Wintegrated: Interac Email Phishing Attack

I recently received my first ever Interac Email Phishing attempt. Once marked as spam, it disappears quickly and it becomes harder to document, so I will document it here.

I woke up this morning with two emails in my mailbox. Here’s what the first one looked like. First part:

..second part:

20160225-Screenshot003

..and third:

20160225-Screenshot004

As you can see, I don’t have images enabled in my mailbox.

I considered the two emails suspicious even before opening them, as it seems that the same person, whom I had never communicated with, had decided to purchase two things I was selling and had seemingly sent me the money without even a heads-up first.

If anybody will ever investigate this, what the emails look like is less important than the source code of the message.

The text of the email is as follows, with the recipient real email address obscured with a few underscores for privacy reasons.

Delivered-To: a____933c@ezv__p.co
Received: by 10.55.93.4 with SMTP id r4csp2938886qkb;
        Thu, 25 Feb 2016 05:28:33 -0800 (PST)
X-Received: by 10.66.255.39 with SMTP id an7mr62820154pad.2.1456406913054;
        Thu, 25 Feb 2016 05:28:33 -0800 (PST)
Return-Path: <bounce-anon-a____933c=ezv__p.co@craigslist.org>
Received: from mxo2a.int.craigslist.org (mxo2a.craigslist.org. [208.82.237.97])
        by mx.google.com with ESMTPS id o76si12572388pfj.216.2016.02.25.05.28.32
        for <a____933c@ezv__p.co>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Thu, 25 Feb 2016 05:28:33 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-anon-a____933c=ezv__p.co@craigslist.org designates 208.82.237.97 as permitted sender) client-ip=208.82.237.97;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounce-anon-a____933c=ezv__p.co@craigslist.org designates 208.82.237.97 as permitted sender) smtp.mailfrom=bounce-anon-a____933c=ezv__p.co@craigslist.org;
       dmarc=pass (p=NONE dis=NONE) header.from=reply.craigslist.org
From: "Christopher Murray" <c482ddaaf42e30deb124492c40351d08@reply.craigslist.org>
To: vnpx4-5426785991@sale.craigslist.org
Subject: =?UTF-8?Q?INTERAC_e=2DTransfer=3A_CRAIGSLIST_BUYER_sent_you_money=2E?=
    =?UTF-8?Q?=E2=80=8F=E2=80=8E?=
Date: Thu, 25 Feb 2016 06:31:15 -0500
X-CL-ID: 56114CFE-E8B3-4D49-B921-747654F489FA.1
Content-Type: multipart/alternative;
boundary="CraigslistMail-v1-216D5A51-638C-31A5-B72F-FB1B35F2ED8E"
MIME-Version: 1.0
Message-Id: <Z5Lz6ZA2NiLbdvnoIM89OTJNmKUAyrLl29ToHd1kXrCFCwAcIDfZ44tNccGHu1M3AX4uvzioybhQ2tU_Ka-DxZIw4_VSWIfhXtjapc4Uo4U@v2.cl.com>

--CraigslistMail-v1-216D5A51-638C-31A5-B72F-FB1B35F2ED8E
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

[image: INTERAC]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen> V=
iew
in Browser
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fetransfer.interac.ca%=
2FViewInBrowser.do%3Ftokens%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSpbagxTSMhW=
YtZl03sXWt9oajqv_Q1L_2I8mNd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnKQWTuqdchI=
JFjMoLVfh9et3be1es1CqtbTkGk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjvwY2XWje6b=
pyBlYujSaxHEYHQ2bwyaJG5TFRGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pdDptxGMXMz=
zGsUiiuOHyQCIG8YT4lTE8dS4wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM7kCGkL_e2=
t3fa7RasK0q7Z01gZazfT7WKhALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzOeyKNOtyvB=
HAP1-8r5Ild7QiMgAaY-THEEEWExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvfzHMT3VCv_=
HwyY9BfLKXsR1HCXh6a-f8jj7IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnmm0DjsFug5=
o3CNh5h9wTkVdC8lCXPGz9mYlyETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadExE0EkdoYS=
eYKUTASD5sBH1F_5eedpWrtk6v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHUIN5ilVGa2=
UHUlIf-QjWUOFuo45sA4Q1kYj2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxTfr70JJFfO=
sqMpiaK5hr3LCl2haM-ExHZPUcyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFpd6p3gelUZ=
pnrhJweSIElesl5UkEGOZ38fwOCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLRllSYS89oL=
6RXB5wA40FmsU5vYx5Ql_rSzzbZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH_lkKm--DN=
71Kx0un333cM2N4%26templateCode%3D1%26langCode%3Den>
| Fran=C3=A7ais
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fetransfer.interac.ca%=
2FViewInBrowser.do%3Ftokens%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSpbagxTSMhW=
YtZl03sXWt9oajqv_Q1L_2I8mNd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnKQWTuqdchI=
JFjMoLVfh9et3be1es1CqtbTkGk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjvwY2XWje6b=
pyBlYujSaxHEYHQ2bwyaJG5TFRGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pdDptxGMXMz=
zGsUiiuOHyQCIG8YT4lTE8dS4wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM7kCGkL_e2=
t3fa7RasK0q7Z01gZazfT7WKhALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzOeyKNOtyvB=
HAP1-8r5Ild7QiMgAaY-THEEEWExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvfzHMT3VCv_=
HwyY9BfLKXsR1HCXh6a-f8jj7IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnmm0DjsFug5=
o3CNh5h9wTkVdC8lCXPGz9mYlyETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadExE0EkdoYS=
eYKUTASD5sBH1F_5eedpWrtk6v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHUIN5ilVGa2=
UHUlIf-QjWUOFuo45sA4Q1kYj2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxTfr70JJFfO=
sqMpiaK5hr3LCl2haM-ExHZPUcyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFpd6p3gelUZ=
pnrhJweSIElesl5UkEGOZ38fwOCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLRllSYS89oL=
6RXB5wA40FmsU5vYx5Ql_rSzzbZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH_lkKm--DN=
71Kx0un333cM2N4%26templateCode%3D1%26langCode%3Dfr>
[image:
?]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen%2F=
interac-etransfer%2Fetransfer-faq>
Hi craigslist seller,

CRAIGSLIST BUYER sent you $500.00 (CAD).

Message:

Purchase using Craigslist online payment
------------------------------

Deposit your Money <http://ie1.ca/etransfer.interac.aspx?pID=3DVNBJDSR&r=3D=
3>
*Expires:* April 8, 2016

FAQs
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen%2F=
interac-etransfer%2Fetransfer-faq>

|

This is a secure Transaction

=C2=A9 2000 - 2015 Acxsys Corporation.
All rights reserved. Terms of Use
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fhelp.interac.ca%2Fca%=
2Foon%2Fen%2Fterms%2F>
=C2=AE Trade-Mark of Interac Inc. Used under licence
[image: Twitter]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Ftwitter.com%2Finterac>
[image:
Facebook]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fwww.facebook.com%2Fin=
terac>
[image:
Linkedin]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.linkedin.com%2Fcom=
panies%2F1328202%2FInterac%2BAssociation>
[image:
Youtube]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fyoutube.ca%2FInteracBr=
and>

Email or text messages carry the notice while the financial institutions
securely transfer the money using existing payment networks. For the
answers to common questions please visit our FAQs. If your financial
Institution does not yet offer *Interac* e-Transfer=C2=AE, you can still de=
posit
transfers to any bank account in Canada.

This email was sent to you by Acxsys Corporation, the owner of the *Interac*
e-Transfer=C2=AE service, on behalf of CRAIGSLIST BUYER at TD Canada Trust.

