vV5zQ36c7YI8AeqnehFxAr2iLjWa475NvjoyXmhGOO.AYJ3wkOvlV1MWu MiS0Zv86zlT1wQeBftcu9ROAl2wZco_tx6kt7Tfm.adYFbjuU6mNNcjTmm1F SKQ8gCHHei6JhHVxXtvoXYCyTaVxkbsmtLu5iC92ggMO5t8kU8ASjX0MWdS8 cx51VgWGHcRMtAMTq.uZWQJHWaYuQLmlqTGLyEg8V7XAGOjv9BYJrZYJNzJ4 wq2kJoyRWCB4qL1akmMI61mSMxEUq3vDjpjo6UERvvYFvHjzRn.dthghsCSB mIXI6xpIzNWnL_LOFNPs3HINsIYORPNYGAAibnrd6rNERchkaaxjqjVdVz0S s4ssR_3Lj1lxP9ncV9aU7gVa_qtegp6br61vnF2TaQ7hBEVXi1pqPxoge37d 2WN5c2pA8fEkfzgf7LQ0Hj7Rk3zRh5h2T4f5FL06JT5_RfSkZ9THFCufOlZp leAWTeA9qBfi2l7OeF6AEMGH1u1Ez4n0fQCkqIesKA_GIDfV1mmhbKQaK3Nf QcdIYfUCEGBbcspg78A_3SYNUXWyH4MS3GfdqBE61Y0jkkPERCHvSXz_RZkf 7KN3SEIXfKDn.VttRA7YEuRtsV_BXZKKEeX3lkfP_JcCEq.g39SC2Zux69L_ DwIw.MIbUbePduUaBC3.9yPNHbbLjTUvglNzyNmhHg5Nny_lLg5Iws_t7bbU FerwxMy0zl6SPwz0X09ztF5pwdxEnNht9xig0rd34yaDf9UYXmiKYbg0W8dS AlfOFPOmBlOo74nXVt8jywbKPE5j_8.niDgLwTXn6XC9fmPnhO_vGE1P7Hus Zn0_0WmKEDdFMyxMqJdt3Gq2lC3FJtzk935BL7bjaBv..azU7iLcHHLGrl4k rssOIt_F8bKMkmXr4xpqNYdd1fI0YpDK4ToJPfiGOQwTDrq1SB_xzppvljtw jCjUlLlzIyu31xor_0G6eb9JcAfynnabJsFsF2_grljdRB0nfKfxbPvWbzaf 2fhu8ZNCj4UngXFA5pKMeJIW
X-Originating-IP: [130.93.80.179]
Authentication-Results: mta1047.mail.gq1.yahoo.com from=devicedigest.com; domainkeys=neutral (no sig); from=devicedigest.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO kl5hbb.devicedigest.com) (130.93.80.179) by mta1047.mail.gq1.yahoo.com with SMTP; Thu, 31 Jan 2013 12:16:30 -0800
From: eHarmony Dating <mailers@devicedigest.com>
Message-id: <72975089_2093192922@devicedigest.com>
Subject: Singles Looking For Love In 2013
X-IK1CRNCvGL5wLAmNh8H: NzI5NzUwODlfMjA5MzE5MjkyMl8xNDI1ODk1Nl80NjQyOF82NTU4OV8xMjI0NTVfMjY3MV83OTU2MzkyXzBfNjA5DQ
X-Ver: NzI5NzUwODk
X-CampaignDetail: 72975089
X-Log: 0
Errors-To: errors@devicedigest.com
List-Unsubscribe: <http://devicedigest.com/x/MjA5MzE5MjkyMg|NzI5NzUwODk|cG9ya3lleHBvc2VkQHlhaG9vLmNvbQ|NDI|MTUzMQ|NjU1ODk|MTIyNDU1|NDY0Mjg||MA|MA|||Nzk1NjM5Mg|MTQyNTg5NTY|MjY3MQ|MA|NjA5|VQ.html>
Content-Type: multipart/alternative; boundary=”—-_=_NextPart_001_9EEATPXW.CKJHBHDT”

eHarmony Dating mailers@devicedigest.com RETURN_PATH: 2093192922@devicedigest.com

This email came in the form of a link as well. The URL is something along the lines of devicedigest.com/…/_bunch_of_numbers_and_letters — At first, it looks like a legitimate website, however, the .com/…/_numbers_letters are what’s making me suspicious. And the website the above email (portalexport) brought me too, was nothing more then a login page and business consultant looking for business partners (supposely a french website, not even English, and definitely NOT eHarmony.

 

If someone has figured out who these unknown emailers are, could you please fill me in. Thank you.

 

Tags: , , , , , , , , , , , , , , ,

Suspicious Spam – Scrappers Attic

PHISHY EMAIL – I’VE RECEIVED SIMILAR EMAILS IN MY SPAM FILTER IN THE PAST. I’VE NEVER CLICKED ON ANY LINKS – POSSIBLE MALWARE OR VIRUS.

safe_or_not

Your friend : YOU’ve Been Selected (Free Private Training) has recommended this great product from Scrappers Attic

Hi …!

Your friend, : YOU’ve Been Selected (Free Private Training), thought that
you would be interested in Hooked on Fishing-Fishing Title accessory sheet
from Scrappers Attic.

: YOU’ve Been Selected (Free Private Training) sent a note saying:

Our computer has randomly selected 100 people to
qualify for exclusive access today.

The spots are limited so please click the link below to see if you qualified to access the product today, before everyone else.

Your special invitation is below…

ACCESS UNIQUE INVITATION: #G52BMT

==_ http://0t.se/dollarcode

PS : Remember positions are available on a strictly first come first serve basis.

Your link will only allow 1 person to join, so please
do not pass it on to others.

ACCESS UNIQUE INVITATION: #G52BMT (Link Copy To Browsers)

==_ http://0t.se/dollarcode

List Marketers,

Theresa M. Langford
864 Henry Ford Avenue
New York, NY 10016

—————————————————————————————-

To view the product, click on the link below or copy and paste the link into
your web browser:

http://scrappersattic.net/index.php?main_page=product_info&products_id=1457&zenid=3cgturf7hnc0ual026562f72q7

Regards,

Scrappers Attic
http://scrappersattic.net/

—–
IMPORTANT: For your protection and to prevent malicious use, all emails sent
via this web site are logged and the contents recorded and available to the
store owner. If you feel that you have received this email in error, please
send an email to thescrappersattic@yahoo.com

This email address was given to us by you or by one of our customers. If you
feel that you have received this email in error, please send an email to
thescrappersattic@yahoo.com
This email is sent in accordance with the US CAN-SPAM Law in effect
01/01/2004. Removal requests can be sent to this address and will be honored
and respected.

HEADER DETAILS:

Return-Path: <do_notreply@ymail.com>
X-YahooFilteredBulk: 72.47.233.67
Received-SPF: none (domain of ymail.com does not designate permitted sender hosts)
X-YMailISG: CuuLYm0WLDsQh_nHM5WHCzP0f7_Mj.VKI6eWJQh1YZpCUKQU 5SAFelkhH2lHx1pB00UDVEzBtsRUb1DL7BGZS.tf8XZRPltztoODR1HG6Khm AngxUNqCJlprCdmpXYX2k0p2Adzyjy1ke0G_amoyMeBPxXqYu1IR9bX8cFTg tGGc9tWOjoGw7AC2c1yFfLhKkE4LaClAOIAAjyD1OdGFZBF5aijcKQ42ElZ8 1ZcbkbwGyMZXywW8H9iNxv7TpYD3PaaW14AUPewJE68buX52x7ithwTBuno7 RtAsYh7TPhgWn5hU3bmp90FuTTLu.vbdgRVYrR9ncpXyDIRJIa4Co6Qgj7E5 NnUH_kYirB.y8LQVuHNpGLhpsjL1KrSpWqqFTkRSDFinCTZPRT57U8fj1VJr eGICh2WdDqVJaqp1ZP08zMbE1CBMplm1eFPWu.jUj3xz1cJ2ABv6M3GO16fo NmqT5aldpdzAmp85IGyDC719ZSgCmIUfzjXzawGC_gq9qbucOZpceO6EA4v6 PaeTllQwCd2bfG48ZJb30JmOnsY9OS3pm9NsrJa8QeQVZOVnx_eCWkPUhKCk ZgCra_ORBqn7VLPbaigN8VwiL7NCL_vN2lrMMppQnUm9W7BudVdWfFcGKMnT ruo7Ydw_df_Y3tx.fFlPw_XmSY4PquJFRjGfcbYKLmbPWlTVwlHwsxelvt4m VwIj6PDnTzAb99xwbViUV4r7Ams8m3doHtcNy.gVriI359g0SxklbKQRCO9. 5eGQ3lyqIRNv2hspuoLcXbCdXCX9Npe54YeauRb7PRU5WB53_VoIt6gZowiC e9WYWlo_772FESIc7Qoz.ULWKgyPv7VtlhhECqPY9Ngb_5hzW9RzCltYTuD7 fW8VOTMwdHhjCgsfeAN2Q0l1uzOr54dwXuV9H3PXOl9b_eKvQBO7.SZV9z2v aBHDR8g.ZjPVjkP9Th31a1GAiYmdfoFGqV7gg_DiUIHM.W7kHuMgg34by9Mj SmxMCPpqeFO_vBLgFOuj8zz6SyeDq0R3AGsFC34HiqLP2q8_klenAY74FsjA PvcwOzipFKj9SQyRpoVTPUa26rtjOrfEewxTxX8bsQHBU5MRFux2lYgKm.bf fOaiyW0tqabfep43pgteG17ZDrurUy7tfdCwI.z6_Aq1Rl_Q.Q3zc8xrgX3D S5IOF2cwbfm5ziWlB1PtV3tZtSUzDzUHOniWf72KwTmkJOEuAkkzDtihfkoX DEShz3G_XZ1UdnP9xNOsYUelyl.fo4JMGGlwm8heS89x_Fk8CuLGFJK.2yHE UaarVQ–
X-Originating-IP: [72.47.233.67]
Received: from 127.0.0.1 (EHLO ft11i.com) (72.47.233.67) by mta1163.mail.bf1.yahoo.com with SMTP; Wed, 30 Jan 2013 03:41:38 -0800
Subject: Your friend : YOU’ve Been Selected (Free Private Training) has recommended this great product from Scrappers Attic
From: “: YOU’ve Been Selected \(Free Private Training\)” <do_notreply@ymail.com>
Reply-to: “: YOU’ve Been Selected \(Free Private Training\)” <do_notreply@ymail.com>
Message-ID: <e9094b7d93592d7eebdbd819ec05e1b3@scrappersattic.net>

72.47.233.67 do_notreply@ymail.com thescrappersattic@yahoo.com RECEIVED_IP: 72.47.233.67

 
2 Comments

Posted by on 01/30/2013 in Uncategorized

 

Tags: , , , , , , , ,

“JESSICA <3"

I’ve been getting sketchy emails (LIKE THIS ONE) sent to my spam filter lately. I have no proof of a scam or attack but whoever is behind the account, whether a person or bot, keeps trying to get me to click on suspicious links. I never click anything.

The emails are similar but the reasoning is not always the same. This email, the woman claims her husband is out of town. I wouldn’t trust it!

animated_hacker_pic

 

Click Show Images To Enable Links.———————————————————————————————————

 

Return-Path: <reply-622542697.24.332481255.2721847_10635-1@ujwohngemeinschaftdirect.in>
X-YahooFilteredBulk: 37.27.63.105
Received-SPF: pass (domain of ujwohngemeinschaftdirect.in designates 37.27.63.105 as permitted sender)
X-Originating-IP: [37.27.63.105]
Authentication-Results: mta1266.mail.ac4.yahoo.com from=; domainkeys=neutral (no sig); from=uypartu.in; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO jonshon-mg-dbl.go.fp.ujwohngemeinschaftdirect.in) (37.27.63.105) by mta1266.mail.ac4.yahoo.com with SMTP; Tue, 29 Jan 2013 03:04:51 -0800
Message-Id: <20130129531575.9A34EF06C@uypartu.in>
From: =?ISO-8859-1?B?SkVTU0lDQSA8Mw==?= <jessica@uypartu.in>
4cf64dcfc17a00bf3c7944a6375b006d57b665ce@uypartu.in
Subject: =?UTF-8?B?TXkgaHVzYmFuZCBpcyBvdXQgb2YgdG93biA7KQ==?=

SUBJECT: My husband is out of town 😉
From =?ISO-8859-1?B?SkVTU0lDQSA8Mw==?= Mon Jan 18 19:13:42 2038 JESSICA ❤ jessica@uypartu.in

 

Tags: , , , , , , , , ,

Suspicious Emails (UOFFERS)

SUSPICIOUS EMAILS – POSSIBLE PHISHING ATTACK

I all of a sudden started getting suspicious looking emails sent to my spam-box. Each email was a different topic but the same goal, the sender(s) want you to click on a link. The URL looks suspicious and the IP addresses, email addresses, name of the sender, etc, is always different in each email but they’re posting the same link. I’ve posted the emails below (I didn’t want to put the actual link just incase someone has a sensitive mouse pointer and/or clicker and accidentally clicks it because I do not know if it’s a malware, a hacker, etc, but the actual url can be seen in the headers I’ve posted below each email.)
animated arrow down2
How’s it going? I’ve been trying to reach you

and you haven’t been responding?

Can you take a peek at this?

>> Click this now and check it out

and send in your thoughts please…it’s urgent.

I discovered something that can help you with
an extra $2490 a month to help pay off your debt.

thanks,

–Jen

P.S. This comes down tomorrow, so make sure you go to it.

You are receiving this message from Unique Solutions and we respect your privacy. We hope you find these communications valuable; however, if you would prefer to no longer receive emails from us, please click here.

Unique Solutions
538 West 21st Street, Suite 95187
Houston, TX 77008, United States

*As with most offers you find, results are unique. Your results will vary. This is an advertisement.

