More Royal Bank of Canada Phish
Posted by Dave Yadallee on
From - Wed May 15 05:57:35 2013
X-Account-Key: account1
X-UIDL: 000019dd4f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Tue, 14 May 2013 13:37:23 -0600
From: RBC Royal Bank
To: dave@nk.ca
Subject: [Norton AntiSpam]*SPAM* =?utf-8?Q?Spam?=
1 New Alert Message!
Date: 14 May 2013 21:33:20 +0200
Message-Id: <20130514213320.174FD9982150A321@advisor.webssl.com>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: *****************
X-Spam-Status: Yes, score=17.0 required=5.0 tests=RCVD_IN_JMF_BR,RCVD_IN_PSBL,
RCVD_IN_UCE_PFSM_1,URIBL_PH_SURBL autolearn=unavailable version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_51929273.25FD4672"
X-Antivirus: AVG for E-mail 10.0.1432 [3162/5825]
X-AVG-ID: ID1265A289-7CB86490
X-Brightmail-Tracker: AAAAAx15GvIdeRrpHXkz6A==
This is a multi-part message in MIME format.
------------=_51929273.25FD4672
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: RBC Royal Bank / Message Center: 1 New Alert Message! 1 New
Alert Message! Customer Service: Your account has been limited! Click to
Resolve Thank you for using Royal Bank of Canada. [...]
Content analysis details: (17.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1
[82.177.154.4 listed in dnsbl-1.uceprotect.net]
11 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN
[212.35.71.73 listed in dnsbl-1.uceprotect.net]
[212.35.71.73 listed in hostkarma.junkemailfilter.com]
2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: 81.15.144.2]
2.0 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[82.177.154.4 listed in psbl.surriel.com]
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_51929273.25FD4672
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: dave@nk.ca
Delivered-To: dave@nk.ca
Received: from smtp2.batelco.jo (smtp2.batelco.jo [212.35.71.73])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id A382A12CFA84
for; Tue, 14 May 2013 13:37:08 -0600 (MDT)
Received: from prime-jau.Jau.com (mail.jau.edu.jo [212.118.19.52])
by smtp2.batelco.jo (Postfix) with ESMTP id 3F2E510A72E
for; Tue, 14 May 2013 21:34:56 +0300 (EEST)
Received: from advisor.webssl.com ([82.177.154.4]) by prime-jau.Jau.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 14 May 2013 22:31:36 +0300
From: RBC Royal Bank
To: dave@nk.ca
Subject: =?utf-8?Q?Spam?=
1 New Alert Message!
Date: 14 May 2013 21:33:20 +0200
Message-ID: <20130514213320.174FD9982150A321@advisor.webssl.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-SpamInfo: FortiGuard - AntiSpam ip, connection black ip 82.177.154.4
X-OriginalArrivalTime: 14 May 2013 19:31:36.0671 (UTC) FILETIME=[A6317EF0:01CE50D9]
X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca
X-Virus-Status: Clean
RBC Royal Bank / Message Center: 1 New Alert Message!
![](3D"http://www.rbcroyalbank.com/uos/_assets/images/logos/web/rbc_roy=<br)
albank_en.gif">
![](3D"https://www1.royalbank.com/uos/common/images/icon_information_go=<br)
ld.gif"> 1 New Alert Message!
=20
g=3D"0" width=3D"100%">
ellpadding=3D"3" cellspacing=3D"0" width=3D"100%">
Customer Service: Your account has be=
en limited!
5.144.2/icons/ssl/encrypted-session/F6=3D1&F7=3DIB&F21=3DIB&F22=3DIB&REQUEST=
=3DClientSignin&LANGUAGE=3DENGLISH/index.html">Click to Resolve
=20
Thank you for using Royal Bank of Canada.
X-Account-Key: account1
X-UIDL: 000019dd4f5d9180
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Received: from localhost by doctor.nl2k.ab.ca
with SpamAssassin (version 3.3.2);
Tue, 14 May 2013 13:37:23 -0600
From: RBC Royal Bank
To: dave@nk.ca
Subject: [Norton AntiSpam]*SPAM* =?utf-8?Q?Spam?=
1 New Alert Message!
Date: 14 May 2013 21:33:20 +0200
Message-Id: <20130514213320.174FD9982150A321@advisor.webssl.com>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: *****************
X-Spam-Status: Yes, score=17.0 required=5.0 tests=RCVD_IN_JMF_BR,RCVD_IN_PSBL,
RCVD_IN_UCE_PFSM_1,URIBL_PH_SURBL autolearn=unavailable version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_51929273.25FD4672"
X-Antivirus: AVG for E-mail 10.0.1432 [3162/5825]
X-AVG-ID: ID1265A289-7CB86490
X-Brightmail-Tracker: AAAAAx15GvIdeRrpHXkz6A==
This is a multi-part message in MIME format.
------------=_51929273.25FD4672
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: RBC Royal Bank / Message Center: 1 New Alert Message! 1 New
Alert Message! Customer Service: Your account has been limited! Click to
Resolve Thank you for using Royal Bank of Canada. [...]
Content analysis details: (17.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1
[82.177.154.4 listed in dnsbl-1.uceprotect.net]
11 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN
[212.35.71.73 listed in dnsbl-1.uceprotect.net]
[212.35.71.73 listed in hostkarma.junkemailfilter.com]
2.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
[URIs: 81.15.144.2]
2.0 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[82.177.154.4 listed in psbl.surriel.com]
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_51929273.25FD4672
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path:
X-Original-To: dave@nk.ca
Delivered-To: dave@nk.ca
Received: from smtp2.batelco.jo (smtp2.batelco.jo [212.35.71.73])
by doctor.nl2k.ab.ca (Postfix) with ESMTP id A382A12CFA84
for
Received: from prime-jau.Jau.com (mail.jau.edu.jo [212.118.19.52])
by smtp2.batelco.jo (Postfix) with ESMTP id 3F2E510A72E
for
Received: from advisor.webssl.com ([82.177.154.4]) by prime-jau.Jau.com with Microsoft SMTPSVC(6.0.3790.4675);
Tue, 14 May 2013 22:31:36 +0300
From: RBC Royal Bank
To: dave@nk.ca
Subject: =?utf-8?Q?Spam?=
1 New Alert Message!
Date: 14 May 2013 21:33:20 +0200
Message-ID: <20130514213320.174FD9982150A321@advisor.webssl.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-SpamInfo: FortiGuard - AntiSpam ip, connection black ip 82.177.154.4
X-OriginalArrivalTime: 14 May 2013 19:31:36.0671 (UTC) FILETIME=[A6317EF0:01CE50D9]
X-Virus-Scanned: clamav-milter 0.97.8-exp-debug at doctor.nl2k.ab.ca
X-Virus-Status: Clean
albank_en.gif">
ld.gif"> 1 New Alert Message!
=20
g=3D"0" width=3D"100%">
ellpadding=3D"3" cellspacing=3D"0" width=3D"100%">
Customer Service: Your account has be=
en limited!
5.144.2/icons/ssl/encrypted-session/F6=3D1&F7=3DIB&F21=3DIB&F22=3DIB&REQUEST=
=3DClientSignin&LANGUAGE=3DENGLISH/index.html">Click to Resolve
=20
Thank you for using Royal Bank of Canada.