Interac Association / Acxsys Corporation
Royal Bank Plaza, North Tower, 200 Bay Street, Suite 2400
P.O. Box 45, Toronto, ON M5J 2J1
www.interac.ca
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen>

------------------------------------------------------------------------
Original craigslist post:
http://toronto.craigslist.ca/tor/mob/5426785991.html
About craigslist mail:
http://craigslist.org/about/help/email-relay
Please flag unwanted messages (spam, scam, other):
http://craigslist.org/mf/1cbb96e356114cfee8b34d49b921747654f489fa.1
------------------------------------------------------------------------

--CraigslistMail-v1-216D5A51-638C-31A5-B72F-FB1B35F2ED8E
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><table class=3D"" style=3D"margin:0px;padding:0px;width:10=
0%;height:100%;line-height:19px;font-family:Helvetica,Arial,sans-serif;font=
-size:14px;vertical-align:top;border-collapse:collapse;border-spacing:0px;b=
ackground-image:none;background-color:rgb(234,236,237);background-repeat:re=
peat"><tbody><tr style=3D"padding:0px;vertical-align:top"><td align=3D"cent=
er" class=3D"" valign=3D"top" style=3D"padding:0px;text-align:center;font-f=
amily:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collaps=
e"><center style=3D"width:100%;min-width:580px"><table class=3D"" style=3D"=
margin:0px auto;padding:0px;width:580px;text-align:inherit;vertical-align:t=
op;border-collapse:collapse;border-spacing:0px;background-image:none;backgr=
ound-color:rgb(255,255,255);background-repeat:repeat"><tbody><tr style=3D"p=
adding:0px;vertical-align:top"><td style=3D"padding:0px;font-family:Helveti=
ca,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><table cla=
ss=3D"" style=3D"padding:0px;width:100%;height:60px;margin-top:0px;margin-b=
ottom:10px;vertical-align:top;display:block;border-collapse:collapse;border=
-spacing:0px;background-image:none;background-color:rgb(34,34,34);backgroun=
d-repeat:repeat" bgcolor=3D"rgb(34,34,34)"><tbody><tr style=3D"padding:0px;=
vertical-align:top"><td class=3D"" style=3D"padding:10px 0px 0px;font-famil=
y:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><=
table class=3D"" style=3D"margin:0px auto;padding:0px;width:580px;vertical-=
align:top;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"=
padding:0px;vertical-align:top"><td class=3D"" style=3D"padding:0px 10px 10=
px;width:41.66%;font-family:Helvetica,Arial,sans-serif;vertical-align:top;b=
order-collapse:collapse;min-width:0px"><a style=3D"color:rgb(102,102,102);t=
ext-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A=
%2F%2Fwww.interac.ca%2Fen" target=3D"_blank"><img width=3D"100" height=3D"4=
0" class=3D"" style=3D"width: 100px; height: 40px; clear: both; margin-left=
: 0px; float: left; display: block; max-width: none; outline-style: none;" =
alt=3D"INTERAC" src=3D"http://etransfer-notification.interac.ca/images/nav-=
logo.png"></a>                         </td><td class=3D"" style=3D"padding=
:0px 10px 10px 0px;width:25%;text-align:right;color:rgb(238,238,238);font-f=
amily:Helvetica,Arial,sans-serif;vertical-align:middle;border-collapse:coll=
apse;min-width:0px"><a style=3D"color:rgb(238,238,238);text-decoration:none=
" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fetransfer.in=
terac.ca%2FViewInBrowser.do%3Ftokens%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSp=
bagxTSMhWYtZl03sXWt9oajqv_Q1L_2I8mNd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnK=
QWTuqdchIJFjMoLVfh9et3be1es1CqtbTkGk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjv=
wY2XWje6bpyBlYujSaxHEYHQ2bwyaJG5TFRGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pd=
DptxGMXMzzGsUiiuOHyQCIG8YT4lTE8dS4wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM=
7kCGkL_e2t3fa7RasK0q7Z01gZazfT7WKhALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzO=
eyKNOtyvBHAP1-8r5Ild7QiMgAaY-THEEEWExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvf=
zHMT3VCv_HwyY9BfLKXsR1HCXh6a-f8jj7IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnm=
m0DjsFug5o3CNh5h9wTkVdC8lCXPGz9mYlyETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadE=
xE0EkdoYSeYKUTASD5sBH1F_5eedpWrtk6v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHU=
IN5ilVGa2UHUlIf-QjWUOFuo45sA4Q1kYj2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxT=
fr70JJFfOsqMpiaK5hr3LCl2haM-ExHZPUcyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFp=
d6p3gelUZpnrhJweSIElesl5UkEGOZ38fwOCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLR=
llSYS89oL6RXB5wA40FmsU5vYx5Ql_rSzzbZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH=
_lkKm--DN71Kx0un333cM2N4%26templateCode%3D1%26langCode%3Den" target=3D"_bla=
nk">View in Browser</a>                         </td><td class=3D"" style=
=3D"padding:0px 10px 10px 0px;width:4.15%;text-align:center;font-family:Hel=
vetica,Arial,sans-serif;vertical-align:middle;border-collapse:collapse;min-=
width:0px"><span class=3D"" style=3D"color:rgb(238,238,238)">|</span>      =
                   </td><td class=3D"" style=3D"padding:0px 10px 10px 0px;w=
idth:16.66%;color:rgb(238,238,238);font-family:Helvetica,Arial,sans-serif;v=
ertical-align:middle;border-collapse:collapse;min-width:0px"><a style=3D"co=
lor:rgb(238,238,238);text-decoration:none" href=3D"http://ie1.ca/dereferrer=
?redirectUrl=3Dhttps%3A%2F%2Fetransfer.interac.ca%2FViewInBrowser.do%3Ftoke=
ns%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSpbagxTSMhWYtZl03sXWt9oajqv_Q1L_2I8m=
Nd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnKQWTuqdchIJFjMoLVfh9et3be1es1CqtbTk=
Gk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjvwY2XWje6bpyBlYujSaxHEYHQ2bwyaJG5TF=
RGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pdDptxGMXMzzGsUiiuOHyQCIG8YT4lTE8dS4=
wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM7kCGkL_e2t3fa7RasK0q7Z01gZazfT7WKh=
ALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzOeyKNOtyvBHAP1-8r5Ild7QiMgAaY-THEEE=
WExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvfzHMT3VCv_HwyY9BfLKXsR1HCXh6a-f8jj7=
IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnmm0DjsFug5o3CNh5h9wTkVdC8lCXPGz9mYl=
yETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadExE0EkdoYSeYKUTASD5sBH1F_5eedpWrtk6=
v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHUIN5ilVGa2UHUlIf-QjWUOFuo45sA4Q1kYj=
2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxTfr70JJFfOsqMpiaK5hr3LCl2haM-ExHZPU=
cyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFpd6p3gelUZpnrhJweSIElesl5UkEGOZ38fw=
OCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLRllSYS89oL6RXB5wA40FmsU5vYx5Ql_rSzz=
bZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH_lkKm--DN71Kx0un333cM2N4%26templat=
eCode%3D1%26langCode%3Dfr" target=3D"_blank">Fran=C3=A7ais</a>             =
            </td><td class=3D"" style=3D"padding:0px 0px 10px;width:8.33%;f=
ont-family:Helvetica,Arial,sans-serif;vertical-align:middle;border-collapse=
:collapse;min-width:0px"><a style=3D"color:rgb(102,102,102);text-decoration=
:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.inte=
rac.ca%2Fen%2Finterac-etransfer%2Fetransfer-faq" target=3D"_blank"><img wid=
th=3D"30" height=3D"30" class=3D"" style=3D"width: 30px; height: 30px; padd=
ing-left: 0px; clear: both; float: left; display: block; max-width: 100%; o=
utline-style: none;" alt=3D"?" src=3D"http://etransfer-notification.interac=
.ca/images/icons-png/question_mark.png"></a>                         </td><=
td class=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sa=
ns-serif;vertical-align:top;border-collapse:collapse"></td></tr></tbody></t=
able></td></tr></tbody></table><table class=3D"" style=3D"padding:0px;width=
:100%;vertical-align:top;display:block;border-collapse:collapse;border-spac=
ing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td class=3D""=
style=3D"padding:10px 0px 0px;font-family:Helvetica,Arial,sans-serif;verti=
cal-align:top;border-collapse:collapse"><table class=3D"" style=3D"margin:0=
px auto;padding:0px;width:580px;vertical-align:top;border-collapse:collapse=
;border-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><t=
d class=3D"" style=3D"padding:0px 20px 10px;font-family:Helvetica,Arial,san=
s-serif;vertical-align:top;border-collapse:collapse"><h1 style=3D"margin:0p=
x;padding:0px;line-height:1.3;font-size:20px">                            H=
i craigslist seller,</h1><p class=3D"" style=3D"margin:0px 0px 10px;padding=
:0px;line-height:21px;font-size:15px">                            CRAIGSLIS=
T BUYER sent you $500.00 (CAD).</p><br><h1 style=3D"margin:0px;padding:0px;=
line-height:1.3;font-size:20px">                            Message:       =
                  </h1><p class=3D"" style=3D"margin:0px 0px 10px;padding:0=
px;line-height:21px;font-size:15px">                            Purchase us=
ing Craigslist online payment                          </p></td><td class=
=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif=
;vertical-align:top;border-collapse:collapse"></td></tr></tbody></table></t=
d></tr></tbody></table><hr style=3D"height:1px;color:rgb(217,217,217);backg=
round-color:rgb(217,217,217)"><br><table class=3D"" style=3D"padding:0px;wi=
dth:100%;vertical-align:top;display:block;border-collapse:collapse;border-s=
pacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td align=
=3D"center" class=3D"" style=3D"padding:10px 0px 0px;text-align:center;font=
-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:colla=
pse"><center style=3D"width:100%;min-width:580px"><table class=3D"" style=
=3D"margin:0px auto;padding:0px;width:280px;text-align:left;vertical-align:=
top;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"paddin=
g:0px;vertical-align:top"><td width=3D"280" align=3D"center" class=3D"" sty=
le=3D"padding:0px 20px 10px;text-align:center;font-family:Helvetica,Arial,s=
ans-serif;vertical-align:top;border-collapse:collapse"><center style=3D"wid=
th:100%;min-width:280px"><table class=3D"" style=3D"padding:0px;width:100%;=
text-align:left;overflow:hidden;vertical-align:top;border-collapse:collapse=
;border-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><t=
d width=3D"380" align=3D"center" valign=3D"middle" style=3D"padding:8px 0px=
;border:1px solid rgb(240,181,28);width:auto;text-align:center;color:rgb(25=
5,255,255);font-family:Helvetica,Arial,sans-serif;vertical-align:top;displa=
y:block;border-collapse:collapse;background-image:none;background-color:rgb=
(240,181,28);background-repeat:repeat" bgcolor=3D"#f0b51c"><a style=3D"colo=
r:rgb(255,255,255);font-size:16px;font-weight:bold;text-decoration:none" hr=
ef=3D"http://ie1.ca/etransfer.interac.aspx?pID=3DVNBJDSR&r=3D3" target=
=3D"_blank">                                                Deposit your Mo=
ney                                             </a>                       =
                  </td></tr></tbody></table></center></td><td class=3D"" st=
yle=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif;vertica=
l-align:top;border-collapse:collapse"></td></tr></tbody></table></center></=
td></tr></tbody></table><table class=3D"" style=3D"padding:0px;width:100%;v=
ertical-align:top;display:block;border-collapse:collapse;border-spacing:0px=
"><tbody><tr style=3D"padding:0px;vertical-align:top"><td class=3D"" style=
=3D"padding:10px 0px 0px;font-family:Helvetica,Arial,sans-serif;vertical-al=
ign:top;border-collapse:collapse"><table class=3D"" style=3D"margin:0px aut=
o;padding:0px;width:580px;vertical-align:top;border-collapse:collapse;borde=
r-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td alig=
n=3D"center" class=3D"" style=3D"padding:0px 20px 10px;text-align:center;fo=
nt-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:col=
lapse"><strong>Expires:</strong> April 8, 2016                     </td><td=
class=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans=
-serif;vertical-align:top;border-collapse:collapse"></td></tr></tbody></tab=
le></td></tr></tbody></table><table class=3D"" style=3D"margin:10px 0px;pad=