Return-Path: <uoffers@smtp228.reimagepc.com>
X-YahooFilteredBulk: 64.120.110.228
Received-SPF: pass (domain of smtp228.reimagepc.com designates 64.120.110.228 as permitted sender)
X-YMailISG: uo3N4y8WLDu0M0JpNApFrPxO9zYKE1rJnM9swzF4c.UD1atQ V4USLyI0QQgY01z68qqsA0qJrCJll2u_EfegtqxXr3vCONlX4lIXUaXP9Ck7 KS3j67vGR3nbWBTZPMjt2z2HgqgmSYyMjUySqJEHpxZaTMZZm3kHPaA9cUkc jC4uXbSnG0.CR2iXcJkWMY1tlcg8cLX1zAs9WSRt7x_d.wrhZDlagp..T2wX Y7oOVcvry9FS6W2Zon10.vHzde3NyHd_uck0dvN0R3lG.08xFD6zDrPJ3xoC kUSTsyvYR6YjEXjLhgJNtp_57iObci0ZQ_pQiW0coN4_XFkyXaniWIXlD30D S.FNw7GZplshn7O9LJEZF_EAUM5Jpuri8E.6TrCx_OICPfTpNczXLxZn8MNJ 4cArg4xrMP1JuVLlinKuHKAIkAwYpgqeXPvPbyXQ0pKCb3Y1U3zNjbce70KA E9Pmhw8LEWOBxjSyfUZ9mvQ3l_Dgee9AustvzwHVXK_TGm5jybRaPbdaPi8P EzmFP07NaqAydVFxn6yuxNnSWfLR5f_mlc3eQG9x9OijT6EdDSB.Tv50PhP9 Dy4ymIdF8.MyI9Tt35fWP2_vPHn.oU3tJY6Qff5ZYJ6CoYx6GHx..P5ksfVY 4MXJRA.B.v9QEp9.k88LuCGdwAoa5cGYQ93z_2DVWmvCm3vcfWEvWZSCwW85 Sz_kXJiwNDRJXeeJUQt3sp5PxtWXLMQAX27W1c1CZEzrzfnvT.zxBEv2JkXA GgC6sV1bbvaDMfOWeS1AU0u.t85l5ZW5icpjnPm0rj6gZ9mrdLVONtpRbcav wT1pAuez5E41GnBgC4GiY_QVQtK28hMmIdDk9zue54SP1AuJ5rWoKqGIPahF VSffqKYsnpUY11S8g_.ukXmACc_HVJuBbD4yuuQBxfyfhCVIfHMNN7EcyJkh yKo8j97xP21ZHgl0Pr7taE7fpJLzMU18A17G6xzEWqB6r08TOIju8BUMOzTt b6U0jxF9780kXDOjmowqBsLGurSxSm_Ug1PKYke87Cy6zkgOfSmP.8osy49F XunG.8.W7Q9o1bi5q4DE7xarkcDDwejX8JgU30MOmDVMOu9RNpbLs2ijfEYq BgF5n3gk4HEcpLbGdjPIRabKf99ZwiFMg0_YKdbkjszjrDGYa_xstyNZIIi8 vThW4ZoE2xCe8wMgQp8jV.fz1aPGlQ4tnLpkq27tm9PJnhQqZSxB4YV_NRxB hW84WKsLI51FTfhiGBuWvoGXilzCXo2Vm2J19GEDepEgNb9TXOUOi2v.YOxT nRT9c6p26ZlhmR.TH4E32adY5Ww34ipaO2V47B_2VHeynhEXVmnuZKtGY9QC FtwS3lqq6CXO8W_KkYcu3CfRZOI08hnhhwPwqYP2NYAjsJlrYDuey_ll_sJy O8IxFDELbDC9Rj0frPQmY2wP6K7YW9xrfb1VUiJc2HhWio_zm.E5_njaYpMC rAFhE.5Ve9hmSRVLA2b4MIWuRdvD6O.AkzgyCT5u.QR31hxp5STBIQ0ZtSr5 MzjxZlXCJbv1xSGLDFhrHk.34RmaMB0BhDJA8lFfxaPhhX4.mPbISQd7GY_F 55DjRP3EiN..qjdae.mJfakgeBpEVegtBVeNnmk69vcvyS.AG0JDxugb6DM2 FA–
X-Originating-IP: [64.120.110.228]
Authentication-Results: mta1288.mail.mud.yahoo.com from=reimagepc.com; domainkeys=pass (ok); from=reimagepc.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO smtp228.reimagepc.com) (64.120.110.228) by mta1288.mail.mud.yahoo.com with SMTP; Wed, 23 Jan 2013 18:57:37 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; s=s1024;d=reimagepc.com; h=message-id:from:to:subject:date:mime-version:content-type; bh=Tyi7QyqP3ZmAhnXTwV00OXSIjoI=; b=AlCJXHE6F/IZBFJ7WEJuvAOYLI024g/LqlMY/CxREyMh8y7HsNDJg+0POJyquCKUfJKbF2kxRSxgkExv3//rgamSrPlyD0pmhmQLBVVzAT5l10SmloLVakbA7M278avHelTMMqShS+DEwsGwToUFCWn9P2H0T5aRe9b6uzD7KNI=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=s1024;d=reimagepc.com; h=message-id:from:to:subject:date:mime-version:content-type; b=bMPTuZ/AvnbAYRNkFzwdsyBMlO6hfkKzhHbpfwhwA7V6h/01A+VU5Z03bHj310jN+9QKLb5OZ8uNhVYfD4+QVNQf59SN034SGWfjSVNLHirPVdj0lh1UEE82oMYQ8IZVc+gxk3uqWqgg1P8FXnDl+JwgKafCUGy8H5nFzvlEQTw=
List-Unsubscribe: http://smtp228.reimagepc.com/u.aspx?u=0&e=867&s=3005&w=0&x=24939953&y=1040&z=2
Received: from Pickup by smtp228.reimagepc.com ([64.120.110.228]) with SMTPSVC; Wed, 23 Jan 2013 17:56:37 -0800
Message-ID: <c07b5a7196d97abebe05cff508fc3b55@reimagepc.com>
Reply-To: “Jen” <uoffers-1040-0-24939953@smtp228.reimagepc.com>
From: “Jen” <uoffers@reimagepc.com>
Subject: trying to get ahold of you
Content-Type: multipart/alternative; boundary=”—-=MailPart0000_0010_20D4AAEC”
Errors-To: 1040-0-24939953

64.120.110.228 Jen uoffers@reimagepc.com <> uoffers@smtp228.reimagepc.com

___________________

Hey,

Your quest for a long-term income
is officially over.

I found what you need but let’s keep
it between me and you, OK?

Just wanted to pay it forward. 🙂

Kristine

P.S. This is private and confidential. Don’t forget.

You are receiving this message from Unique Solutions and we respect your privacy. We hope you find these communications valuable; however, if you would prefer to no longer receive emails from us, please click here.

Unique Solutions
538 West 21st Street, Suite 95187
Houston, TX 77008, United States

*As with most offers you find, results are unique. Your results will vary. This is an advertisement.

Return-Path: <uoffers@mx10.bashfulbows.com>
X-YahooFilteredBulk: 108.62.93.56
Received-SPF: pass (domain of mx10.bashfulbows.com designates 108.62.93.56 as permitted sender)
X-YMailISG: Ja3a7UEWLDtv3cT_sUs9DUfvjKJf1l1HWzBd9icdtyNpYpvq 9ZioLAcEmPhUPOXdebYS.cao3ZUOgkKOFCrxxfo2iab31iSj9hwCNCcseSr3 xo960vtMSWL5vubGv5VEnmSLpWUiSlmgt02RYEjSuPGIQXulngS88zNN_4HD qlEdFfoma_5EcGaOyPDFz7_vSrnEfFnp6Q_O7DNVROPfWXSW5RfKG3j4O9v. 8HP31SP6OGufRl33rehE8StLo0mMUHhJR_ZYEIM3d4Hlf2_PTFqrJogKgAzk OqPI1WltlxKe2e7.LTaaYNVdhle1UtwIKPC85HFzKyBdW8AxbvXzRjJDS7c7 z5W2vIb8qoBT7CdrfdQF1aZEegs2Q.Y6tLudvsyAROJHN1RMr1T1GiFp0A83 AOOMfDLpt46NTTZURGCE4qsjkO8_Htgq8bIXb0p0xgLwnmFdwGZbJpbt2m0w pOyklsdVahFi.Kwj5wefuTjUWMb.SCWmeDXdiDV1rQMARZA22nzbpWshnUZ1 dCwRWQDXcXdiD9ZYw0FLc1CYdemi8LUNSANY.NCZmH4YHMM8X1zuL8I85hCV cM3nOgR68qQxd8AKBRvvJd7_N4gdizOewrBqXX.u8.3C3Si.O5yvgCFObv58 pZN_V.sPs6yN_pY6agMf.Q5UiWvEbWvipY7EzJs6CESS.y48ta1EQSB4YPMR 84BoZh7gF9PQeRh3DEdm1EWtsnfdmrMBYRc85WA0PYxh0ikTOT3zw_Sb1Lg6 blr0YYyodcG7MnC42yTqLDil.m.jx9T9sN3atg3LQxYg4Rc.JlcNfksEexiD hCxNQbkec2efN48dCAJHL3C5hJumZrmFT767qmxKBW7iB4PnGMkvC0AhUAtW LHDzi31yBuw42DVJ0IAB07IXnCepDsaoGwmwmklZJwK_MFNAvQqtUrZxaD2Y Mn4GnXTLN7uQAnQNKlXxMQSoPf0VjS6tlbqRnMN1Z30ptLUm9t_ipkYrZyK3 hAGJK59q70k9UIaVJTk9eB_8vpMFduGv_h9J8VvjpVRC0fSSg6Je6NiJMYFL 5mrES13XP__ISYDJQkfPHiWMNoNveXi8yW4Hol7MTGQet5llMVrSnwAPovuJ 5LJkGC3.EEHBqJ9mq4fAhz7D1Mp2twu_2LZZ.e92zqBWR8XtZ9e2MwLQdMXJ OShrqJMnMbS544sCRGwCGm.LgyZT2Vcz4C5_VttBVtqrVQdJr1aCYqrIRIx1 03YVANgW0bbXjkAWMC8hVoTfzMi7NhmHKNTgtkMD1xR.AZnLGcmWPQfoGvt8 n8D.JZhuhPuyNW60.oHmZtK8dH60PKGiGKgIJn95L4_6v6g6p9.r9povP_tL SHwAGmga2uDjmhqMlsKJ3pst2tSEs4zgYhRnjct96d8wYkTqLTtDq84I_R_1 IICxQ_yEWcXtBGEms9ah_clXwl0RoSs0ZA9posC75pFFeaoIGC7Z9J00_pIO IlUaQ_DM8cJ6lJeESV59bSEl2mbbahkLmoqXmyScyQ2xNmK7.rblLgIh2njD FZWwhrFgW207UkYjlzzhXdmDVF93olxn5ltrWZuKb3b6oZNT6eooAps0sZio lWdpwd9tVd7gNZW3VDVJjIhJ_tkHdvKWeVMQkLSbGU09lvUMq_O3CF5Z1RNe
X-Originating-IP: [108.62.93.56]
Authentication-Results: mta1474.mail.mud.yahoo.com from=bashfulbows.com; domainkeys=pass (ok); from=bashfulbows.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO mx10.bashfulbows.com) (108.62.93.56) by mta1474.mail.mud.yahoo.com with SMTP; Sun, 27 Jan 2013 18:19:37 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; s=s1024;d=bashfulbows.com; h=message-id:from:to:subject:date:mime-version:content-type; bh=sVkZYyXs3TrZQZ3aYFCPRoSlKhw=; b=Q38oWvGyDWa/c5wJe1DyI2+ZkrqwsDsd0R3TDEAu7I9Wh3IVc4KoVRLBGc7YiHuk9Pad5zXBvWpNSEuAo/NryIDv7+Rfjx+VmZBVvhFRzoUFjfKkzOqMnGqSALagPpKXm5Cucd7/FDUMD1TPsj5SqBobX2++k6v0CU2mVMPECxM=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=s1024;d=bashfulbows.com; h=message-id:from:to:subject:date:mime-version:content-type; b=u/2DiNQmjQPgWDaskdZz4tMQ0D9BYU7aIef5998FIuqDUkytyurykseIvUo8NXF4c69ud8nRLdZwy42X4ON/Z8zSsC2XZbq/SbSCe+IVA6387CO74Q0AOQGCPBEZ51Y7kUuOO2eXqMCKIHbruFrWLqWEknb+e6Lz/91mRm/s+JA=
List-Unsubscribe: http://mx10.bashfulbows.com/u.aspx?u=0&e=821&s=1319&w=0&x=24939953&y=1064&z=2
Received: from Pickup by mx10.bashfulbows.com ([108.62.93.56]) with SMTPSVC; Sun, 27 Jan 2013 21:19:32 -0500
Message-ID: <29da38b3fb4557c77217d7ec3e5f9b91@bashfulbows.com>
Reply-To: “Kristine” <uoffers-1064-0-24939953@mx10.bashfulbows.com>
From: “Kristine” <uoffers@bashfulbows.com>

Kristine uoffers@bashfulbows.com 108.62.93.56

_____________________

FROM: Bob uoffers@nowdecorating.com REPLY-ADDRESS: uoffers-1053-0-24939953@mx3.nowdecorating.com RETURN-ADDRESS: uoffers@mx3.nowdecorating.com

SUBJECT: (Last Try) Membership Reservation for deleted@yahoo.com

Hi,

You visited our site recently, but for
some strange reason you left.

We’ve reserved an account for you under
your current email address.

>>> {spin#:Click||Go||Press#} Here and Claim Your Account

Your order will remain pending for the next
36 hours.

Your friend in success,
– Bob

You are receiving this message from Unique Solutions and we respect your privacy. We hope you find these communications valuable; however, if you would prefer to no longer receive emails from us, please click here.

Unique Solutions
538 West 21st Street, Suite 95187
Houston, TX 77008, United States

*As with most offers you find, results are unique. Your results will vary. This is an advertisement.