ding:0px;width:100%;vertical-align:top;border-top-color:rgb(217,217,217);bo=
rder-bottom-color:rgb(217,217,217);border-top-width:1px;border-bottom-width=
:1px;border-bottom-style:solid;display:block;border-collapse:collapse;borde=
r-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td clas=
s=3D"" style=3D"padding:0px 0px 0px 150px;font-family:Helvetica,Arial,sans-=
serif;vertical-align:top;border-collapse:collapse"><table class=3D"" style=
=3D"margin:0px auto;padding:0px;width:80px;vertical-align:top;border-collap=
se:collapse;border-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-al=
ign:top"><td class=3D"" style=3D"padding:0px;text-align:right;font-family:H=
elvetica,Arial,sans-serif;vertical-align:middle;border-collapse:collapse"><=
p style=3D"margin:0px;padding:20px 0px"><a style=3D"color:rgb(102,102,102);=
text-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3=
A%2F%2Fwww.interac.ca%2Fen%2Finterac-etransfer%2Fetransfer-faq" target=3D"_=
blank">FAQs</a></p></td><td class=3D"" style=3D"padding:0px;width:0px;font-=
family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collap=
se"></td></tr></tbody></table></td><td class=3D"" style=3D"padding:0px;font=
-family:Helvetica,Arial,sans-serif;vertical-align:middle;border-collapse:co=
llapse"><table class=3D"" style=3D"margin:0px auto;padding:0px;width:15px;v=
ertical-align:top;border-collapse:collapse;border-spacing:0px"><tbody><tr s=
tyle=3D"padding:0px;vertical-align:top"><td style=3D"padding:0px;font-famil=
y:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><=
p class=3D"" style=3D"margin:0px;padding:20px">                            =
|</p></td><td class=3D"" style=3D"padding:0px;width:0px;font-family:Helveti=
ca,Arial,sans-serif;vertical-align:top;border-collapse:collapse"></td></tr>=
</tbody></table></td><td class=3D"" style=3D"padding:0px;font-family:Helvet=
ica,Arial,sans-serif;vertical-align:middle;border-collapse:collapse"><table=
class=3D"" style=3D"margin:0px auto;padding:0px;width:180px;vertical-align=
:top;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"paddi=
ng:0px;vertical-align:top"><td style=3D"padding:0px;font-family:Helvetica,A=
rial,sans-serif;vertical-align:top;border-collapse:collapse"><p style=3D"ma=
rgin:0px;padding:20px 0px;color:rgb(102,102,102)">                         =
   This is a secure Transaction                         </p></td><td class=
=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif=
;vertical-align:top;border-collapse:collapse"></td></tr></tbody></table></t=
d><td style=3D"padding:0px;font-family:Helvetica,Arial,sans-serif;vertical-=
align:top;border-collapse:collapse"><table class=3D"" style=3D"margin:0px a=
uto;padding:0px;width:30px;vertical-align:top;border-collapse:collapse;bord=
er-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td cla=
ss=3D"" style=3D"padding:0px;font-family:Helvetica,Arial,sans-serif;vertica=
l-align:middle;border-collapse:collapse"><p style=3D"margin:0px;padding:20p=
x 0px"><img width=3D"20" height=3D"20" style=3D"width: auto; clear: both; f=
loat: left; display: block; max-width: 100%; outline-style: none;" alt=3D""=
src=3D"http://etransfer-notification.interac.ca/images/icons-png/security.=
png"></p></td><td class=3D"" style=3D"padding:0px;width:0px;font-family:Hel=
vetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"></td><=
/tr></tbody></table></td></tr></tbody></table><table class=3D"" style=3D"pa=
dding:0px;width:100%;margin-top:10px;vertical-align:top;border-bottom-color=
:rgb(217,217,217);border-bottom-width:1px;border-bottom-style:solid;display=
:block;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"pad=
ding:0px;vertical-align:top"><td class=3D"" style=3D"padding:10px 20px 0px =
0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collap=
se:collapse"><table class=3D"" style=3D"margin:0px auto;padding:0px;width:2=
80px;vertical-align:top;border-collapse:collapse;border-spacing:0px"><tbody=
><tr style=3D"padding:0px;vertical-align:top"><td class=3D"" style=3D"paddi=
ng:0px 0px 10px 20px;font-family:Helvetica,Arial,sans-serif;vertical-align:=
top;border-collapse:collapse"><img width=3D"256" height=3D"50" style=3D"wid=
th: auto; clear: both; float: left; display: block; max-width: 100%; outlin=
e-style: none;" alt=3D"" src=3D"http://etransfer-notification.interac.ca/im=
ages/footer-logo-desktop.png"></td><td class=3D"" style=3D"padding:0px;widt=
h:0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border-coll=
apse:collapse"></td></tr></tbody></table></td><td class=3D"" style=3D"paddi=
ng:10px 0px 0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;b=
order-collapse:collapse"><table class=3D"" style=3D"margin:0px auto;padding=
:0px;width:280px;vertical-align:top;border-collapse:collapse;border-spacing=
:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td class=3D"" st=
yle=3D"padding:0px 20px 10px 0px;text-align:right;color:rgb(181,181,181);li=
ne-height:1.5;font-family:sans-serif;font-size:10px;vertical-align:top;bord=
er-collapse:collapse">=C2=A9 2000 - 2015 Acxsys Corporation.<br>           =
               All rights reserved. <a style=3D"color:rgb(181,181,181);text=
-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2=
F%2Fhelp.interac.ca%2Fca%2Foon%2Fen%2Fterms%2F" target=3D"_blank">         =
                                         Terms of Use                                                   </a>   =
                                            <br>=C2=AE Trade-Mark of Interac Inc. Used und=
er licence                         </td><td class=3D"" style=3D"padding:0px=
;width:0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border=
-collapse:collapse"></td></tr></tbody></table></td></tr></tbody></table><ta=
ble class=3D"" style=3D"padding:0px;width:100%;margin-top:20px;vertical-ali=
gn:top;display:block;border-collapse:collapse;border-spacing:0px"><tbody><t=
r style=3D"padding:0px;vertical-align:top"><td class=3D"" style=3D"padding:=
10px 0px 0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;bord=
er-collapse:collapse"><table class=3D"" style=3D"margin:0px auto;padding:0p=
x;width:580px;vertical-align:top;border-collapse:collapse;border-spacing:0p=
x"><tbody><tr style=3D"padding:0px;vertical-align:top"><td align=3D"center"=
class=3D"" style=3D"padding:0px 0px 10px;text-align:center;font-family:Hel=
vetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><cente=
r style=3D"width:100%;min-width:580px"><a style=3D"color:rgb(102,102,102);t=
ext-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A=
%2F%2Ftwitter.com%2Finterac" target=3D"_blank"><img width=3D"40" height=3D"=
40" class=3D"" style=3D"margin: 0px auto; padding: 0px 4px; width: 40px; he=
ight: 40px; clear: both; float: none; display: inline-block; max-width: 100=
%; outline-style: none;" alt=3D"Twitter" src=3D"http://etransfer-notificati=
on.interac.ca/images/social-media-icons/twitter.png">                      =
         </a>                             <a style=3D"color:rgb(102,102,102=
);text-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp=
s%3A%2F%2Fwww.facebook.com%2Finterac" target=3D"_blank"><img width=3D"40" h=
eight=3D"40" class=3D"" style=3D"margin: 0px auto; padding: 0px 4px; width:=
40px; height: 40px; clear: both; float: none; display: inline-block; max-w=
idth: 100%; outline-style: none;" alt=3D"Facebook" src=3D"http://etransfer-=
notification.interac.ca/images/social-media-icons/facebook.png">           =
                    </a>                             <a style=3D"color:rgb(=
102,102,102);text-decoration:none" href=3D"http://ie1.ca/dereferrer?redirec=
tUrl=3Dhttp%3A%2F%2Fwww.linkedin.com%2Fcompanies%2F1328202%2FInterac%2BAsso=
ciation" target=3D"_blank"><img width=3D"40" height=3D"40" class=3D"" style=
=3D"margin: 0px auto; padding: 0px 4px; width: 40px; height: 40px; clear: b=
oth; float: none; display: inline-block; max-width: 100%; outline-style: no=
ne;" alt=3D"Linkedin" src=3D"http://etransfer-notification.interac.ca/image=
s/social-media-icons/linkedin.png">                               </a>     =
                        <a style=3D"color:rgb(102,102,102);text-decoration:=
none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fyoutube.c=
a%2FInteracBrand" target=3D"_blank"><img width=3D"40" height=3D"40" class=
=3D"" style=3D"margin: 0px auto; padding: 0px 4px; width: 40px; height: 40p=
x; clear: both; float: none; display: inline-block; max-width: 100%; outlin=
e-style: none;" alt=3D"Youtube" src=3D"http://etransfer-notification.intera=
c.ca/images/social-media-icons/youtube.png">                               =
</a>                           </center></td><td class=3D"" style=3D"paddin=
g:0px;width:0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;b=
order-collapse:collapse"></td></tr></tbody></table></td></tr></tbody></tabl=
e><table class=3D"" style=3D"padding:0px;width:100%;vertical-align:top;disp=
lay:block;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"=
padding:0px;vertical-align:top"><td class=3D"" style=3D"padding:10px 0px 0p=
x;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse=
:collapse"><table class=3D"" style=3D"margin:0px auto;padding:0px;width:580=
px;vertical-align:top;border-collapse:collapse;border-spacing:0px"><tbody><=
tr style=3D"padding:0px;vertical-align:top"><td class=3D"" style=3D"padding=
:0px 20px 10px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;bo=
rder-collapse:collapse"><p style=3D"margin:0px 0px 10px;padding:0px"></p><p=
style=3D"margin:0px 0px 10px;padding:5px 0px;color:rgb(181,181,181);line-h=
eight:1.5;font-family:sans-serif;font-size:12px">                          =
Email or text messages carry the notice while the financial                =
          institutions securely transfer the money using existing payment =
                        networks. For the answers to common questions pleas=
e visit our                          FAQs. If your financial Institution do=
es not yet offer <i>Interac</i>                          e-Transfer<sup>=C2=
=AE</sup>, you can still deposit transfers to any bank account             =
             in Canada.                         </p><p style=3D"margin:0px =
0px 10px;padding:5px 0px;color:rgb(181,181,181);line-height:1.5;font-family=
:sans-serif;font-size:12px">                            This email was sent=
to you by Acxsys Corporation, the owner of the <i>Interac</i> e-Transfer<s=
up>=C2=AE</sup> service, on behalf of CRAIGSLIST BUYER at TD Canada Trust. =
                          </p><p style=3D"margin:0px 0px 10px;padding:0px">=
</p><p style=3D"margin:0px 0px 10px;padding:5px 0px 0px;color:rgb(181,181,1=
81);line-height:1.5;font-family:sans-serif;font-size:12px">                =
          Interac Association / Acxsys Corporation<br>                     =
     Royal Bank Plaza, North Tower, 200 Bay Street, Suite 2400<br>         =
                 P.O. Box 45, Toronto, ON M5J 2J1                          =
<br><a style=3D"color:rgb(102,102,102);text-decoration:none" href=3D"http:=
//ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen" target=
=3D"_blank">www.interac.ca</a>                           </p></td><td class=
=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif=
;vertical-align:top;border-collapse:collapse"></td></tr></tbody></table></t=
d></tr></tbody></table><br><br></td></tr></tbody></table></center></td></tr=
></tbody></table></div>
<P><br>
<hr>Original craigslist post:<br>
<a href=3D"http://toronto.craigslist.ca/tor/mob/5426785991.html">http://tor=
onto.craigslist.ca/tor/mob/5426785991.html</a><br>
About craigslist mail:<br>
<a href=3D"http://craigslist.org/about/help/email-relay">http://craigslist.=
org/about/help/email-relay</a><br>
Please flag unwanted messages (spam, scam, other):<br>
<a href=3D"http://craigslist.org/mf/1cbb96e356114cfee8b34d49b921747654f489f=
a.1">http://craigslist.org/mf/1cbb96e356114cfee8b34d49b921747654f489fa.1</a=
><hr></P>

--CraigslistMail-v1-216D5A51-638C-31A5-B72F-FB1B35F2ED8E--

I have tried to remove all toxic links but they may reappear, automatically introduced by my editor as I re-edit. If you see any above or below, please let me know ASAP so that I can remove it.

The second email is nearly identical and I provide it for comparison purposes.

Delivered-To: a____933c@__voip.__
Received: by 10.55.93.4 with SMTP id r4csp2938870qkb;
        Thu, 25 Feb 2016 05:28:31 -0800 (PST)
X-Received: by 10.140.171.7 with SMTP id r7mr8248848qhr.79.1456406911430;
        Thu, 25 Feb 2016 05:28:31 -0800 (PST)
Return-Path: <bounce-anon-a____933c=__voip.__@craigslist.org>
Received: from mxo2a.int.craigslist.org (mxo2a.craigslist.org. [208.82.237.97])
        by mx.google.com with ESMTPS id d13si8026027qhc.70.2016.02.25.05.28.31
        for <a____933c@__voip.__>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Thu, 25 Feb 2016 05:28:31 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-anon-a____933c=__voip.__@craigslist.org designates 208.82.237.97 as permitted sender) client-ip=208.82.237.97;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounce-anon-a____933c=__voip.__@craigslist.org designates 208.82.237.97 as permitted sender) smtp.mailfrom=bounce-anon-a____933c=__voip.__@craigslist.org;
       dmarc=pass (p=NONE dis=NONE) header.from=reply.craigslist.org
From: "Christopher Murray" <65e1bce6c1ae39338b1a87cf55cfebe6@reply.craigslist.org>
To: sn7xr-5426774753@sale.craigslist.org
Subject: =?UTF-8?Q?INTERAC_e=2DTransfer=3A_CRAIGSLIST_BUYER_sent_you_money=2E?=
    =?UTF-8?Q?=E2=80=8F=E2=80=8E?=
Date: Thu, 25 Feb 2016 06:31:15 -0500
X-CL-ID: 56114CFE-E8B3-4D49-B921-747654F489FA.1
Content-Type: multipart/alternative;
boundary="CraigslistMail-v1-C3A6ADCA-6A1D-3FBE-B4EB-47F90C260E29"
MIME-Version: 1.0
Message-Id: <4gdgYw3Cv_-995dI0W5bkV_8bTHR3IhSUUqS1ruRPScYXk7XjxHXEKAH6PKXwPcOLLEl5vHPynOsz5PAtT_BYtI89qMAynfgwbdP8kZWTN0@v2.cl.com>