HEADER DETAILS:

Return-Path: <uoffers@mx3.nowdecorating.com>
X-YahooFilteredBulk: 108.62.93.155
Received-SPF: pass (domain of mx3.nowdecorating.com designates 108.62.93.155 as permitted sender)
X-YMailISG: 3WDVnS0WLDu2dY7V6mqP7iuAcQHsEZbk32Kr6WCuuKtg0tLM rSpMHxnMKOpTISgZ1SdpZ.U0Y.a0.J65tC6KvJstK5jwssCPk8ii28dqifev gi0Ctx7izl_FKezSBr_klt70fX0l7eMkftcLArC7D5ZAzOmCoSYShCLhdg7_ Qd3MXWijMBGAwi_RgmUmZGDZA6dC6Mxq_qDHkITMaNkxq0v5plymUjRa6d38 wAkXCzX8i.Wvrk.7IWA3feWScMIzBuY3KtzouhQJ90rgXF48c2IdhRDICr5f y0HpZwTEEe8FhY5koHf8ZRwkq1zL.5vOSXoWHy1vhmZlD7uOMN1Mjd8Fe_If IuWm4snOkBcoOYCrWWlJmHJyKhZkK9eI1IRfNFbCsUu6Q29XPabCIM5_9WUf Ht73uS_eqEKFjtrxJpzFEWpXseVZTwvNpPodFGX6Bz63dnnUOtqZ5njQND6P vlntAW6UodIsU2aVCzsKJYK.5nSW2xflc5ZfDaId9Epajhep8yuLqvrJJqLn PAK6FP4zbemJ_K3rMUAz0XnmoX_g3OOtOjQY0eOLdfg1vyv7MGqZrq9VJtoq 72.LOUQiLH.qzCo7ayk067271z_9f6bPfNfurO1r_NEFEidi0nmcVBXmTYEj .7fbUsROzMtBCH25J2OFQ2iclyJanDRxJvtEY8IkdLdUb629REjisHK3IggJ x2h6rw8ISkPQzvULK0FFRF4r78cX7c6PihEGG81GaUi9u39Xoj4mbvavLwNg CmofSEjGlIbnXkGTynukdbZPWshdSu5LsbT.4TqdRyN.Gn4FVS2ue5Cahgd9 d4FO7cTg2gPFPSTi4swXfv4opZjB9UtRr4svIjsQeT2bBpwmf3uqfm9br73m Fg5cCm6wn.1sQzaXNmwveA7UiaEBCRR9GmG6dUJng7IWNlHdjQqcnIJhxugS rC04wg24cZj7R601DbJnJgoK1i1vIwdbLgnMooNVnvXrEnsHjeJD743rWsmm EMxxXk0OLFZH_dO1LZTRmyHJTFT0yy7qzWVKduqjnAUKAf5lMUUI7M7OjK_O x.Zt1svfPwqTwq4.nvk1PMvbkJbX9G44WaH4_7lPc6_VmQPC9mu7G5wbJ43z 7wXp6733l5nienSfpclgB37iUMvH1bBbF3Tp_xzuVFi2XgNVm2Op92tj7GYQ A4sI2m10egyIrtMhynERND1AlYQHQkj6qYVxZKIj.iXcrJ9Jw5EdQTTmSXF4 cBN6otDxA6z00nzaJCgwek0Owj7u2EYT8x41Viiq9Gtf_kLEYmh8Q319bzDK 78V6lBG9.oIalLypomWVLefXNMvHQoYLHFf.NDJll5YIKFROMnOj4FOu0YVI WA3elOm3O6XFCrjM_CU0vcatjGMAUTpMZHb5Xls0GzT0KPbFEtLNaj89ClqC eDt_ZmJEfiTN3uTlFxxIPpNOzK8.qszH_yOvA9ck.ghJuv4Ni0jhgE89aTQQ P2pNDwLz_CdIJ01p_EJXTuqeuRqjp8Ud4eKb70W3i37pRpIT9pQXsCl93iaG 8SZONP6YaGkz3s..0JfUH169h.df5Qvg
X-Originating-IP: [108.62.93.155]
Authentication-Results: mta1387.mail.bf1.yahoo.com from=nowdecorating.com; domainkeys=pass (ok); from=nowdecorating.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO mx3.nowdecorating.com) (108.62.93.155) by mta1387.mail.bf1.yahoo.com with SMTP; Fri, 25 Jan 2013 20:45:38 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; s=s1024;d=nowdecorating.com; h=message-id:from:to:subject:date:mime-version:content-type; bh=EJCuWh8ysrE6UD/eGTDxyTjv2T0=; b=VoOM+eKrhRF1+zvxB1BexVAy/+kaP+9mpHWWytO99djHG0spCjk2XXelgzWcsL23cqm8BTWKT1mf+uhnrb/kwmqy0wHfDF6OnY3wpNGPOEXVjxvutqcSdFNGQDBHlHim2aGEX9h842Hb3fMsX8oFZFsGmiu1OyCOv6Jqmgjklfw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=s1024;d=nowdecorating.com; h=message-id:from:to:subject:date:mime-version:content-type; b=f4bE2mh31SyZ3RVTO54Y/rvlI17sk03O3sjvQuxFHsURE1nNugiO7tqFtA7RsD3i4vYUSRcPARbsqexsLsvVwPaLfjkDQFY7xPWizxwXDVF1djgSPLbjXoNh3kd8XMNOAqwswFcL9YDv4gf663yo8X3BJ8hbgAk1ZKrwFSZZU8Q=
List-Unsubscribe: http://mx3.nowdecorating.com/u.aspx?u=0&e=692&s=1418&w=0&x=24939953&y=1053&z=2
Received: from Pickup by mx3.nowdecorating.com ([108.62.93.155]) with SMTPSVC; Fri, 25 Jan 2013 23:45:41 -0500
Message-ID: <22c4e5c47e4034e8549d08b73e7dcca4@nowdecorating.com>
Reply-To: “Bob” <uoffers-1053-0-24939953@mx3.nowdecorating.com>
From: “Bob” <uoffers@nowdecorating.com>

_____________________

Hi,

You came to our site recently, but for
some strange reason you left.

We’ve saved an account for you under
your current email address.

>>> {spin#:Click||Go||Press#} Here and Claim Your Account

Your access will remain pending for the next
24 hours.

Your friend in success,
– Robert

You are receiving this message from Unique Solutions and we respect your privacy. We hope you find these communications valuable; however, if you would prefer to no longer receive emails from us, please click here.

Unique Solutions
538 West 21st Street, Suite 95187
Houston, TX 77008, United States

*As with most offers you find, results are unique. Your results will vary. This is an advertisement.

Return-Path: <uoffers@smtp124.rhsfmla.com>
X-YahooFilteredBulk: 199.127.118.124
Received-SPF: pass (domain of smtp124.rhsfmla.com designates 199.127.118.124 as permitted sender)
X-YMailISG: 3jPxf0AWLDsku3rfKmiyARUvvL1vRyBF2vNFCROIhgZY1H0W vKOYMk7iVYpVerZW4lBnAXayJeiKySZQClghIHXAKoQNptGUkI45Hglts7eq zlJA5gyZLSi2FtMAxApXVhUeK_dPEwFhVd_p16z68DLxJBecoreZKcsXMi6G r3jaHtX7ECFPj5ZzADXGMeDWuVeIwpE2mHX3z4q39pj9hToY33niauH8cy_f veGhYIUVgWNJ0v8YzpjsqaAA5ipjJTABSI.tUEIsE5O7b4bN2WOZ4yde8fVz uBvUDLhEuh26i4sDYA2aztkqCu0qBtso1aZCtp7WBMPmtVy3eobBsdZW4epU xXbXUyJbbXD7XrHBz5GN7q9BD59fcfYRYWx87RTinNxQZDLbUWysHsR.qU7K NSykVKhSsmSywRUXv8HRzGysMqmgf7Hfcoxt7cx3lL_YC7Xm2.dgdnhFWVUx zIGtd.m4YIn60SvV8BkIWMRzCeABVh9jXQX1JyPCvQovCvTI9RLgP_acmIUL m0HI9hcBjeG1NrkIohXsWeTGXQhDLYgXu6Cv.uI1e_nAK5QGZuSbWqnWZkuj ihzF3e1CyLLoyk.YKBcphrX96OIHX2yqKTHQ6pItjuWHAOSwsiuwhbb0WvsW MYiOPhy_jgtqCPqINo7w0i3Ew0.CWQHW7iCNGI7_oFyMcSTo.buGGDaNnbf9 Ivm.g003kwbCTpufVeJH5FRwCXIfQ1wYMzhg4H_vP0c18NiafUsGwJyT.GKk tBrWsdZ0ssF6NdiQbp4Ri_U4G2ZjVV0ckn1W2Q0mOG2ZKzmdfqnojUfyuA5T 6L6uzsEfyvF3oEDJEqEm2f8y9vR6.r_vJpIEpmlNgroHR87NFx7cEPfeW6yE IWe1diZZGwccZjKc_nzr4fXdmR4b9l2zNeyoIQwDVsuWOg5E25LzPrsaibk1 dsY3ywlYREZ.9GNFi7BVxKk0wnlsOeXMgCN2AGysrLf2yT3aGJgHC.BE6iXY F3lV4VyfMRjcsvmxkZRxePortGZGBsUNdIk4OTC1S7XjDxM.V5oMK_EhS0np UPbnXsl1OEDx8mzzeBMCmlWH8iahUHpEOKCwM.Z0Dgc3QhW0OwMV_1mWa.Of IYN7pURozzoco6PCUlX.UigDe9SWp34r2tA2EarHzpVJAmeVE7g07ge1gXM9 qpGjQ9vAnodFDzwvHm0ZoHP.PkCbScjLTrdPh0e_xHvUtGkxDwBjqgfUvOmI lV1V.PUWkbgBsrhSqXd.xPlLY5T9OcwzuYOyU2an5NOJ2wgKvcCz0fLCN8gk BCAFLH6.DSsVcN9qyKcGN4LRLd4iIFQi8p_zKM33mqj9l5fE4ltctC384mZC 8IitcNG9cIgB5081rb3QM36E7Y2Zr86qFH4r
X-Originating-IP: [199.127.118.124]
Authentication-Results: mta1276.mail.sk1.yahoo.com from=rhsfmla.com; domainkeys=pass (ok); from=rhsfmla.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO smtp124.rhsfmla.com) (199.127.118.124) by mta1276.mail.sk1.yahoo.com with SMTP; Sun, 20 Jan 2013 14:17:40 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; s=s1024;d=rhsfmla.com; h=message-id:from:to:subject:date:mime-version:content-type; bh=xEsTuF2/j7qmFTkDn1gIJstfnjk=; b=n/0lvpUtD5BCwZcGjm9fLQWNP9K11LcRhJ4Q75Cbc0sdleD4YjNyBId5xp2mHFQZ2Nwoj0hVxcQy3lTE/BkG6M36iMAK5IjNu6htWVFeSvu/5Tq2RJbRll8PPmAX11OgS0AHXmOdA2TfSnASwcJ6dVePvmaPGotim5wnYeCOK0M=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=s1024;d=rhsfmla.com; h=message-id:from:to:subject:date:mime-version:content-type; b=HhQoMcGu+yGJOl+qoydRUNmZb7Vg8OA+gU4GEiTdnMSeku2QZw/V50qxFROm/6o0bQytxBx6pQKrrx7310X2jD66NVg+UtTLm7hqcESRU34ymJjhv2jlUUxrkTbK+t4WuzBfd6wVl8i5Lh89N/dXsWgYIkxGzd0o7hZGG8+LZ7g=
List-Unsubscribe: http://smtp124.rhsfmla.com/u.aspx?u=0&e=692&s=3154&w=0&x=24939953&y=1025&z=2
Received: from Pickup by smtp124.rhsfmla.com ([199.127.118.124]) with SMTPSVC; Sun, 20 Jan 2013 14:17:25 -0800
Message-ID: <e1f0ba64b4e102d1b3864b8419beb1ec@rhsfmla.com>
Reply-To: “Bob” <uoffers-1025-0-24939953@smtp124.rhsfmla.com>
From:  “Bob” <uoffers@rhsfmla.com>

_____________________

SUBJECT: IMPORTANT – Concerning your account

Your member account is about to be upgraded.

>> Check out this page for details | Click Here

* Just use your email address to log in.

Have fun making profits with your new account!

Who would have thought?

– Admin

You are receiving this message from Unique Solutions and we respect your privacy. We hope you find these communications valuable; however, if you would prefer to no longer receive emails from us, please click here.

Unique Solutions
538 West 21st Street, Suite 95187
Houston, TX 77008, United States

*As with most offers you find, results are unique. Your results will vary. This is an advertisement.