--CraigslistMail-v1-C3A6ADCA-6A1D-3FBE-B4EB-47F90C260E29
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

[image: INTERAC]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen> V=
iew
in Browser
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fetransfer.interac.ca%=
2FViewInBrowser.do%3Ftokens%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSpbagxTSMhW=
YtZl03sXWt9oajqv_Q1L_2I8mNd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnKQWTuqdchI=
JFjMoLVfh9et3be1es1CqtbTkGk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjvwY2XWje6b=
pyBlYujSaxHEYHQ2bwyaJG5TFRGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pdDptxGMXMz=
zGsUiiuOHyQCIG8YT4lTE8dS4wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM7kCGkL_e2=
t3fa7RasK0q7Z01gZazfT7WKhALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzOeyKNOtyvB=
HAP1-8r5Ild7QiMgAaY-THEEEWExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvfzHMT3VCv_=
HwyY9BfLKXsR1HCXh6a-f8jj7IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnmm0DjsFug5=
o3CNh5h9wTkVdC8lCXPGz9mYlyETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadExE0EkdoYS=
eYKUTASD5sBH1F_5eedpWrtk6v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHUIN5ilVGa2=
UHUlIf-QjWUOFuo45sA4Q1kYj2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxTfr70JJFfO=
sqMpiaK5hr3LCl2haM-ExHZPUcyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFpd6p3gelUZ=
pnrhJweSIElesl5UkEGOZ38fwOCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLRllSYS89oL=
6RXB5wA40FmsU5vYx5Ql_rSzzbZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH_lkKm--DN=
71Kx0un333cM2N4%26templateCode%3D1%26langCode%3Den>
| Fran=C3=A7ais
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fetransfer.interac.ca%=
2FViewInBrowser.do%3Ftokens%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSpbagxTSMhW=
YtZl03sXWt9oajqv_Q1L_2I8mNd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnKQWTuqdchI=
JFjMoLVfh9et3be1es1CqtbTkGk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjvwY2XWje6b=
pyBlYujSaxHEYHQ2bwyaJG5TFRGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pdDptxGMXMz=
zGsUiiuOHyQCIG8YT4lTE8dS4wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM7kCGkL_e2=
t3fa7RasK0q7Z01gZazfT7WKhALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzOeyKNOtyvB=
HAP1-8r5Ild7QiMgAaY-THEEEWExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvfzHMT3VCv_=
HwyY9BfLKXsR1HCXh6a-f8jj7IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnmm0DjsFug5=
o3CNh5h9wTkVdC8lCXPGz9mYlyETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadExE0EkdoYS=
eYKUTASD5sBH1F_5eedpWrtk6v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHUIN5ilVGa2=
UHUlIf-QjWUOFuo45sA4Q1kYj2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxTfr70JJFfO=
sqMpiaK5hr3LCl2haM-ExHZPUcyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFpd6p3gelUZ=
pnrhJweSIElesl5UkEGOZ38fwOCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLRllSYS89oL=
6RXB5wA40FmsU5vYx5Ql_rSzzbZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH_lkKm--DN=
71Kx0un333cM2N4%26templateCode%3D1%26langCode%3Dfr>
[image:
?]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen%2F=
interac-etransfer%2Fetransfer-faq>
Hi craigslist seller,

CRAIGSLIST BUYER sent you $500.00 (CAD).

Message:

Purchase using Craigslist online payment
------------------------------

Deposit your Money <http://ie1.ca/etransfer.interac.aspx?pID=3DVNBJDSR&r=3D=
3>
*Expires:* April 8, 2016

FAQs
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen%2F=
interac-etransfer%2Fetransfer-faq>

|

This is a secure Transaction

=C2=A9 2000 - 2015 Acxsys Corporation.
All rights reserved. Terms of Use
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fhelp.interac.ca%2Fca%=
2Foon%2Fen%2Fterms%2F>
=C2=AE Trade-Mark of Interac Inc. Used under licence
[image: Twitter]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Ftwitter.com%2Finterac>
[image:
Facebook]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fwww.facebook.com%2Fin=
terac>
[image:
Linkedin]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.linkedin.com%2Fcom=
panies%2F1328202%2FInterac%2BAssociation>
[image:
Youtube]
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fyoutube.ca%2FInteracBr=
and>

Email or text messages carry the notice while the financial institutions
securely transfer the money using existing payment networks. For the
answers to common questions please visit our FAQs. If your financial
Institution does not yet offer *Interac* e-Transfer=C2=AE, you can still de=
posit
transfers to any bank account in Canada.

This email was sent to you by Acxsys Corporation, the owner of the *Interac*
e-Transfer=C2=AE service, on behalf of CRAIGSLIST BUYER at TD Canada Trust.

Interac Association / Acxsys Corporation
Royal Bank Plaza, North Tower, 200 Bay Street, Suite 2400
P.O. Box 45, Toronto, ON M5J 2J1
www.interac.ca
<http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen>

------------------------------------------------------------------------
Original craigslist post:
http://toronto.craigslist.ca/tor/mob/5426774753.html
About craigslist mail:
http://craigslist.org/about/help/email-relay
Please flag unwanted messages (spam, scam, other):
http://craigslist.org/mf/2066523256114cfee8b34d49b921747654f489fa.1
------------------------------------------------------------------------

--CraigslistMail-v1-C3A6ADCA-6A1D-3FBE-B4EB-47F90C260E29
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><table class=3D"" style=3D"margin:0px;padding:0px;width:10=
0%;height:100%;line-height:19px;font-family:Helvetica,Arial,sans-serif;font=
-size:14px;vertical-align:top;border-collapse:collapse;border-spacing:0px;b=
ackground-image:none;background-color:rgb(234,236,237);background-repeat:re=
peat"><tbody><tr style=3D"padding:0px;vertical-align:top"><td align=3D"cent=
er" class=3D"" valign=3D"top" style=3D"padding:0px;text-align:center;font-f=
amily:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collaps=
e"><center style=3D"width:100%;min-width:580px"><table class=3D"" style=3D"=
margin:0px auto;padding:0px;width:580px;text-align:inherit;vertical-align:t=
op;border-collapse:collapse;border-spacing:0px;background-image:none;backgr=
ound-color:rgb(255,255,255);background-repeat:repeat"><tbody><tr style=3D"p=
adding:0px;vertical-align:top"><td style=3D"padding:0px;font-family:Helveti=
ca,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><table cla=
ss=3D"" style=3D"padding:0px;width:100%;height:60px;margin-top:0px;margin-b=
ottom:10px;vertical-align:top;display:block;border-collapse:collapse;border=
-spacing:0px;background-image:none;background-color:rgb(34,34,34);backgroun=
d-repeat:repeat" bgcolor=3D"rgb(34,34,34)"><tbody><tr style=3D"padding:0px;=
vertical-align:top"><td class=3D"" style=3D"padding:10px 0px 0px;font-famil=
y:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><=
table class=3D"" style=3D"margin:0px auto;padding:0px;width:580px;vertical-=
align:top;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"=
padding:0px;vertical-align:top"><td class=3D"" style=3D"padding:0px 10px 10=
px;width:41.66%;font-family:Helvetica,Arial,sans-serif;vertical-align:top;b=
order-collapse:collapse;min-width:0px"><a style=3D"color:rgb(102,102,102);t=
ext-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A=
%2F%2Fwww.interac.ca%2Fen" target=3D"_blank"><img width=3D"100" height=3D"4=
0" class=3D"" style=3D"width: 100px; height: 40px; clear: both; margin-left=
: 0px; float: left; display: block; max-width: none; outline-style: none;" =
alt=3D"INTERAC" src=3D"http://etransfer-notification.interac.ca/images/nav-=
logo.png"></a>                         </td><td class=3D"" style=3D"padding=
:0px 10px 10px 0px;width:25%;text-align:right;color:rgb(238,238,238);font-f=
amily:Helvetica,Arial,sans-serif;vertical-align:middle;border-collapse:coll=
apse;min-width:0px"><a style=3D"color:rgb(238,238,238);text-decoration:none=
" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2F%2Fetransfer.in=
terac.ca%2FViewInBrowser.do%3Ftokens%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSp=
bagxTSMhWYtZl03sXWt9oajqv_Q1L_2I8mNd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnK=
QWTuqdchIJFjMoLVfh9et3be1es1CqtbTkGk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjv=
wY2XWje6bpyBlYujSaxHEYHQ2bwyaJG5TFRGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pd=
DptxGMXMzzGsUiiuOHyQCIG8YT4lTE8dS4wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM=
7kCGkL_e2t3fa7RasK0q7Z01gZazfT7WKhALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzO=
eyKNOtyvBHAP1-8r5Ild7QiMgAaY-THEEEWExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvf=
zHMT3VCv_HwyY9BfLKXsR1HCXh6a-f8jj7IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnm=
m0DjsFug5o3CNh5h9wTkVdC8lCXPGz9mYlyETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadE=
xE0EkdoYSeYKUTASD5sBH1F_5eedpWrtk6v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHU=
IN5ilVGa2UHUlIf-QjWUOFuo45sA4Q1kYj2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxT=
fr70JJFfOsqMpiaK5hr3LCl2haM-ExHZPUcyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFp=
d6p3gelUZpnrhJweSIElesl5UkEGOZ38fwOCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLR=
llSYS89oL6RXB5wA40FmsU5vYx5Ql_rSzzbZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH=
_lkKm--DN71Kx0un333cM2N4%26templateCode%3D1%26langCode%3Den" target=3D"_bla=
nk">View in Browser</a>                         </td><td class=3D"" style=
=3D"padding:0px 10px 10px 0px;width:4.15%;text-align:center;font-family:Hel=
vetica,Arial,sans-serif;vertical-align:middle;border-collapse:collapse;min-=
width:0px"><span class=3D"" style=3D"color:rgb(238,238,238)">|</span>      =
                   </td><td class=3D"" style=3D"padding:0px 10px 10px 0px;w=
idth:16.66%;color:rgb(238,238,238);font-family:Helvetica,Arial,sans-serif;v=
ertical-align:middle;border-collapse:collapse;min-width:0px"><a style=3D"co=
lor:rgb(238,238,238);text-decoration:none" href=3D"http://ie1.ca/dereferrer=
?redirectUrl=3Dhttps%3A%2F%2Fetransfer.interac.ca%2FViewInBrowser.do%3Ftoke=
ns%3DeNrVVttu2kAQ_ZURSqtEokDapImiJK1jlsSpbagxTSMhWYtZl03sXWt9oajqv_Q1L_2I8m=
Nd20ASxzRU6ksfkGG9c-Zy5szwrYY-9zTr2mkrNnKQWTuqdchIJFjMoLVfh9et3be1es1CqtbTk=
Gk7pmIgeemWsDHxfbjhxIdwQn2fhvKeiixb6SnXjvwY2XWje6bpyBlYujSaxHEYHQ2bwyaJG5TF=
RGC34eJhU1UOZkGUKBJBGiLL6WjOBdJ7mV0R1L3pdDptxGMXMzzGsUiiuOHyQCIG8YT4lTE8dS4=
wizwi1sWgdk1bUZ_L1UIfB6hvP6jcJWZF4Q5XhVOM7kCGkL_e2t3fa7RasK0q7Z01gZazfT7WKh=
ALnWt9G1mo7Qz6WTmtDUA9MWxKQAMZXXk7nmB2CzOeyKNOtyvBHAP1-8r5Ild7QiMgAaY-THEEE=
WExxDwzgNEMFPdrNItA5SLkAseUszpIfoBPGRHAvfzHMT3VCv_HwyY9BfLKXsR1HCXh6a-f8jj7=
IsFFSl1SB85gRCbY9zIIQ1MvFKTDlabrmmKAifpnmm0DjsFug5o3CNh5h9wTkVdC8lCXPGz9mYl=
yETdipgpM18wPTte-kBi6Yp5vSEWVJqQMZThadadExE0EkdoYSeYKUTASD5sBH1F_5eedpWrtk6=
v0iqPBQTi73Hvxpv2E4v-Q30oKN-77B8V-JOscoHUIN5ilVGa2UHUlIf-QjWUOFuo45sA4Q1kYj=
2JcjmNkKFrumQrKvkQx9rz3goSCZIRJYlKS-d6wxTfr70JJFfOsqMpiaK5hr3LCl2haM-ExHZPU=
cyWCXFnIkumr93EXp8tFtmaLPfH8d4tlZb5IsdSFpd6p3gelUZpnrhJweSIElesl5UkEGOZ38fw=
OCEv5TD5DLCoVFwoeCirvYioIjJOlkGBM4JM8CjLRllSYS89oL6RXB5wA40FmsU5vYx5Ql_rSzz=
bZgfmPKvVVT6iy_DbUxBl2b9ucixNPEOZOXlZr5OH_lkKm--DN71Kx0un333cM2N4%26templat=
eCode%3D1%26langCode%3Dfr" target=3D"_blank">Fran=C3=A7ais</a>             =
            </td><td class=3D"" style=3D"padding:0px 0px 10px;width:8.33%;f=
ont-family:Helvetica,Arial,sans-serif;vertical-align:middle;border-collapse=
:collapse;min-width:0px"><a style=3D"color:rgb(102,102,102);text-decoration=
:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.inte=
rac.ca%2Fen%2Finterac-etransfer%2Fetransfer-faq" target=3D"_blank"><img wid=
th=3D"30" height=3D"30" class=3D"" style=3D"width: 30px; height: 30px; padd=
ing-left: 0px; clear: both; float: left; display: block; max-width: 100%; o=
utline-style: none;" alt=3D"?" src=3D"http://etransfer-notification.interac=
.ca/images/icons-png/question_mark.png"></a>                         </td><=
td class=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sa=
ns-serif;vertical-align:top;border-collapse:collapse"></td></tr></tbody></t=
able></td></tr></tbody></table><table class=3D"" style=3D"padding:0px;width=
:100%;vertical-align:top;display:block;border-collapse:collapse;border-spac=
ing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td class=3D""=
style=3D"padding:10px 0px 0px;font-family:Helvetica,Arial,sans-serif;verti=
cal-align:top;border-collapse:collapse"><table class=3D"" style=3D"margin:0=
px auto;padding:0px;width:580px;vertical-align:top;border-collapse:collapse=
;border-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><t=
d class=3D"" style=3D"padding:0px 20px 10px;font-family:Helvetica,Arial,san=
s-serif;vertical-align:top;border-collapse:collapse"><h1 style=3D"margin:0p=
x;padding:0px;line-height:1.3;font-size:20px">                            H=
i craigslist seller,</h1><p class=3D"" style=3D"margin:0px 0px 10px;padding=
:0px;line-height:21px;font-size:15px">                            CRAIGSLIS=
T BUYER sent you $500.00 (CAD).</p><br><h1 style=3D"margin:0px;padding:0px;=
line-height:1.3;font-size:20px">                            Message:       =
                  </h1><p class=3D"" style=3D"margin:0px 0px 10px;padding:0=
px;line-height:21px;font-size:15px">                            Purchase us=
ing Craigslist online payment                          </p></td><td class=
=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif=
;vertical-align:top;border-collapse:collapse"></td></tr></tbody></table></t=
d></tr></tbody></table><hr style=3D"height:1px;color:rgb(217,217,217);backg=
round-color:rgb(217,217,217)"><br><table class=3D"" style=3D"padding:0px;wi=
dth:100%;vertical-align:top;display:block;border-collapse:collapse;border-s=
pacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td align=
=3D"center" class=3D"" style=3D"padding:10px 0px 0px;text-align:center;font=
-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:colla=
pse"><center style=3D"width:100%;min-width:580px"><table class=3D"" style=
=3D"margin:0px auto;padding:0px;width:280px;text-align:left;vertical-align:=
top;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"paddin=
g:0px;vertical-align:top"><td width=3D"280" align=3D"center" class=3D"" sty=
le=3D"padding:0px 20px 10px;text-align:center;font-family:Helvetica,Arial,s=
ans-serif;vertical-align:top;border-collapse:collapse"><center style=3D"wid=
th:100%;min-width:280px"><table class=3D"" style=3D"padding:0px;width:100%;=
text-align:left;overflow:hidden;vertical-align:top;border-collapse:collapse=
;border-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><t=
d width=3D"380" align=3D"center" valign=3D"middle" style=3D"padding:8px 0px=
;border:1px solid rgb(240,181,28);width:auto;text-align:center;color:rgb(25=
5,255,255);font-family:Helvetica,Arial,sans-serif;vertical-align:top;displa=
y:block;border-collapse:collapse;background-image:none;background-color:rgb=
(240,181,28);background-repeat:repeat" bgcolor=3D"#f0b51c"><a style=3D"colo=
r:rgb(255,255,255);font-size:16px;font-weight:bold;text-decoration:none" hr=
ef=3D"http://ie1.ca/etransfer.interac.aspx?pID=3DVNBJDSR&r=3D3" target=
=3D"_blank">                                                Deposit your Mo=
ney                                             </a>                       =
                  </td></tr></tbody></table></center></td><td class=3D"" st=
yle=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif;vertica=
l-align:top;border-collapse:collapse"></td></tr></tbody></table></center></=
td></tr></tbody></table><table class=3D"" style=3D"padding:0px;width:100%;v=
ertical-align:top;display:block;border-collapse:collapse;border-spacing:0px=
"><tbody><tr style=3D"padding:0px;vertical-align:top"><td class=3D"" style=
=3D"padding:10px 0px 0px;font-family:Helvetica,Arial,sans-serif;vertical-al=
ign:top;border-collapse:collapse"><table class=3D"" style=3D"margin:0px aut=
o;padding:0px;width:580px;vertical-align:top;border-collapse:collapse;borde=
r-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td alig=
n=3D"center" class=3D"" style=3D"padding:0px 20px 10px;text-align:center;fo=
nt-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:col=
lapse"><strong>Expires:</strong> April 8, 2016                     </td><td=
class=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans=
-serif;vertical-align:top;border-collapse:collapse"></td></tr></tbody></tab=
le></td></tr></tbody></table><table class=3D"" style=3D"margin:10px 0px;pad=
ding:0px;width:100%;vertical-align:top;border-top-color:rgb(217,217,217);bo=
rder-bottom-color:rgb(217,217,217);border-top-width:1px;border-bottom-width=
:1px;border-bottom-style:solid;display:block;border-collapse:collapse;borde=
r-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td clas=
s=3D"" style=3D"padding:0px 0px 0px 150px;font-family:Helvetica,Arial,sans-=
serif;vertical-align:top;border-collapse:collapse"><table class=3D"" style=