Return-Path: <uoffers@smtp250.rhsfmla.com>
X-YahooFilteredBulk: 199.127.118.250
Received-SPF: pass (domain of smtp250.rhsfmla.com designates 199.127.118.250 as permitted sender)
X-YMailISG: yLuIlsMWLDuEAAc96JmZU.oQzqYAVw.8rq_4cCZA1xekKkox MuKgZJ5ogpRBZtOZ_nBszkwjxzKs2ymlFpgj_tmeFrzKGrSXdlmQC4t5IvY2 YQVIKtruHWQ92B.oAwVFSxUcz0gjV6PQlxK9YgbH56a_YQo9PSBNYZBpYkMG JC9YJhwYTsrvOSA9cpbRDwRQfP3hrW0Wq6ox8.WdHo0BrivMgXawtKuJalNT FUJTQE1OKcmMztu8T_SqYD3eFnVyB3xa1tURtXiFcbDWH1JFkb_X5LlVDAQi 1hwzkUEWXu4EM7M5tiJFIEf5Sn3M2UmDKLSWFW4zYiIXKjtNgUTAPSbNyx1y 581BiB8Pap8TqUqDlEtRdhuwihn.Z1ILcyzT7AYhc36VCvlHM.08jPxuNZ5R chBdqidzNcNW9KbmLlsoXINRrZZ9kHYI1lQ9__pN5PyLAXNPt5U94aSDyP.U vxi_.A58WEiDWJHUzhlP3Z5817cqVGgIO4E1ntrTt3phuU5SsMDkUpzKEa7d OZYO_dfq6F1KOQKvA9IS_sGChlWD4a7DPemmAbP8Rf9M4unYU4CznGKaLejE GUp4bZMh1lUz6RepJkAK49caCc2itrkbrSndPbAghCkR0yLb23fu67VS.AZJ NgKNvs2d4bIJoWkKkBeDrEeQBbsy8J2V_7IrcGVrnzBnImgPVq8qzZYY7Vaw 4xMFtS0NDviVwQK1WR6YgmJLv6N5vjJfT33gNhjurrAsjDdg5EDjjUlJRLFM bjyGR8Koqnsb6T_snSNI9f1O5DJb4WfPO99wvVZNaQue0939kQdh0fqm44eZ ZfKdNXQKaDww3c8N_Uy7s7DoYf8VfLBcjCNpvfH2ZDtO7fP1lTpcVsndkw6U n29TYHJouPxvOmzt0586AxT7mYeKWwQnzqWG.tLk8jbkJbUcuPp91eiXqSki vTO1w1hDzGUTSeLD1kT8B9XYutBakR6afqkKfouXbIbZWocfoyPGLUAZcT_2 VNsVZsIk4hiuwxw4mvWh1tvk2He5zZe9._k1Mregt643PU0NDYtWcdtTZddd jHiaiDC4P9oRSBF3S80vo0L1C4lvZWQvZfyr1TJlBTqUSApmY0RWsrVPVDbW 2TcNAE.dbiqQrY_CJ6iVClcUvGTAEuSCIcf3YG8PWghepoiczKjtPliyiDj7 KKxPVCEre1nSOjeSrep3wrMBetCr.J36aBSoeaa08uT6Lr4.zGHD.MdzhOq8 9sGVxO5Sr94Xwc4XsNBMVp9_lEuQJ8dTTz9CG8aFz3_8oeI6JfnAz1VsIOl6 xJ0ky37wD_VUBsIQOc8Aq6CIcBi07cFeu.mckSvJA_Stnzae7otayt60QLbg hV9_WDw20nGbeRbYX04ZprgLuRqYUSv1kbpo9Sc5fzeNOGWZUX1Qpb0s_oXW d9GLYh0P.86PdXFTFijJiiqxVGmTPGC_9Z5jDx21tB.UFWeI7zL23g604kNe CRGoi3gYy2c52SEUUfbRe.IZIoeFsWOqRIgZq_ap3ulmoYlK8K_._N.6B1c-
X-Originating-IP: [199.127.118.250]
Authentication-Results: mta1349.mail.mud.yahoo.com from=rhsfmla.com; domainkeys=pass (ok); from=rhsfmla.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO smtp250.rhsfmla.com) (199.127.118.250) by mta1349.mail.mud.yahoo.com with SMTP; Tue, 22 Jan 2013 15:46:08 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; s=s1024;d=rhsfmla.com; h=message-id:from:to:subject:date:mime-version:content-type; bh=1HijUMHlB9VnKqM9eg+iEHtzT4g=; b=eJnUoCTa37zIEBJKuTV5NXLi6p3jaHn1L24jPP3TiAslprTEwJUwQvZUxFmnlW/YfgKL1ymt2E5+mj+pTAuOwDONbvN5xFFr0/xpYSPA3tbult9/DGm3f72SH0l9ESDkQGr+I5py6ykle1DvdSrgPbHOdBYZMAcMoYZhheAn20Y=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=s1024;d=rhsfmla.com; h=message-id:from:to:subject:date:mime-version:content-type; b=DxRKBeHBDeXIzSRNvDOqBnDlCyfsHVuTgtEgsyPeAwqHQ+YkZSjWPwuwVgFO65/aKzUCh1XCFg7ia1utyzbYWvRTa8lbaTrTxPM8Cyoxc0r1BwrKcsCnKM7KpvsZOddFgqBPhYjzXnltMIpsrlqjUpjMm1UMggo1urn/pQ7AMMI=
List-Unsubscribe: http://smtp250.rhsfmla.com/u.aspx?u=0&e=1206&s=3280&w=0&x=24939953&y=1035&z=2
Received: from Pickup by smtp250.rhsfmla.com ([199.127.118.250]) with SMTPSVC; Tue, 22 Jan 2013 13:44:25 -0800
Message-ID: <e8c233fc88f26622eb4c08700e83774d@rhsfmla.com>
Reply-To: “Admin” <uoffers-1035-0-24939953@smtp250.rhsfmla.com>
From: “Admin” <uoffers@rhsfmla.com>

From: Admin uoffers@rhsfmla.com 199.127.118.250 uoffers@smtp250.rhsfmla.com <> uoffers-1035-0-24939953@smtp250.rhsfmla.com

_________________________

Dear Member,

You’ve been {selected|chosen|picked} to {begin receiving|receive|get|grab|make} up to $9,587.12/month
with our {automated|done-for-you|easy cash} system, starting today.

>> Your instructions can be found here

Your {passcode|invitation|reservation|access} expires in 24 hours.

{Congrats|Congratulations} – see you on the other side.

– {Member Support|Member Services|Member Center}

You are receiving this message from Unique Solutions and we respect your privacy. We hope you find these communications valuable; however, if you would prefer to no longer receive emails from us, please click here.

Unique Solutions
538 West 21st Street, Suite 95187
Houston, TX 77008, United States

*As with most offers you find, results are unique. Your results will vary. This is an advertisement.

Return-Path: <uoffers@smtp190.rhsfmla.com>
X-YahooFilteredBulk: 199.127.118.190
Received-SPF: pass (domain of smtp190.rhsfmla.com designates 199.127.118.190 as permitted sender)
X-YMailISG: VPZdwTkWLDurfgCFMOHmYgqY3eqnrGg9peGtK9cnARbTs0UY mB940H8qeYrQA2X1DVGkgmNbmBS_nKOknyoA1YQ7LF5yT6HVFTc8QMBXxmDr 2oh8Cqygq.YkarKTwPUghNl6J3U3Oi3bsGNz5ZAi04sAMyvONbsmGgv9uFGO vI101lB2rWICQZ1UkJBwcR_VfbKtxsuCP6xOKjiRj_zcho0YXQm.iMJx9dYO 3mjYR3YxdMYU8RaviZj8ZtqspDChbuXlNLdjv.GkhRROfmDbwXpMOC.EQZMG Y98WEgs4utbx66zAj4QB09L7JuyISJJ54MTkP0IR5cIuPmiql_wiyIuu2C08 jV9LUQB3vRw6uPgXn8aaOkgVAKSHdIjG6ySHgPxvAIaSNmFvq.Ye0B_nsoE6 XaaUZZ.uLdXpkAR7rqZ_gOoSdNe.7OOWDTxQYSqw2kHLCaymn7QB3x_bZw.D T.TX3kjLwYcgYItTWyZbpQjgu9fKZqGDnoZJCJgLoVBCadreP2U_RAYe_OZ2 DsOhlGxAdeMDib4Tx0vcFpGOkIIJUM2Jb9M0sWoXMVnfSO_BP7gePon9WF.A eZUD1Zb4NWvgOILODtBn4F3Aw.L.2HYZZdvXR1ezrCq1f7DyaxjVsB_95.4C pBG5fYltNetZIildtQY0ZmvnMLvOctzeYwAr6Srjs1UjiaWqGnfnEEWes8iX SQazddtC.HMLTeBUijZ9ZK4Ba306zcaDP7t_kDA5xm5KsQCCDZ_8esuUCT81 l3E_8U5JBkdwirVTcqkU_35qudpu.MJOfPoTq6mfWjzN4mG02pq.XLjGZNQs DovFHrC5GkVSrgixj03EuU3NvqaEDId12DVZeC9FnfX4KE6vxHN.fdnyzuOx LlmYrbF6qP8rzNkUOP7CurVvVoSwQNMLw248KS4FJlY_tr29CRKkpcp87mhT zcfC7OyYrXDdLcMls6i3bYkg.wn01BkaceU4EReScuz14U2fW8zoJIPYuBTO V1DAHtJfvKzPAeoKLW3U9MoqZsS6LJhrYrO1hB2C3M0BQSQnmQO2d4pG9OoE avUThkIHnd30b6oOvFMXOkgIbaufuvxBg.akaro8AP3us4OZDaBNm_4tQcq_ SQtJwOY9MqKcVft.XW28wmgNNeXFGVejRDbgGyGLXmaCyFn3cH1WPHhRdmqc k2Hy_MpoLWojZTp1eEv5OAH.jELv3C1Gok8tHbiiHUmXcJHh5ggiA46sCJ4G pvDyuBdgvc7SUcKh5maw7nTCfaD6_IkDXFE8fjLeOMC57whVYuRWVFenHLAL Re6mFD.kR.ypD14JU0.MI6b1LENiJaabuQ_oTVkLQtJjWnjxyUTpN9hPpdLm 3IIwIaPzyB.0TS3VusHiN_qW6vFndBM5zyiPPJbDlqyQsmra.j3iT7omgDqq PUL3fmun8HxW4m51vvDJR6t2RUL1eYnYa0zvwQ2Q2_Yeac88xuk4dLjZ4ODR FXtSUw–
X-Originating-IP: [199.127.118.190]
Authentication-Results: mta1129.mail.bf1.yahoo.com from=rhsfmla.com; domainkeys=pass (ok); from=rhsfmla.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO smtp190.rhsfmla.com) (199.127.118.190) by mta1129.mail.bf1.yahoo.com with SMTP; Sat, 19 Jan 2013 14:58:25 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; s=s1024;d=rhsfmla.com; h=message-id:from:to:subject:date:mime-version:content-type; bh=zRul4w3H48DuiL9Y4c7eeegoX6E=; b=m53CP0MEHIJErDgpLEUoOGPql5iYhT6Fi3fAqo41haqTdIxu/R3Dr+MTEDWUnoL6o5FcuP55npBgYCGmgNwLSzZmEAC626R8pkC3gfKQI6neIzNinxMXBX3/BEtG+Az11U6907E0lxM//PiwmHy2LnF6u9YBGIc8/hswIYcs0h0=
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=s1024;d=rhsfmla.com; h=message-id:from:to:subject:date:mime-version:content-type; b=IWhM84InohJWJmH2MPS2ufgtHE1hiMojkHfX4TpTf9nCj+CyeAvMJGt02g424Z4XkHiUd7qk3dUzmzX9cZ7Fjl1Ao4cNfvFIlon/7tnuCowqxU5obezaFD1RsOjbUVo9FhW2KwmWyCFUIfWZ7mz2PU2yfVL3UOgqdEisU5RPVq0=
List-Unsubscribe: http://smtp190.rhsfmla.com/u.aspx?u=0&e=1074&s=3220&w=0&x=24939953&y=1019&z=2
Received: from Pickup by smtp190.rhsfmla.com ([199.127.118.190]) with SMTPSVC; Sat, 19 Jan 2013 14:58:13 -0800
Message-ID: <1de23ceab4694ae6360f45310a761d27@rhsfmla.com>
Reply-To: “Carrie” <uoffers-1019-0-24939953@smtp190.rhsfmla.com>
From: “Carrie” <uoffers@rhsfmla.com>

Carrie uoffers@rhsfmla.com

 
Leave a comment

Posted by on 01/28/2013 in Uncategorized

 

Tags: , , , , , , , , ,

Suspicious Spoofed Craigslist Email

SUSPICIOUS FAKE CRAIGSLIST EMAIL – PHISHING ATTACK

01/27/13, UPDATE – I received another phishing email by a supposed Craigslist user using the name Eduard Frank – I’ll will post the e-mails in order, newest to oldest, along with the header details.

I don’t have any Craigslist ads currently listed. Infact I don’t even list Craigslist Ads on the account I use to bait scammers so I was immediately suspicious when I received this Craigslist email alert. Not only are the two ‘Craigslist’ links spoofed (the actual URL is not Craigslist) — but the IP address is blacklisted on many anti-scam websites.

SUBJECT: i would like to buy your item from craigslist RECEIVED: Thursday, January 24, 2013 4:22 PM
From: Eduard Frank qdbfwp@hotmail.com

EMAIL: Hi Am very interested in your item posted on craigslist : https://post.craigsIist.org/k/EEEYZLFl4hGbaqXZBYzI7A/vh279?s=tou This is the same spoofed link from the previous emails. The actual URL is goo.gl/aiNwi 

is it still available?

HEADER DETAILS:

Return-Path: <qdbfwp@hotmail.com>
X-YahooFilteredBulk: 209.86.89.63
Received-SPF: softfail (transitioning domain of hotmail.com does not designate 209.86.89.63 as permitted sender)
X-YMailISG: f21Sl8cWLDuLkBRdjpHUdX9xerAr20OQ.qHh.cYAhFw5lSy9 InkNTHdcI2EA5oGO9s9WRGoE8X5ydhJMddl7xNfU7SS5DV.ZmEuoogthq2Mr ZvEhsMyuVJDUF.SjyE4Tc89NIsqgqTDyubXh8JCI4vlsSXzjTBeONvNIq6Kg cqZ8zxS3GmdYZWjr7H42UDM4exf6rEjAzJpgC8FAMm4ynJLZBkBoyWFfO2Ll qv.ng07yAnqBA3sFkFS_Y.CSVvZm88fwcMZlZyRi_4wzLBnT5yvTPIAuvqT5 tNs4bOiPVUJfXgqNLp7wrrOUqTjAkUqRUs66quJ6_O2JXVAoU.ZY6JoiL5EO kI0w0mTfK_Ywb.QBcTEUSmUWvqn_CQsUlSLAvyn.qxAh8Y2runI8uiQygKGz PJYlnCyv78fhIxh.nBTk_9CqekcGWowgPXwkvZapxZ5_jda.VjWRmrJQpk5Q 70.QaXHLbKcyWqGU_DdG7adHyc9kvV4EiGdecXmmVXU1qM_MUGmbhRHPkInj yzHCteTsIZesiuI0wKIPizjJTdqCC.NN.UiWyXZlMTJfPXtQTa4RlRBDDPyz Xy0ki7OZklAZBGKSTFhDY5BgR.NKTJ6XWiPXz9gttbYrBMBrNkY2HLd0zEHX 8NAX0o7PjQfXOIJ1a1EB.3ZhcDS7kWlm9ChTpiVdDLLcNq8IYZoGIXdR8X4R jHFX6pCqOPafF_ukxFRia_W66cmiyjhUISaBWM5GDA1bam3h8Q5iDQhonN0H mt38Vl9DJdp.0CCcpXnGj8EMezEmFErlX7riKAHti3bHf6B2psPM9F3Q66YD Yvev1gX2V8AXHutGkN5kqIbapmCsFrEcNlsQ6PWOa_MaF50swL7c3qegbBmB aX2qBolGvmVByMl7LRqFYxvUirxOQxoRYQgh3RsDrOckcbf6xCeNIX_BnCMK MHTpGaA4sYqPPKdCTky02qrqvsrC4jgmgJygFS.ok93p6xLaA7J18EWkLP0B 7HXxWRY4Gv70DVDXfCmC_W6S.wfF0Q96oxHXhE8eGCz32L.sDLEJ.lfp8PTT ta6RcLyAAW5spPFLk4cFqavI1kDCiU8FxlcCL0wbAWcL9MbA97xKPwuwfzTA onZcJp5qb2AhvBc2FN_LWuRAL6bE.1cit4BS_T1xjj6ZrGV9cm5KKu2Bb7tz rOMyUXhj_Jti6n0rBzP3FBJkgzc2j.vTFMrgV.gbGVH9vZRYfUui8ndHyPXU QaZMaLBHHys-
X-Originating-IP: [209.86.89.63]
Authentication-Results: mta1160.mail.gq1.yahoo.com from=hotmail.com; domainkeys=neutral (no sig); from=hotmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO elasmtp-junco.atl.sa.earthlink.net) (209.86.89.63) by mta1160.mail.gq1.yahoo.com with SMTP; Thu, 24 Jan 2013 08:23:36 -0800
Received: from [71.237.118.147] (helo=User) by elasmtp-junco.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <qdbfwp@hotmail.com>) id 1TyPZx-0002jO-Fi; Thu, 24 Jan 2013 11:23:05 -0500
Reply-To: qdbfwp@hotmail.com
From: Eduard Frank<qdbfwp@hotmail.com>
Subject: i would like to buy your item from craigslist
Content-Type: text/html; charset=”Windows-1251″
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1TyPZx-0002jO-Fi@elasmtp-junco.atl.sa.earthlink.net>
X-ELNK-Trace: 8219d692fd5468d6d780f4a490ca6956d5d4673fe7faad86623ec139337907e38e9f230fcf1cb831350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 71.237.118.147

Your posting has been flagged for removal.
Approximately 98% of postings removed are in violation of craigslist posting guidelines.
Please make sure you are abiding by all posted site rules, including our terms of use:
http://www.craigslist.org/about/terms.of.use.html This was a spoofed link with the actual URL being goo.gl/aiNwi
If you need help figuring out why your posting was flagged, try asking in our flag help forum. Include posting title, body, category, city, how often posted, any images, HTML markup, etc.
If you feel your posting was wrongly flagged down (2% of flagged ads are) please accept our apologies and feel free to repost using the link below:
http://www.craigslist.org/about/ctd/repost.html This was a spoofed link with the actual URL being goo.gI/aiNwi
Sorry for the hassle, and thanks for your understanding.
——————————————————————————

Date: 1327114516
PostID: 24177504

HEADER DETAILS:

Return-Path: <dycsbl@craiglist-accounts.com>
X-YahooFilteredBulk: 209.86.89.69
Received-SPF: temperror (encountered temporary error during SPF processing of domain of craiglist-accounts.com)
X-YMailISG: 2h.FN3sWLDsEDE8qqS_yEcqB6M1HR9h.u85ZaLiGYL.IEQuU iab6_WhytOr0v8KZup3soVlAl7qxu2RiK1epX7ek6GeXBAj6poh2cJDD.zQg jPJjyPfclZKW_NnPFDTrSWD79AqrNkBBoJ5hW__LZXlZUz.ZLpSi3ZGXK4Ge VIQygP.nLCk6NbRgJn9twOcwwHoP9j9q6on5YSGUI.nb1gYsctI_PDBGrRnF KvveQMYnrrNG4DgZdrwZSRT2Ox8yP7gB51A8WWDw8krq9Pr5un4ainmeAweF XEuXHV0gt8Ow1O0rAIxiwCKOtJWaYKiesaCJl7_h6QSFdL1PpDwAqVZXazI0 QmP3DUNfRbb71rVQF.0VNpiFdohCTjJUO6uB0YxxGT6CZ10wN1eCKhe4eSPv e8vXdS37Jh0ofSMl9amPk1N5KfTnveNm2V6cqR1pA1vlUkaA_5CyVppBKBMz jtvxdFt.RDiMZzuE77R3OHnsdEvmu4PaX64_PEj.vf._aKc738JxzsFaHmf8 TQAsQMpo.WAEdh0b_5rITS4ima44rP.6UIKfFqAc31KrxVEBY9oGXCHB9nz9 V3nDA50qbSHIIagS9ZVZTstHWy4dum2Gaz9KgGNMoR6UIhnw4H6tagKAyPPY EnTD1ypXM8jQocv6l0dsJk3azMLION2iNB9P4Ow6gtjMwkVygfgFrchDUwRs fSxZ4_itBU3TG9KdPtUCdH5wUwuxAGiVBCjLVsLlg2d694opIOVX2J40BGRH IYhXAAfbxnnbpYnzY9.FWxSe.uRNv0UKJ5R91syZw_5x.ifYmztP8ZxSubqC 4PEvO1.qavB3u4KwY4riKy.H5mmZBAKLDx1EY4pYVofWYjywCEiVOuq0.KjM VszzfJPQT3i9fvKhxDE9THio9A1vagNxw1rThbN1v0cPF7CgwE1yGIXPKv3Y DjIOVLoI7C3ubQK1AioG3t6RCfO32iPiiefv0oWc4x6LYaDv0RMeO32XiVsm qoptc3moDkfy29NJAQZXHA9oO.GwX4fjNRIliMgY8OaK6zb2XRbBdDBfdD6f IVgVhUSeYJKmYxxWOmWP.DX1Jq2aZNU3LQ5MyOV0U054Ws9MRNZKjR3BJcCi 3tgqq1kcbrPHOhkWI0hjJNFaLZY8z3qLl41wPKkkq8H0FN0.6q._GbmNGB4z twsjMemUDLkyY32h.MUaQiL.3UvRYkY7mXIsQlCwKe4BeYyY0y03rcJMb3iF FIR2s29QvuOjBD7kRTSILNW1qwInYb3kFH_ODhQTUTLlYiic9f.M_uYkGXA0 X6nSS2lFS1d2hK.XlYnYjn49yt7oY0SVNiPQ6Z9FqiXwp4cT0cKnB6NX2NE8 DZGrkmlBsrgZmJA8n_9hHwi.7CKGEmLJnqP5MgQkCuKNEz_z0l7yYw22MkJH qqeHgmb75noxVzMTDd1KtfwgGTmnVGcBzo0vvAlk588aZfVAyXwXZMCX
X-Originating-IP: [209.86.89.69]
Authentication-Results: mta1220.mail.sk1.yahoo.com from=craiglist-accounts.com; domainkeys=neutral (no sig); from=craiglist-accounts.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO elasmtp-mealy.atl.sa.earthlink.net) (209.86.89.69) by mta1220.mail.sk1.yahoo.com with SMTP; Wed, 23 Jan 2013 12:58:50 -0800
Received: from [72.172.204.128] (helo=User) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <dycsbl@craiglist-accounts.com>) id 1Ty7Nq-0004nx-4X; Wed, 23 Jan 2013 15:57:22 -0500
Reply-To: dycsbl@craiglist-accounts.com
From: Craigslist <dycsbl@craiglist-accounts.com>
Subject: flagged & removed 24177504
Message-ID: <E1Ty7Nq-0004nx-4X@elasmtp-mealy.atl.sa.earthlink.net>
0da15bcd0e72a23c13bbd08df6cfe9269ef193a6bfc3dd48c25deae7748207c3a2f7e1f2b096e1d07ef9f80aaf77e5a4350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 72.172.204.128

dycsbl@craiglist-accounts.com 72.172.204.128 <> 209.86.89.69

 

Tags: , , , , , , , , , , , , , , , ,

Julian Thomas

Phishing Attack – MALWARE

 

EMAIL: http://theglobalviews.com/wp-content/plugins/akismet/ugoogle.html

HEADER:

Return-Path: <jthomas299@gmail.com>
Received-SPF: pass (domain of gmail.com designates 209.85.210.173 as permitted sender) dWdpbnMvYWtpc21ldC91Z29vZ2xlLmh0bWwgATABAQEB
X-YMailISG: _QbkUa4WLDtDDImGzxIRh._8UctX7E_yEakMVKzPQVFgOxU2 f8BXgO9XOACNn18iN8QwyZUxCQjglxaLxh4l1dHKsh377v_gydQ1_Y9OFsPj 0k8K9DADiuebd2j.rmz9EnAaSwF2jdtNGDrTEPGS_EZilciswFOJti5hGzmy uPfoF.AJlwdTa9vYWnC.ijOt7dkRDUrJ6cPYFkuGK9Fa7Vy6.WWkGdmAlvxp mum7F6q6e6nOeCwHLK5Hi56e2QqN3TNT3M92wT5X9GDKvxGhTR1D5JebAs0D Ta_K6z1CLwIcycuHy81fSgDvcGZjMDMdBn6TlMal02B7KUXXEjZbKSdGMbCg p9_qnbQqoKeybTscfuwT.DeaW5AhOgxNxSMJQjuQlTzbdz0oyeQDVS.NrGdY aAXwBp8.oSejmBXdtuPWsPSo1QqhkvE4xOAH0JWR4Ffdc3aMV86DzbLZ5xgb k6OmZZq.LkWDm7WlSGboqNQZcjyHFIvZHHTArW_mv4OBklvqb04bzyxSsAFY mRbtLcROkVI0MupzMJPwSQY4uqXTvfAfD2cyV2Omx6udS23Zbi5BEJZV6VZr lFsiUFuddVHiDZYzOTgYaTQYUJuxzL0pLS9XQtIMwbFBZ7HzZ9PCxx0MpvEE p5EEdb5gDPidUiFjPEd8A7seTb0bft2VCgaWgybRiBYGyvTb5mAGXw3CrxHi 5pSRqwQdVr3_YSKPxD7ziKVD6yTHRI9n8cWJ_WYwF3XJRFvyOqq7.rM5gmlN Z1LMh8k8x_wTcVKMSYdlz1ELt_4H5CWL6IQM.juI_Ag59GSfmOThO40utvLr eth5EljfPr0IhUMOChtpZnsEbGXbrCe2bQRcr.u2LVQ2NoOX_g6nb_yX_ChG UAHULyY4IvpPsG9PpQol1gfSKVp_LSXF0dxzem4Wf6jKdRkswKe3yZpFrXmF o2kEOJtCqwCrk05Z0naHjZiQ4IOHWT7nzM3oNiW1eaobvAyip1W7bZvG6chd HGiLQ8JEarox2qFrPCzTj8RDVl66byTZ4v0XN8MrkIcq7MxM1oZRibWXniOQ wn1Zj03LkieeflXlhgZNUi566Ced5zol9ousQfqUVBQeH46.5038.6aWFmv4 iM1tBAPuh9SxdV5FcHr_rCGgQ1CUYvOcWwhWHnIHACk_tvpIyXZLXSDBd5Tv 4P.FV6_D
X-Originating-IP: [209.85.210.173]
Authentication-Results: mta1259.mail.bf1.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO mail-ia0-f173.google.com) (209.85.210.173) by mta1259.mail.bf1.yahoo.com with SMTP; Sat, 10 Nov 2012 02:23:05 -0800
Received: by mail-ia0-f173.google.com with SMTP id m10so3261400iam.4 for <deleted@yahoo.com>; Sat, 10 Nov 2012 02:23:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=X/EcyHI7fCzBVRIZx1ZLHDvk8NTmX3HJwBi5boQXb1Q=; b=oYfe6tprlmGl4KQGlch5xN9W/sfJdTSxywTJ0RPlOyKp92uoBSeDrC7gi6Cju6EujQ VdKZO205dG3h2pX64Wt+vQiAjwONADSwU0jZ4NGFie+TzVWM9Hfs5RTrpgSDHrRr+E93 ElhMjrYS1fpk3P4LxqPgSzZQFWZV8XGwMUE24Hz16+0AAu0w7cd11I5h7d//s8sIY7MA wmKpBHSg7wxoBMdQ0gik6WGNcTFb5RTY/YF8rYv/6hQY1geA6XGjIRW0iBeUWALv9TBH G6aLZyUkbNeiqwRBsWou2dNAljQgW1UDYlDrPpu6fvSDVhDGhrPZsOjT1xHgFeLuO3xK k1dQ==
MIME-Version: 1.0
Received: by 10.50.16.144 with SMTP id g16mr3131462igd.23.1352542985776; Sat, 10 Nov 2012 02:23:05 -0800 (PST)
Received: by 10.231.11.67 with HTTP; Sat, 10 Nov 2012 02:23:05 -0800 (PST)
Date: Sat, 10 Nov 2012 11:23:05 +0100
Message-ID: <CACYsU7yNrJqyaoLs1pASkUTWyk-biOmk+-b79chG_LMtGjwWDA@mail.gmail.com>
From: Julian Thomas <jthomas299@gmail.com> Add sender to Contacts
To: julianthomas@facebook.com, mmdavis6@gmail.com, mzwx4-3270719590@sale.craigslist.org, deleted@yahoo.com, theenvycorps@gmail.com

“Julian Thomas” <jthomas299@gmail.com> 209.85.210.173

 

Tags: , , , , , , , , , ,

“Michael Brewer”

SUSPICIOUS EMAIL – Sending unknown links in emails – I don’t trust it and i’d advise you not to click on any unknown links sent by unidentified online users (or bots) (FYI, I havn’t had a Craigslist ad up in months so any emails i’m receiving by people claiming to be from Craigslist are liars.)

Hello, my name is Michael.  I am a US Marine veteran, and I was just viewing your ad on craigslist.
I would like to show you something that I believe can help you.

I didn’t believe it when my friend approached me.  
After seeing his results I decided to follow his link.
My life has changed because of it.
But don’t take my word for it. Visit my link and see for yourself.

Best Regards,
Michael Brewer
612-5597501
Here’s the link.