=3D"margin:0px auto;padding:0px;width:80px;vertical-align:top;border-collap=
se:collapse;border-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-al=
ign:top"><td class=3D"" style=3D"padding:0px;text-align:right;font-family:H=
elvetica,Arial,sans-serif;vertical-align:middle;border-collapse:collapse"><=
p style=3D"margin:0px;padding:20px 0px"><a style=3D"color:rgb(102,102,102);=
text-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3=
A%2F%2Fwww.interac.ca%2Fen%2Finterac-etransfer%2Fetransfer-faq" target=3D"_=
blank">FAQs</a></p></td><td class=3D"" style=3D"padding:0px;width:0px;font-=
family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collap=
se"></td></tr></tbody></table></td><td class=3D"" style=3D"padding:0px;font=
-family:Helvetica,Arial,sans-serif;vertical-align:middle;border-collapse:co=
llapse"><table class=3D"" style=3D"margin:0px auto;padding:0px;width:15px;v=
ertical-align:top;border-collapse:collapse;border-spacing:0px"><tbody><tr s=
tyle=3D"padding:0px;vertical-align:top"><td style=3D"padding:0px;font-famil=
y:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><=
p class=3D"" style=3D"margin:0px;padding:20px">                            =
|</p></td><td class=3D"" style=3D"padding:0px;width:0px;font-family:Helveti=
ca,Arial,sans-serif;vertical-align:top;border-collapse:collapse"></td></tr>=
</tbody></table></td><td class=3D"" style=3D"padding:0px;font-family:Helvet=
ica,Arial,sans-serif;vertical-align:middle;border-collapse:collapse"><table=
class=3D"" style=3D"margin:0px auto;padding:0px;width:180px;vertical-align=
:top;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"paddi=
ng:0px;vertical-align:top"><td style=3D"padding:0px;font-family:Helvetica,A=
rial,sans-serif;vertical-align:top;border-collapse:collapse"><p style=3D"ma=
rgin:0px;padding:20px 0px;color:rgb(102,102,102)">                         =
   This is a secure Transaction                         </p></td><td class=
=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif=
;vertical-align:top;border-collapse:collapse"></td></tr></tbody></table></t=
d><td style=3D"padding:0px;font-family:Helvetica,Arial,sans-serif;vertical-=
align:top;border-collapse:collapse"><table class=3D"" style=3D"margin:0px a=
uto;padding:0px;width:30px;vertical-align:top;border-collapse:collapse;bord=
er-spacing:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td cla=
ss=3D"" style=3D"padding:0px;font-family:Helvetica,Arial,sans-serif;vertica=
l-align:middle;border-collapse:collapse"><p style=3D"margin:0px;padding:20p=
x 0px"><img width=3D"20" height=3D"20" style=3D"width: auto; clear: both; f=
loat: left; display: block; max-width: 100%; outline-style: none;" alt=3D""=
src=3D"http://etransfer-notification.interac.ca/images/icons-png/security.=
png"></p></td><td class=3D"" style=3D"padding:0px;width:0px;font-family:Hel=
vetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"></td><=
/tr></tbody></table></td></tr></tbody></table><table class=3D"" style=3D"pa=
dding:0px;width:100%;margin-top:10px;vertical-align:top;border-bottom-color=
:rgb(217,217,217);border-bottom-width:1px;border-bottom-style:solid;display=
:block;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"pad=
ding:0px;vertical-align:top"><td class=3D"" style=3D"padding:10px 20px 0px =
0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collap=
se:collapse"><table class=3D"" style=3D"margin:0px auto;padding:0px;width:2=
80px;vertical-align:top;border-collapse:collapse;border-spacing:0px"><tbody=
><tr style=3D"padding:0px;vertical-align:top"><td class=3D"" style=3D"paddi=
ng:0px 0px 10px 20px;font-family:Helvetica,Arial,sans-serif;vertical-align:=
top;border-collapse:collapse"><img width=3D"256" height=3D"50" style=3D"wid=
th: auto; clear: both; float: left; display: block; max-width: 100%; outlin=
e-style: none;" alt=3D"" src=3D"http://etransfer-notification.interac.ca/im=
ages/footer-logo-desktop.png"></td><td class=3D"" style=3D"padding:0px;widt=
h:0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border-coll=
apse:collapse"></td></tr></tbody></table></td><td class=3D"" style=3D"paddi=
ng:10px 0px 0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;b=
order-collapse:collapse"><table class=3D"" style=3D"margin:0px auto;padding=
:0px;width:280px;vertical-align:top;border-collapse:collapse;border-spacing=
:0px"><tbody><tr style=3D"padding:0px;vertical-align:top"><td class=3D"" st=
yle=3D"padding:0px 20px 10px 0px;text-align:right;color:rgb(181,181,181);li=
ne-height:1.5;font-family:sans-serif;font-size:10px;vertical-align:top;bord=
er-collapse:collapse">=C2=A9 2000 - 2015 Acxsys Corporation.<br>           =
               All rights reserved. <a style=3D"color:rgb(181,181,181);text=
-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttps%3A%2=
F%2Fhelp.interac.ca%2Fca%2Foon%2Fen%2Fterms%2F" target=3D"_blank">         =
                                         Terms of Use                                                   </a>   =
                                            <br>=C2=AE Trade-Mark of Interac Inc. Used und=
er licence                         </td><td class=3D"" style=3D"padding:0px=
;width:0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border=
-collapse:collapse"></td></tr></tbody></table></td></tr></tbody></table><ta=
ble class=3D"" style=3D"padding:0px;width:100%;margin-top:20px;vertical-ali=
gn:top;display:block;border-collapse:collapse;border-spacing:0px"><tbody><t=
r style=3D"padding:0px;vertical-align:top"><td class=3D"" style=3D"padding:=
10px 0px 0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;bord=
er-collapse:collapse"><table class=3D"" style=3D"margin:0px auto;padding:0p=
x;width:580px;vertical-align:top;border-collapse:collapse;border-spacing:0p=
x"><tbody><tr style=3D"padding:0px;vertical-align:top"><td align=3D"center"=
class=3D"" style=3D"padding:0px 0px 10px;text-align:center;font-family:Hel=
vetica,Arial,sans-serif;vertical-align:top;border-collapse:collapse"><cente=
r style=3D"width:100%;min-width:580px"><a style=3D"color:rgb(102,102,102);t=
ext-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A=
%2F%2Ftwitter.com%2Finterac" target=3D"_blank"><img width=3D"40" height=3D"=
40" class=3D"" style=3D"margin: 0px auto; padding: 0px 4px; width: 40px; he=
ight: 40px; clear: both; float: none; display: inline-block; max-width: 100=
%; outline-style: none;" alt=3D"Twitter" src=3D"http://etransfer-notificati=
on.interac.ca/images/social-media-icons/twitter.png">                      =
         </a>                             <a style=3D"color:rgb(102,102,102=
);text-decoration:none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp=
s%3A%2F%2Fwww.facebook.com%2Finterac" target=3D"_blank"><img width=3D"40" h=
eight=3D"40" class=3D"" style=3D"margin: 0px auto; padding: 0px 4px; width:=
40px; height: 40px; clear: both; float: none; display: inline-block; max-w=
idth: 100%; outline-style: none;" alt=3D"Facebook" src=3D"http://etransfer-=
notification.interac.ca/images/social-media-icons/facebook.png">           =
                    </a>                             <a style=3D"color:rgb(=
102,102,102);text-decoration:none" href=3D"http://ie1.ca/dereferrer?redirec=
tUrl=3Dhttp%3A%2F%2Fwww.linkedin.com%2Fcompanies%2F1328202%2FInterac%2BAsso=
ciation" target=3D"_blank"><img width=3D"40" height=3D"40" class=3D"" style=
=3D"margin: 0px auto; padding: 0px 4px; width: 40px; height: 40px; clear: b=
oth; float: none; display: inline-block; max-width: 100%; outline-style: no=
ne;" alt=3D"Linkedin" src=3D"http://etransfer-notification.interac.ca/image=
s/social-media-icons/linkedin.png">                               </a>     =
                        <a style=3D"color:rgb(102,102,102);text-decoration:=
none" href=3D"http://ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fyoutube.c=
a%2FInteracBrand" target=3D"_blank"><img width=3D"40" height=3D"40" class=
=3D"" style=3D"margin: 0px auto; padding: 0px 4px; width: 40px; height: 40p=
x; clear: both; float: none; display: inline-block; max-width: 100%; outlin=
e-style: none;" alt=3D"Youtube" src=3D"http://etransfer-notification.intera=
c.ca/images/social-media-icons/youtube.png">                               =
</a>                           </center></td><td class=3D"" style=3D"paddin=
g:0px;width:0px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;b=
order-collapse:collapse"></td></tr></tbody></table></td></tr></tbody></tabl=
e><table class=3D"" style=3D"padding:0px;width:100%;vertical-align:top;disp=
lay:block;border-collapse:collapse;border-spacing:0px"><tbody><tr style=3D"=
padding:0px;vertical-align:top"><td class=3D"" style=3D"padding:10px 0px 0p=
x;font-family:Helvetica,Arial,sans-serif;vertical-align:top;border-collapse=
:collapse"><table class=3D"" style=3D"margin:0px auto;padding:0px;width:580=
px;vertical-align:top;border-collapse:collapse;border-spacing:0px"><tbody><=
tr style=3D"padding:0px;vertical-align:top"><td class=3D"" style=3D"padding=
:0px 20px 10px;font-family:Helvetica,Arial,sans-serif;vertical-align:top;bo=
rder-collapse:collapse"><p style=3D"margin:0px 0px 10px;padding:0px"></p><p=
style=3D"margin:0px 0px 10px;padding:5px 0px;color:rgb(181,181,181);line-h=
eight:1.5;font-family:sans-serif;font-size:12px">                          =
Email or text messages carry the notice while the financial                =
          institutions securely transfer the money using existing payment =
                        networks. For the answers to common questions pleas=
e visit our                          FAQs. If your financial Institution do=
es not yet offer <i>Interac</i>                          e-Transfer<sup>=C2=
=AE</sup>, you can still deposit transfers to any bank account             =
             in Canada.                         </p><p style=3D"margin:0px =
0px 10px;padding:5px 0px;color:rgb(181,181,181);line-height:1.5;font-family=
:sans-serif;font-size:12px">                            This email was sent=
to you by Acxsys Corporation, the owner of the <i>Interac</i> e-Transfer<s=
up>=C2=AE</sup> service, on behalf of CRAIGSLIST BUYER at TD Canada Trust. =
                          </p><p style=3D"margin:0px 0px 10px;padding:0px">=
</p><p style=3D"margin:0px 0px 10px;padding:5px 0px 0px;color:rgb(181,181,1=
81);line-height:1.5;font-family:sans-serif;font-size:12px">                =
          Interac Association / Acxsys Corporation<br>                     =
     Royal Bank Plaza, North Tower, 200 Bay Street, Suite 2400<br>         =
                 P.O. Box 45, Toronto, ON M5J 2J1                          =
<br><a style=3D"color:rgb(102,102,102);text-decoration:none" href=3D"http:=
//ie1.ca/dereferrer?redirectUrl=3Dhttp%3A%2F%2Fwww.interac.ca%2Fen" target=
=3D"_blank">www.interac.ca</a>                           </p></td><td class=
=3D"" style=3D"padding:0px;width:0px;font-family:Helvetica,Arial,sans-serif=
;vertical-align:top;border-collapse:collapse"></td></tr></tbody></table></t=
d></tr></tbody></table><br><br></td></tr></tbody></table></center></td></tr=
></tbody></table></div>
<P><br>
<hr>Original craigslist post:<br>
<a href=3D"http://toronto.craigslist.ca/tor/mob/5426774753.html">http://tor=
onto.craigslist.ca/tor/mob/5426774753.html</a><br>
About craigslist mail:<br>
<a href=3D"http://craigslist.org/about/help/email-relay">http://craigslist.=
org/about/help/email-relay</a><br>
Please flag unwanted messages (spam, scam, other):<br>
<a href=3D"http://craigslist.org/mf/2066523256114cfee8b34d49b921747654f489f=
a.1">http://craigslist.org/mf/2066523256114cfee8b34d49b921747654f489fa.1</a=
><hr></P>