Link was here

I didn’t click on the link and didn’t want to post it and have someone else accidentally click it. The Link said http://networthgain(dot)com and the URL was networthgain(dot)com with no ‘http’

 

HEADER:

Return-Path: <msbrewer@gmail.com>
X-YahooFilteredBulk: 67.222.50.208
Received-SPF: neutral (67.222.50.208 is neither permitted nor denied by domain of gmail.com)
X-YMailISG: S6Vh9hcWLDubgDGy_xQOlA8KEUP57lQplXkxzdnkuUs5UTL8 IHAmaELNCB5lqzGFOk5uiGRU.rDHF4wjb849pP2PZroMduwL2hY8.ksxIG04 IjjzxTS5BJRc6bn04pfF6hvl8OavbAl3NpZcoSSUColwAiiO1fhMWBNOUc_N grTMJdWNiFrmvDGExWJaTIIlpapw82RvCqcWkE.nMMM7KX1OIQLFiEPIfL9u U0jkH5hFS52wiy7TTFfnfFGPMWMQWJXkRYUs8kohLVKvDLtsk4fg5ZwdjBko D4ZclazthTgrDeMj6ps1EqHkQVQesZk9rBGKs4wrK.zQuJj52qe26VENjFjl PZjE2RcBAS.g_dOPyyBcOtpKBawWyHz08_X42qtLaCBlcDmt2XBb7iyCf3yE XYhV1SNVLWAG1BwoAQ_ufTQOrotoQEtwbMcPPlKU2.LXyvZMCDdt9exzI7au LaedSKChCnq0bl5V1JVfM8Ub2K1Ugla2_9YgIK4wveaD7V1uKe1sGBCfGaa5 alRTJJ2zl4uwynAFwDmLEWro1SOqIgchab.FaYsfGJCU8VPfnrFv.VzLSfKl 5uEKniX.4dBvbP4SeqH84n5AzGze8hjt_KiNu1J4hp5J_Cy_48ValPe0Dk9a G4LRVcHWvoKEIv4BPWO5OoHras6XYBAuDUuZDf9pffMJlLzkHoHDyoD6V8ef JF70e8WwFK73wvj9cqOHFKvjMlzeQjUuJ6w34nfVfo5dhNNPPr6GTEA5hkaR 3k3VvU67uh2ecUQytwpal02AaqEPS2ksVwA_zwByf286er2U7Vva1CZztWog .1eecc2V6fPlTTCuNn0XdGXRaFuUUIqx81_qXKcwLEl9em_a4cc2T9yzKVtL PqMDRBlyLXbH_WAwRl5fcjr9ifrbyGtd.IorpAF7NSl4wxwaUHlWpxwo44Fs ZoSh.Sgq69SxyDrwW2YrBff5dZWNCGfdMKJP8naMy46AhWb07SAlFFxj6im. T_1V6EdBnONACh36oCI8Efa99ahNQX8bbJK3pHygTBGqb5LBUdA2bkvt6G0p mursgi3SHF053GAxCeiy8srOdJ5n8keAADLFNNpwCcuNmvWvaYXMRmw3MFow cbSbl.tUYo3.cWhOgQVTUBUq0O3.keasOT9HNv5.4zfVcm7HNe5g4bUhlUMm VNxc0U_pF4LspgcPAWVMMyHCBSRVJXZ0sHMyxAAj0FTGXBp3TKoha4ENrFe2 5wgQk.8VMBQxL83aMQBCEejwHcBwVz8QQDROc9RHs_NmpZgDQ0vSSDzttOX. fvFTVavHkYCbvPUbkVpd.j49mA–
X-Originating-IP: [67.222.50.208]
Authentication-Results: mta1173.mail.mud.yahoo.com from=gmail.com; domainkeys=neutral (no sig); from=gmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO outbound-ss-1353.hostmonster.com) (67.222.50.208) by mta1173.mail.mud.yahoo.com with SMTP; Fri, 12 Oct 2012 01:20:40 -0700
Received: (qmail 28821 invoked by uid 0); 12 Oct 2012 08:20:40 -0000
Received: from unknown (HELO box587.bluehost.com) (66.147.242.187) by soproxy1.bluehost.com with SMTP; 12 Oct 2012 08:20:40 -0000
Received: from [66.41.126.218] (port=63105 helo=Kokunai-PC) by box587.bluehost.com with esmtpa (Exim 4.76) (envelope-from <msbrewer@gmail.com>) id 1TMaU3-0001Wc-VB for deleted@yahoo.com  Fri, 12 Oct 2012 02:20:40 -0600
Message-ID: <024463a9-41194-06891390529514@kokunai-pc>
Reply-To: “Michael Brewer” <msbrewer@gmail.com>
From:
“Michael Brewer” <msbrewer@gmail.com>
To: deleted@yahoo.com
Subject: Craigslist Reply…
Date: Fri, 12 Oct 2012 03:20:14 -0500
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-Identified-User: {2654:box587.bluehost.com:exceptk3:exceptionalismofamerica.com} {sentby:smtp auth 66.41.126.218 authed with exceptk3}

ORIGINATING-IP – 67.222.50.208 Host: outbound-ss-1353.hostmonster.com

IP – 66.147.242.187 Host: box587.bluehost.com

IP – 66.41.126.218 Host: c-66-41-126-218.hsd1.mn.comcast.net

Michael Brewer — msbrewer@gmail.com —

 

Tags: , , , , , , , , , ,

Suspicious Email (possible hacker/phishing attack)

Similar suspicious emails came threw from unknown users (possible bots.) In the email was one link and the email was sent to me and dozens of other addresses. The IP’s in this email and others alike, a IP’s used by Scammers sending out fraud mail and the link are believed to be spoofed or a possible hacker/phishing attack. I havn’t clicked the link and I don’t advise you to. I posted it so it would show up in search engines incase others looked it up.

 
 
FROM: Victor Garza” <garza-victor@sbcglobal.net>
To: jsissonsinvestments@gmx.com, harveyhcho@gmail.com, generalmeuse@gmail.com, minwater2009@hotmail.com, nilamerlita@yahoo.com, porkyexposed@yahoo.com, pers-pjz28-2625231933@craigslist.org, tognar33@yahoo.com, hanzdb@yahoo.com, tagee0@aol.com, ang7maulana@yahoo.com, revitalisasidiy@telkom.net, ini_bisnis_gw@yahoo.com, benny_irawan0581@yahoo.com, wawa0926@kimo.com, dejuntaxs@yahoo.com, Bharathsabari.Venkataraj@bh.yokogawa.com, modeling@knoxvillemodels.org, patty_aiken@juno.com, utuydjamhur@yahoo.co.id, freddy_saputera@yahoo.com, herzal@windowslive.com, sssxxxp11@gmail.com, selina671@yahoo.com.tw, chrisgladdenmusic@gmail.com, sy45689@hotmail.com, daffy_dee79@yahoo.co.id, star_maxing@yahoo.cn, hannien_sans@yahoo.com
 
 
 
HEADER:
 
 

The ORIGINATING IP ADDRESS OF THE ABOVE EMAIL IS KNOWN TO SEND OUT NIGERIAN 419 SCAMS WHICH MOST LIKELY INDICATES THAT THE ABOVE EMAIL IS SOME TYPE OF SPOOFED/HACKER/PHISHING-ATTACK

Example Messages Sent From 98.138.229.103
From: Spring Investment Limited <web.office_3474.32@veri
Subjectnone/blank 
From: “Frank Jimmy Loans Co.” <web.office.003-10@rogers.
Subjectnone/blank 
From: evelyn <janniferkiss@yahoo.com>
Subject: HELLO, 
From: Nadia Mbembe <nadiammbem@yahoo.co.th>
Subject: Hello dear 
From: Miss Nadia Kallon Mbembe <nadiammbem@yahoo.co.th>
Subject: Hello dear 
From: gift ukeh <giftukeh@yahoo.com>
Subject: Nice To Meet You, 
From: “222222222” <222222222>
Subject: 请查收 
From: Walid Kh <walidkh52@yahoo.com>
Subject: this has been your time to shine 
From: “Mrs. Sharon Crawford”<info203932@skymail.mn>
Subject: COMPENSATION ALERT, OPEN ATTACHMENT TO READ ALERT 
From: “Mrs. Sharon Crawford”<sharoncrwfrd1191@skymail.mn
Subject: Scam Victim Compensation Alert, View Attachment Fo
From: Florin <munguu_jin@yahoo.com>
Subject: =?iso-8859-1?Q=?= 
From: “MRS. VERA DAVISON” <mrs.veradavison@gmail.com>
Subject: NOTIFICATION!!! YOUR E-MAIL I. 
From: Re majer <web1.118@att.net>
Subject: HELLO FRIEND? 
From: PREMIUM FINANCIAL HOLDINGS LIMITED <web.offfice.45
Subject: Loan Offer 3% 
From: rejoybaby maj <web69.12345@att.net>
Subject: HI It’s My Pleasure 
From: weboffice 000xxxxofficef1 <web_officefile0990@att.
Subject: Fw: PLEASE YOUR URGENT ATTENTION IS NEEDED
From: “MR. SUNNY LUCAS” <sunluccas111222@rediffmail.com>
Subject: SOUTH AFRICAN NETWORK FOR WOMEN 
From: “MRS. SUSAN SHABANGU” <shabangu100@gmail.com>
Subject: KINDLY OPEN YOUR ATTACHED FILE AND GO THROUGH IT A 
From: “General Manager”<xxxxxx32@hushmail.com>
Subject: HELLO, (VERY URGENT PLEASE !!!) 
From: “travisgalica@yahoo.com” <travisgalica@yahoo.com>
Subject: FW: Did you see what Dr Oz said last week? 

client ip 98.139.212.191

Associated Mail Server – 98.139.212.191

Project Honey Pot

The email’s IP has also been the IP of a 419 scam attempt by an online user who then reported it to scamwarners

Delivered-To: [my.redacted.address]
Received: by 10.182.51.4 with SMTP id g4csp15278obo;
Thu, 22 Mar 2012 09:07:20 -0700 (PDT)
Received: by 10.224.58.205 with SMTP id i13mr11384387qah.97.1332432439777;
Thu, 22 Mar 2012 09:07:19 -0700 (PDT)
Return-Path: <0desirekoende4582@att.net>
Received: from nm23-vm0.bullet.mail.bf1.yahoo.com (nm23-vm0.bullet.mail.bf1.yahoo.com. [98.139.212.191])
by mx.google.com with SMTP id c2si2125271qcd.182.2012.03.22.09.07.19;
Thu, 22 Mar 2012 09:07:19 -0700 (PDT)
Received-SPF: neutral (google.com: 98.139.212.191 is neither permitted nor denied by best guess record for domain of 0desirekoende4582@att.net) client-ip=98.139.212.191;
Authentication-Results: mx.google.com; spf=neutral (google.com: 98.139.212.191 is neither permitted nor denied by best guess record for domain of 0desirekoende4582@att.net)smtp.mail=0desirekoende4582@att.net; dkim=pass header.i=@att.net
Received: from [98.139.212.148] by nm23.bullet.mail.bf1.yahoo.com with NNFMP; 22 Mar 2012 16:07:19 -0000
Received: from [68.142.200.224] by tm5.bullet.mail.bf1.yahoo.com with NNFMP; 22 Mar 2012 16:07:19 -0000
Received: from [66.94.237.118] by t5.bullet.mud.yahoo.com with NNFMP; 22 Mar 2012 16:07:19 -0000
Received: from [127.0.0.1] by omp1023.access.mail.mud.yahoo.com with NNFMP; 22 Mar 2012 16:07:18 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 987846.4887.bm@omp1023.access.mail.mud.yahoo.com
Received: (qmail 30955 invoked by uid 60001); 22 Mar 2012 16:07:18 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=att.net; s=s1024; t=1332432438; bh=qC9ja17T2XXp6aqesfDLGfKpznCUVeikD60t7/lfcNQ=; h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=y0wL2wF7Ou+MqEhEnoS2H+wWp2Qyut0bPleskdzEgWoAXVYYXWRuzHHupGsu1F4os93JLL6Dm4wBfwhq9Jj+6IMouzb7ghB9GBr4WH34IbJ40+Y0jt3Kvk7xPeKpTq/AgBIpqMVwyDdfHIIGLRNMa/Z//GwnW6XTQY3+R4odMRMDomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=att.net;
h=X-YMail-OSG:Received:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=A9AAuHEVubbzaAjLCe1F2QXM6T4rNgWGc58ZdbiN0y0ONyi3avS69FCJvwGlbvNG+fDU4BbwaEKeZ/xoqRx6qi8T5eBVdElPReyIAcxs27GttTcw9pHIey+Jmi58T/Z8p/ALnnM5qk8/mCO7KB8I96Wr5mlgBNozCw71BP+59TI=;
X-YMail-OSG: BIagEk0VM1kiihpr6_QUOCzsmXlIPZ0xTODn1dDH6rL4Uqu
YKXGlk3eS7WyDQ324tdhkrDgRb_r1xCKsPLS8IdffD7YdHDiUeZfJnmXenuX
RTbjq6F6mMAzY_MWskr9N1jhO_rMHCVrLnRv14jJqe0u3MUMtn9wv1juziRK
ej.JnAtMxZsKrDoWAs.aPCX1V7myQlhnbzsCSNwBTNyB4736ZQJ.lI2rH0dN
phxlNHy61DXsXqiorsbtqRjoLYxlJHMz3vn38iH3unqV2Vb47cBIz4dC14JP
zSYJPQXm1IATDR1cjC9w1YVq4VYB7DaIl2r_970rS8CczZ2H1aXprM7EqlDO
xZvnKodoErHLBoIxuXrcjWKBRJv78_5rzlVEEJHxpEwjqdB3w4HnMdKTjg0D
UL.MtISfulEEKis3tnsjlqmurgKXSc0wUSLyTwFHkT9QucZj5B0roeGYQZSU
l0TQ16rMLi3H00mVaeQ–
Received: from [41.82.148.87] by web180910.mail.ne1.yahoo.com via HTTP; Thu, 22 Mar 2012 09:07:18 PDT
X-Mailer: YahooMailClassic/15.0.5 YahooMailWebService/0.8.117.340979
Message-ID: <1332432438.21116.YahooMailClassic@web180910.mail.ne1.yahoo.com>
Date: Thu, 22 Mar 2012 09:07:18 -0700 (PDT)
From: desire koenders <0desirekoende4582@att.net>
Reply-To: mr.desirekoenders@yahoo.com
Subject: From Mr. Koenders Desire
To: [redacted]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”897918875-1321714197-1332432438=:21116″

From Mr.Koenders Desire
Telephone: 00221771499501
I am Mr.Koenders Desire the only son of Late Mr. & Mrs.Désiré Dallo but am here with my sister. I select you to assist me. My father was a cocoa merchant in Abidjan the economic capital of Cote d’Ivoire He was poisoned to death by his friends . But before the death , he secretly called me by his bed side and told me that he has the sum of Four million two hundred thousand United States Dollars USD ($4.200,000) deposited in bank .So am currently living in senegal to get someone that will assist me. He used my name (Koenders Desire) as the next of Kin to deposit the money. He then strongly advised me to be careful especially with his friends and our relatives.the money is kept in the bank with the view of making use of it for investment purposes after my educational carrier.. For The urgly development in this country,I have now decided to take quick actions and have this money transferred out of this country before it is too late.I am honorably seeking your assistance in the following ways Please I need your assistance in this ways.

1. Can I completely trust you? 2. What percentage of the total amount in question will be good for you after the money is transfer to your country? 3.Can you help me to come over to your country and further my educational carrier?4.Can you asure me of the confidentiality of this transaction till when this money get to your Custody,this is to ensure that nothing jeopardizes my last wish on Earth.No matter what your decision may turn to be I humbly beg you to reply to me.
Thanks and God bless you
Best regards
Mr Koenders Desire

 
Leave a comment

Posted by on 11/25/2012 in Other

 

Tags: , , , , , ,

Hunter Marshell

Suspicious emails sent by Hunter Marshall using a IP/DOMAIN known for sending out scam mail

FIRST EMAIL SENT: http://edebiyatalemi.com/boybullet/70matthewbrown/ <– Believed to be a spoofed link. The actual URL doesn’t have an HTTP:// and this email was sent to dozens of people at once. The IP/DOMAIN has not only been blacklisted but is known for sending out spam/phishing. This leads me to think that these links are malicious and trying to steal information and the links are spoofed. This unknown emailer also sent the email to the following: “nbnxs-3210175843@pers.craigslist.org” <nbnxs-3210175843@pers.craigslist.org>, “ndghq-3255393928@pers.craigslist.org” <ndghq-3255393928@pers.craigslist.org>, “ngjsv-3283872977@pers.craigslist.org” <ngjsv-3283872977@pers.craigslist.org>, “NicoleClarik3@hotmail.com” <NicoleClarik3@hotmail.com>, “nkzjz-3209235157@pers.craigslist.org” <nkzjz-3209235157@pers.craigslist.org>, “p3ftm-3252808088@sale.craigslist.org” <p3ftm-3252808088@sale.craigslist.org>, “p6kbq-3215584511@sale.craigslist.org” <p6kbq-3215584511@sale.craigslist.org>, “p8fr2-3210992600@pers.craigslist.org” <p8fr2-3210992600@pers.craigslist.org>, “pers-38fq3-2698084615@craigslist.org” <pers-38fq3-2698084615@craigslist.org>, “pers-e9dqs-2704366508@craigslist.org” <pers-e9dqs-2704366508@craigslist.org>, “pers-paans-2699763453@craigslist.org” <pers-paans-2699763453@craigslist.org>, “pers-rajgk-2707076820@craigslist.org” <pers-rajgk-2707076820@craigslist.org>, “pers-rzhzy-2705029535@craigslist.org” <pers-rzhzy-2705029535@craigslist.org>, “pmfnc-3209866186@pers.craigslist.org” <pmfnc-3209866186@pers.craigslist.org>, “pmvkk-3228774589@pers.craigslist.org” <pmvkk-3228774589@pers.craigslist.org>, “porkyexposed@yahoo.com” <porkyexposed@yahoo.com>, “pwgqc-3255597543@pers.craigslist.org” <pwgqc-3255597543@pers.craigslist.org>, “pxthp-3223707014@sale.craigslist.org” <pxthp-3223707014@sale.craigslist.org>, “q74zq-3252448536@pers.craigslist.org” <q74zq-3252448536@pers.craigslist.org>, “qbnmq-3268989654@pers.craigslist.org” <qbnmq-3268989654@pers.craigslist.org>, “qd3s2-3236365959@pers.craigslist.org” <qd3s2-3236365959@pers.craigslist.org>, “qhczg-3207863319@pers.craigslist.org” <qhczg-3207863319@pers.craigslist.org>, “qq22w-3232024680@pers.craigslist.org” <qq22w-3232024680@pers.craigslist.org>, “qrwxt-3268506258@pers.craigslist.org” <qrwxt-3268506258@pers.craigslist.org>, “qzsv8-3236584232@pers.craigslist.org” <qzsv8-3236584232@pers.craigslist.org>, “qzz2p-3255572511@sale.craigslist.org” <qzz2p-3255572511@sale.craigslist.org>, “r5bmt-3207962113@pers.craigslist.org” <r5bmt-3207962113@pers.craigslist.org>, “rbender@avrmc.org” <rbender@avrmc.org>, “rgxzz-3253056010@sale.craigslist.org” <rgxzz-3253056010@sale.craigslist.org>, “rockiesbatgirl9@yahoo.com” <rockiesbatgirl9@yahoo.com>, “rrtbh-3236355552@pers.craigslist.org” <rrtbh-3236355552@pers.craigslist.org>, “s6jgc-3228760429@sale.craigslist.org” <s6jgc-3228760429@sale.craigslist.org>

SECOND EMAIL SENT: http://kora2day.com/wp-content/disoiuer.php <– Believed to be a spoofed link. Actual URL doesn’t have an http:// .. This email was sent a few days after the first email by Hunter Marshell. This email was sent to my email address along with other email addresses including alot of Craigslist email-addresses. When I look up both the originating IP and the received IP/DOMAIN, both come up blacklisted on many websites. And both have been reported by other online users. Below is a list of other messages sent from the originating IP.

Other Email addresses sent along with my email address are: “nbnxs-3210175843@pers.craigslist.org” <nbnxs-3210175843@pers.craigslist.org>, “ndghq-3255393928@pers.craigslist.org” <ndghq-3255393928@pers.craigslist.org>, “ngjsv-3283872977@pers.craigslist.org” <ngjsv-3283872977@pers.craigslist.org>, “NicoleClarik3@hotmail.com” <NicoleClarik3@hotmail.com>, “nkzjz-3209235157@pers.craigslist.org” <nkzjz-3209235157@pers.craigslist.org>, “p3ftm-3252808088@sale.craigslist.org” <p3ftm-3252808088@sale.craigslist.org>, “p6kbq-3215584511@sale.craigslist.org” <p6kbq-3215584511@sale.craigslist.org>, “p8fr2-3210992600@pers.craigslist.org” <p8fr2-3210992600@pers.craigslist.org>, “pers-38fq3-2698084615@craigslist.org” <pers-38fq3-2698084615@craigslist.org>, “pers-e9dqs-2704366508@craigslist.org” <pers-e9dqs-2704366508@craigslist.org>, “pers-paans-2699763453@craigslist.org” <pers-paans-2699763453@craigslist.org>, “pers-rajgk-2707076820@craigslist.org” <pers-rajgk-2707076820@craigslist.org>, “pers-rzhzy-2705029535@craigslist.org” <pers-rzhzy-2705029535@craigslist.org>, “pmfnc-3209866186@pers.craigslist.org” <pmfnc-3209866186@pers.craigslist.org>, “pmvkk-3228774589@pers.craigslist.org” <pmvkk-3228774589@pers.craigslist.org>, “porkyexposed@yahoo.com” <porkyexposed@yahoo.com>, “pwgqc-3255597543@pers.craigslist.org” <pwgqc-3255597543@pers.craigslist.org>, “pxthp-3223707014@sale.craigslist.org” <pxthp-3223707014@sale.craigslist.org>, “q74zq-3252448536@pers.craigslist.org” <q74zq-3252448536@pers.craigslist.org>, “qbnmq-3268989654@pers.craigslist.org” <qbnmq-3268989654@pers.craigslist.org>, “qd3s2-3236365959@pers.craigslist.org” <qd3s2-3236365959@pers.craigslist.org>, “qhczg-3207863319@pers.craigslist.org” <qhczg-3207863319@pers.craigslist.org>, “qq22w-3232024680@pers.craigslist.org” <qq22w-3232024680@pers.craigslist.org>, “qrwxt-3268506258@pers.craigslist.org” <qrwxt-3268506258@pers.craigslist.org>, “qzsv8-3236584232@pers.craigslist.org” <qzsv8-3236584232@pers.craigslist.org>, “qzz2p-3255572511@sale.craigslist.org” <qzz2p-3255572511@sale.craigslist.org>, “r5bmt-3207962113@pers.craigslist.org” <r5bmt-3207962113@pers.craigslist.org>, “rbender@avrmc.org” <rbender@avrmc.org>, “rgxzz-3253056010@sale.craigslist.org” <rgxzz-3253056010@sale.craigslist.org>, “rockiesbatgirl9@yahoo.com” <rockiesbatgirl9@yahoo.com>, “rrtbh-3236355552@pers.craigslist.org” <rrtbh-3236355552@pers.craigslist.org>, “s6jgc-3228760429@sale.craigslist.org” <s6jgc-3228760429@sale.craigslist.org>

HEADER:

Return-Path: <hunter.mashell@yahoo.com>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts) LnBocCABMAEBAQEDdGV4dC9wbGFpbgMDMAIDdGV4dC9odG1sAwMx
X-YMailISG: 8m6IHqkWLDs.3oU5LH5YbJUF05C_830qagvefFyFN1SsSq1M 21Lmjm01GmhuYWO2i8o3CVbHF1FZ4nzHBAF_Sorh_8k19P5PiinTzTwI8Jwa .38uYiFqKUWxTYoBhGB.M9NWh.yMtR1NMMScWc8hTHWhe9.FO8m.P1ltd22q 8kq.Sd7k1uy_gEDG3CQspWgSS5cBJGQwWtcsC0D702Cr9lJLVhrza34rKkly Wa5DT.Bw_yxavqdnrFQ70SUlNNyoym4Xh1AkhOT5vU4MwZ0BnPqcgnqxv3lM smlGhiyvrKzNBbZf0QykXpSO22upZAF7tHRtSp5ZYQZmB89OA3vrkWgtq5MQ _2CpKuqYEP2ouU5Gc4eSYgt0Y_NroAK0pxF1DZBx0aLGd5tbeX5fZwzijASG 2sopsxgVbfVA22mCgaV9dB0FhslwY61RrXA_AemIwiOzzjVJ5mPkCFxNlEpk kYYs_0ln3VSOOnCcishHsLG1WjfEuL1vmQFfGa54nAnX2QbhAfdywSPsB9sB aowK977zFX7yeFPVXgJxx2USA2FeUTCFbTtHdEkBJnYzPWVfg_eop_oHVDRT nPV6CXB_co8C7pQ8pT3DkPJLLvL6wqcXUkv5xbyaw8BJQpxwfsxmNAQ38Jwp OwE9Xe1KKHxZbdXoBVLgNxUAYlxjSe0hOJ0cH4DLBZBJ_W1EUoHRXw9siwhG 9j2.V7vXjB9PAhfz8ub2g3EnVowFBUDpSj4BMiRDeVdYxSVz6xDkahXnck3g u028OTvCrNHjs4Me6Ld0UW3loobNb5JjAN7AoRGzAFz752SgsMyx8b3NmQf6 IobQi11XuOVJRRkGg27fMz8HMwl8oEXenL9dcLXdNYhR.FZX32ZNzLWOfruA VPH_KhVJVJPEW6MiF2dhDSh5dxKMBMOegu6YrQZFZa0ZT4jihX4kse.Ulzha uQQXY2i.pBpLSA4Z1crDSoAahbgeicN5qFMeJNM8AJ9ChKRXRtYxWG8EIjqB xLilg.LOE1SllnWNRg1aM03sWyGaT85_ng_NuofHXhWxIrJVhisgrE.Ff6Jq 1xMCBmdSfhZhh6zArdJHdjy0l34o9nrg9Co5IIhPG.hCShKQ7uEhjvbsefi6 WhYPNuGYQv3BbuYSpbdPNgqo3jlsSv7y5GLZ9TWi8ptPF4u5wuOeYroED2DF 7kqSLVEogRImA_9RwBq9MvfYIMQvAQ–
X-Originating-IP: [98.139.212.191]
Authentication-Results: mta1061.mail.gq1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm23-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.191) by mta1061.mail.gq1.yahoo.com with SMTP; Sun, 18 Nov 2012 14:03:01 -0800
Received: from [98.139.215.142] by nm23.bullet.mail.bf1.yahoo.com with NNFMP; 18 Nov 2012 22:03:00 -0000
Received: from [98.139.212.235] by tm13.bullet.mail.bf1.yahoo.com with NNFMP; 18 Nov 2012 22:03:00 -0000
Received: from [127.0.0.1] by omp1044.mail.bf1.yahoo.com with NNFMP; 18 Nov 2012 22:03:00 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 399988.28509.bm@omp1044.mail.bf1.yahoo.com
Received: (qmail 84775 invoked by uid 60001); 18 Nov 2012 22:03:00 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1353276180; bh=ndVyovJHFOuRXWx3yCkZvqgZsA9GZf4U0QYoOVZJsZU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:To:MIME-Version:Content-Type; b=a8rRCMbRh7EldKyUf6V6bZ0p1bYqxZ7NFvFKCbVxfln9wfI731eVCcVx6Sb78yXuPa3CvQt7ro9FxPQ3SajSWFIRhCVcsjUhVS1mAA+jTprV9Zu5LxRAu/mHhXemIH/kPjCuVL9g6CnRrRx0f1YqLtHblobigrotb0/cdh7O0D0=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:To:MIME-Version:Content-Type; b=nUlshYW6xFdoUC+oHAhQoWIB+PmtBA4znAEgOADxUUi4YYGFmjC/iTYJV4pMyoqXM24WajRNaj7fAolTR9MFtKZTJh6lv8Md8eHyPzBWGftWMYsieKJ+tvTT899nPXYReBHZ+xklL9yP4lLO55WYiI7t5e39OTcrteQm1/mIKjE=;
X-YMail-OSG: 24fUDJwVM1mu4oNOl0zidjOV9vVTiz1yuEspcMFsCgGiFH6 oh4x5mY3HO_aT8sMtACHSoQuxb9lLkxSZU1xRtd7E.QHYWCkSJ3Z5fnjPOnI .0aPfSZ79YTavaHJWitpW5.qYVeoOa0Bp1ydr_xQ1RJ6_UCAENbgPRUBk_kq lbF696i1UJYED0mMhpYMr4qj.EEw11aAUuHCS4h1lHG6W3yBMP0qCATdwTBh aC_jmMTX9LPpH0m6NCccBQTq0Ns9gffOwlc8C.r868pf4tcCjyTL26Wbkix3 6viQYLN_oMChZJbeDOANcQX46HW4fYQL.cjcKbdsu8wQuasVhv2W7_pLLCIm cizxM507M.6dFd01SowYcIy5XrFuTlqxZktgMSxNg18EAgBuwi.vWj3wObWu 6CYNetLVSl0NQUK7N8YU78LNo_.0lsqPH7M8a9LKweCNWYefDiGqKtUHsOb9 o6Gb7CZco_c4lyhz3oSD1y8rge8lo3A1iItH022en5Y.jiBUIzzKXJ8c.86L YH8HS
Received: from [88.240.46.22] by web160305.mail.bf1.yahoo.com via HTTP; Sun, 18 Nov 2012 14:03:00 PST
X-Mailer: YahooMailWebService/0.8.123.460
Message-ID: <1353276180.78726.YahooMailNeo@web160305.mail.bf1.yahoo.com>
Date: Sun, 18 Nov 2012 14:03:00 -0800 (PST)
From: Hunter Mashell <hunter.mashell@yahoo.com>
Reply-To: Hunter Mashell <hunter.mashell@yahoo.com>
To: x8s8k-3232016651@pers.craigslist.org, pers-rajgk-2707076820@craigslist.org, porkyexposed@yahoo.com, devildog4life.hr@gmail.com, fqss9-3208471845@sale.craigslist.org, jc9vx-3236113278@pers.craigslist.org, 3dfb7-3212331409@sale.craigslist.org, pxthp-3223707014@sale.craigslist.org, 4wdzt-3167460410@sale.craigslist.org
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”-360795340-1627103512-1353276180=:78726″
Content-Length: 551