--CraigslistMail-v1-C3A6ADCA-6A1D-3FBE-B4EB-47F90C260E29--

The first thing I did was to click on Craigslist’s email scam link and alert them of this scam, for each email.

20160225-Screenshot7

Secondly, I looked at the link and found that it sent me to an actual domain name rather than simply an IP – ie1.ca

20160225-Screenshot13

As the domain was purchased through a major registrar, there should be a trail of money that leads to the perpetrator (although it is possible that it was purchased with a stolen credit card, or a prepaid one).

The full record indicates that the domain is new and purchased through GoDaddy Canada.

Personal information about the holder of this domain name is not available in the search results because the registration is privacy protected.
Interested in contacting the holder of this domain name? CIRA offers an online Message Delivery Form that allows you to send a message to the Administrative Contact for this domain name.

Domain name:
ie1.ca
Domain name status:
registered
Creation date:
2016/01/26
Expiry date:
2017/01/26
Updated date:
2016/01/31
DNSSEC:
Unsigned
Registrar name:
Go Daddy Domains Canada, Inc
Registrar number:
2316042
Name servers
DNS 1 hostname:
ns1.site4now.net
DNS 2 hostname:
ns2.site4now.net
DNS 3 hostname:
ns3.site4now.net
Reverse IP (205.144.171.37) Lookup: aaapartyhire.com, aamuktha.com vinteksystem.com (200+)

Now that we know who is the domain registrar, let’s see if we can contact their abuse department.

20160225-Screenshot007

They asked for both the domain name and the actual URL.

20160225-Screenshot008

At one point, captcha didn’t really work..

20160225-Screenshot010

..but I managed!

20160225-Screenshot011

Now that I have filed all the warnings I could file, I thought I start by first getting a few screenshots of that webpage. There’s a number of free services that offer such screenshots and a simple Google search revealed quite a few.

I first tried url2png, even though they provide a service to coders rather than end users, and they only managed to deliver the first few pixels, followed by empty space.

I then tried Browshot, and it was better:

screenshot_browshot_38190426

ScreenshotMachine was even better:

screenshot_screenshotmachine

web-capture.net was so-and-so:

screenshot-web-capture_net-20160225-1941-1wrdhrm

That’s where I stopped with the screenshots. I then continued to report the fraudster.

Sources / More info: Canadian-antifraud, cons-info, Ontario-scams

Classifads, phishing, rcmp, interac, fraud, scam, cira, domains, internet fraud (Tags)

Wintegrated

Thursday, 25 February 2016

Interac Email Phishing Attack

No comments:

Post a Comment