SECOND EMAIL – HEADER:

Return-Path: <hunter.mashell@yahoo.com>
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts) dHRoZXdicm93bi8gATABAQEBA3RleHQvcGxhaW4DAzACA3RleHQvaHRtbAMD MQ–
X-YMailISG: DaSKeHMWLDtpjAojuuC005648iMl_O1cmJgTfAmDWTBgjTyj W0K5h6q3bjKe.RoFe3pqNEaqEUieV1BOk1sAYhn1oAfwzXD8Aj1IVBreqZdZ kbeNaYICml27j0mrk9rkFcXiD2fmoCK4a16imA.sBEly5.T0mqc7xSQrTR0R yqiCyGpnUpzo2eGTFTI8wECjOLtR20l.Va3npL0thkK52lJGhAfG.fxIQmKj drHq7cL_qaBu48frGKc5zbTLNlQyiHP8rtZjw2Ov8Ckx4gGvYjrfSRFklL2o mwyJcgV5xmsaJ33Pxo4cy2Q7F0s00H7zM6LEHH.FmMvZOhKceJz29cb2KlXw kQWh4hUUtAOIzNPoY6lpSSgvMxoSKkPYMeBXIda9P75JJ2KjvYbSpcPxybmX _dNfv7fsrx9O84n4aNYg.pE42l4mewdRio_3u8RbQEBrk57bF41cyIUE9EwM eenpQxypMWRjm8mvX2DG9iXhlB7yCojwdHbGshgbWs2QEklIUu9faBOnWWj2 FYy0SNBp2e950SLrYGKLcr35j3pPt.1i6Bm_2jFhoS8G6sv3UR1_JuFtAl8f Zi4y9GFnn6kMiPSTWpr6CNxjmg0W8C1OyEqQ3kqZ5.EPAxtXcjZMTmBWXkZ9 gCLvEWba9xj7DEX89meVWSvlnNDr27xBSv0ZJj4mlSxLbkIRoqcomaKdG88L LNFVwGpvu.Zd.vJ3Z0FS1RPMc8LuO.k1pBecOEtwTKV2G2nwzxpx8inpum7r EerfYvkUHB8E0nWTYKU9o5SGoVjA3ESNP6Zu9fcaoSp5X9Kp1KAMAGRHodVw gYbXMovbsH_lUgHDSJNJ44jR0J50RqkyeJ.pMCKgl2KqMpUlBfqzcxrolnF2 fhmtemJo5IdvTqX4m0xKaIYQs6_RT2KTXgM5pvts5z58yVpC5RQajU22L3tB A6YwXQ7zVSS35li0N5e7XjEsGR0ILR3BEP1QV0.YbE1.5Hq9CZ7zjxMyQ0Me JlX.xHsthSNd1TpnbYAT2WspG89jf.4fWVN83fm8Ijh2IniCV0Ay0FJxAbc. 7Uz0xxjlPLrO_CI70o0YTZ80rWjEs3toLGIsrnbtoFbabwnd09Jyjr0YWJLS NMW65qWLLdshRY1n30MUhwul5W0qCNt8rvrbkBBR2GmsZa4ubJy61g.adZTQ yp.SljIk75abbfYU64Vy2eDgCR2ZBuBWQ4aU50JfoH_UDtdfLUpN8kfs9ZKg mA7rmw–
X-Originating-IP: [98.139.212.160]
Authentication-Results: mta1399.mail.gq1.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO nm1.bullet.mail.bf1.yahoo.com) (98.139.212.160) by mta1399.mail.gq1.yahoo.com with SMTP; Sat, 17 Nov 2012 17:30:24 +0000
Received: from [98.139.212.152] by nm1.bullet.mail.bf1.yahoo.com with NNFMP; 17 Nov 2012 17:30:22 -0000
Received: from [98.139.215.254] by tm9.bullet.mail.bf1.yahoo.com with NNFMP; 17 Nov 2012 17:30:22 -0000
Received: from [127.0.0.1] by omp1067.mail.bf1.yahoo.com with NNFMP; 17 Nov 2012 17:30:22 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 948524.69397.bm@omp1067.mail.bf1.yahoo.com
Received: (qmail 15374 invoked by uid 60001); 17 Nov 2012 17:30:22 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1353173422; bh=73XBI+Vxyzj3LMifXM0eCpx4TW4CwH6qnUe6WBqbSJc=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:To:MIME-Version:Content-Type; b=LM8j1z0V+Y08iN2zxbsIHeCodaPWG/tMhLUpjQkevJdaeq5L4P3D+8g18nSPlbOtHYpM/AZRV+EYfwg5x6FLu16LQ65oHcEZttEg2avXsrM/Wf95mstrccxwC3koscV6H+KK7Lf0khdLLaGykhsVQfglkvFzrdER4E0LWy1ZY+Y=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:To:MIME-Version:Content-Type; b=YlvI8Yi/hqeSDlvB1gah8NEUIIrslxhIwAbPt3r1Tj5BXd16/ujgmtYvUM1/emnV4iLwEpAJ7zdKQd/S0cmThVVlCo5nvHn3dkV+/vs4Qm4DTD4wyFtBxLURe0sRVVW1ZqzOFKUpfPQRhfT4luuzDazZjXbbQpNdfZAzsiPmXyg=;
X-YMail-OSG: J6yHAxgVM1nZ5gr0kmpokRnOqMrRsATyexzx.xCuBJ2fhKQ 3PdReUQCxt4aiCtcmkCVi1mLsG2QCoQ1TkZgCJgytTyExBTASAAgNWLN5Lil RnvPLg5z7BTRxplxzYDC4GHqjhM_f0hJRTTpTiJih_Qyo.zav1BgFhbaqv8v GrikLYpfuJyGGzaWzGyArpbL8qDvZXiXHnJQrGpjiYm5QU32eHePNrKbIg.2 AVzDAhlofpwbNux2jbvrbYgbTIrW3UaRXK47.ZBj.eWYSYa9D0AYCZEe5VFf Lwh7.7XDHQGNiw5vbXmW9WeqBsT_cqg.wEjmJ.EqW89DffUDnK20Hl3jslnY Gf7Nc8ZV2vrhGhS79C8jEIdBjUp7XpO5TnFFH2w.0Bk_1JYEvQxYAga.ayxY 7978Rcrgcy3zwZ1EuGiqa3vmWp7xbTXdjUU52kJEc77o0LX5YoNoLjQGxxoM 1B9iQ1jx5sMkonWuMi.SCPK8MchlawzhcZlJic6QtNOjqWqWonlHC2JPA.CH afeabN7w83gNuTNaL
Received: from [181.14.174.37] by web160301.mail.bf1.yahoo.com via HTTP; Sat, 17 Nov 2012 09:30:22 PST
X-Mailer: YahooMailWebService/0.8.123.460
Message-ID: <1353173422.14639.androidMobile@web160301.mail.bf1.yahoo.com>
Date: Sat, 17 Nov 2012 09:30:22 -0800 (PST)
From: Hunter Mashell <hunter.mashell@yahoo.com>
To: “nbnxs-3210175843@pers.craigslist.org” <nbnxs-3210175843@pers.craigslist.org>, “ndghq-3255393928@pers.craigslist.org” <ndghq-3255393928@pers.craigslist.org>, “ngjsv-3283872977@pers.craigslist.org” <ngjsv-3283872977@pers.craigslist.org>, “NicoleClarik3@hotmail.com” <NicoleClarik3@hotmail.com>, “nkzjz-3209235157@pers.craigslist.org” <nkzjz-3209235157@pers.craigslist.org>, “p3ftm-3252808088@sale.craigslist.org” <p3ftm-3252808088@sale.craigslist.org>, “p6kbq-3215584511@sale.craigslist.org” <p6kbq-3215584511@sale.craigslist.org>, “p8fr2-3210992600@pers.craigslist.org” <p8fr2-3210992600@pers.craigslist.org>, “pers-38fq3-2698084615@craigslist.org” <pers-38fq3-2698084615@craigslist.org>, “pers-e9dqs-2704366508@craigslist.org” <pers-e9dqs-2704366508@craigslist.org>, “pers-paans-2699763453@craigslist.org” <pers-paans-2699763453@craigslist.org>, “pers-rajgk-2707076820@craigslist.org” <pers-rajgk-2707076820@craigslist.org>, “pers-rzhzy-2705029535@craigslist.org” <pers-rzhzy-2705029535@craigslist.org>, “pmfnc-3209866186@pers.craigslist.org” <pmfnc-3209866186@pers.craigslist.org>, “pmvkk-3228774589@pers.craigslist.org” <pmvkk-3228774589@pers.craigslist.org>, “porkyexposed@yahoo.com” <porkyexposed@yahoo.com>, “pwgqc-3255597543@pers.craigslist.org” <pwgqc-3255597543@pers.craigslist.org>, “pxthp-3223707014@sale.craigslist.org” <pxthp-3223707014@sale.craigslist.org>, “q74zq-3252448536@pers.craigslist.org” <q74zq-3252448536@pers.craigslist.org>, “qbnmq-3268989654@pers.craigslist.org” <qbnmq-3268989654@pers.craigslist.org>, “qd3s2-3236365959@pers.craigslist.org” <qd3s2-3236365959@pers.craigslist.org>, “qhczg-3207863319@pers.craigslist.org” <qhczg-3207863319@pers.craigslist.org>, “qq22w-3232024680@pers.craigslist.org” <qq22w-3232024680@pers.craigslist.org>, “qrwxt-3268506258@pers.craigslist.org” <qrwxt-3268506258@pers.craigslist.org>, “qzsv8-3236584232@pers.craigslist.org” <qzsv8-3236584232@pers.craigslist.org>, “qzz2p-3255572511@sale.craigslist.org” <qzz2p-3255572511@sale.craigslist.org>, “r5bmt-3207962113@pers.craigslist.org” <r5bmt-3207962113@pers.craigslist.org>, “rbender@avrmc.org” <rbender@avrmc.org>, “rgxzz-3253056010@sale.craigslist.org” <rgxzz-3253056010@sale.craigslist.org>, “rockiesbatgirl9@yahoo.com” <rockiesbatgirl9@yahoo.com>, “rrtbh-3236355552@pers.craigslist.org” <rrtbh-3236355552@pers.craigslist.org>, “s6jgc-3228760429@sale.craigslist.org” <s6jgc-3228760429@sale.craigslist.org>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”1332810471-999729533-1353173422=:14639″
Content-Length: 572

 

Hunter Mashell  hunter.mashell@yahoo.com <hunter.mashell@yahoo.com>

41.83.22.59 <> Associated IP <> 41.82.77.176

Example Messages Sent From 98.139.212.191
From: LOAN SERVICE <web.office23429924@att.net>
Subjectnone/blank
From: “Mr. Robin Paker” <web.offfice.19.127@att.net>
Subjectnone/blank
From: L Wells <jbwells3@yahoo.com>
Subjectnone/blank
From: MISS JENNY <missjennykipkalya@postafiok.hu>
Subject: Hello Dearest One,
From: Esther Chizizy <000333yyyzz@att.net>
Subject: hi
From: sosdf fghj <goone_55@yahoo.ca>
Subject: Hi
From: Mrs Rose Lambert <webxxvvcc@att.net>
Subject: My Dear Friend
From: Mrs Elizabeth Kamara <elizabethkamara90@hotmail.fr
Subject: Dear Beloved One
From:
Subject: CONGRATULATION: YOUR OVERDUE FUND HAS BE RELEASED
From: “Mrs. Evelyn McGregor” <officialnoticecaza1@gmail.
Subject: GOOD NEWS YOUR EMAIL HAS WON USD$1,000,000.00 !!!
From: “MR. SUNNY LUCAS” <sunluccas111222@rediffmail.com>
Subject: SOUTH AFRICAN NETWORK FOR WOMEN
From: SJPUB <kmoore1099@att.net>
Subject: PUBLISH RESEARCH STUDIES ARTIC
From: “Robert”<fbiusaorg2011@live.com>
Subject: Read attached message and respond
From: “Maria .B Raul”<incaseinhkilo@btconnect.com>
Subject: Re: Award Final Notification
From: “Mr Anthony D Loehnis”<www.offic223@hotmail.com>
Subject: Kindly check the attached message for full details
From: 張小姐
Subject: =?utf-8?B?6Lez5qiT5YO5LeWQjeeJjC3ljIUt6Yy2LS7p=?
From: Wilfred Wilson <wwilson_four@yahoo.co.th>
Subject: My mail.
From: “ROBERT S. MUELLER”<fbiinvestigatiion@live.com>
Subject: ANTI-TERRORIST AND MONEY LAUNDRY CRIMES DIVISION W
From: “nutzkicker@yahoo.com” <nutzkicker@yahoo.com>
Subject: FW: Tired of green tea? Try green COFFEE!
From: “sonofdxb@yahoo.com” <sonofdxb@yahoo.com>
Subject: FW: Forget those usual weightloss scams!
From: “From Mr. David Morris” <john.king350@yahoo.co.id>
Subject: From Mr. David Morris
From: ETISALAT COMMUNICATION <ukpess@yahoo.com>
Subject: Etisalat Award Promotion
From: Millennium Global loan Ltd <mgl1@live.co.za>
Subject: Loan at 2% reply with Name,Amount,Duration and Con
From: “Mai Leida” <shoshanasherlyn@kl.com>
Subject: Generic & Brand Cialis for $1.53/pill from TRUSTED
From: “Kiera Susanne” <hilmasachiko@wipro.com>
Subject: Buy Cheap Generic Cialis or Brand name Cialis, CIA
From: “Rolande” <georgettewilhelmina@yowzahost.com>
Subject: Buy HCG Drops Online for only $59/bottle ltqgyab
From: “Linnie” <nereidamayme@ps.ge.com>
Subject: SPECIAL OFFER : CIALIS on SALE at $1.53 !!! r6ckix
From: “Carmel Mui” <vivanelda@fusionstorm.com>
Subject: SPECIAL OFFER : CIALIS on SALE at $1.53 !!! fzesti
 
Leave a comment

Posted by on 11/25/2012 in Other

 

Tags: , , , , ,

 
%d bloggers like this: