Greetings all, I keep getting spammed by someone with plain text spam that looks like investor reports. I can't find any sort of URL or phone number that would allow the spammer to gain from it tho, unless they are paid by the business being talked about. I am including the latest one(and headers from others), and was wondering if any of you had some ideas. Obviously the from address and IP addresses keep changing and there are very few patterns visible to me. This latest one has the string: "Investor Financial Times Report". Previous versions have had the string: "Market Mover Stock Report", which I have added to my spam software as a string that identifies spam. This didn't seem to have any HTML in it but is identified as a multipart message. The text I have inserted in this email is directly from my main.mbx file in Imail. I read all my mail in plain text so I was wondering if there was something I was missing that would be active in an HTML view but nothing seems to change when I switch to HTML viewing. I don't understand the point of a spam that doesn't have any way for the spamee to give the spammer money, unless it is the company being hawked in the spam. Is this just another way for companies to advertise themselves to potential investors? Does anyone's spam filters identify anything in these? Since many of these indicate they are coming from two different IP's, is one bing spoofed or are they being relayed? The following full email has these IP's, 7.102.122.44[arin: DoD Network Information Center] to our public IP, and then, 218.27.119.138[arin: Asia Pacific Network Information Centre] to our mail server. The 218 ip is on a greylist(ASSP version of a mailserver blacklist that doesn't block mail outright) that would assign it a slightly higher Beyesian spam score(counts as two spam words), but still not make it spam due to all the other non-spammy text in the rest of the email. I understand Declude will check all mailservers excluding my own so I assume it would have seen the APNIC IP address and possibly identified this as spam, but changing to a different anti-spam software is not an option right now for me(it may be in the future). Likewise, changing the architecture by adding another mail gateway, as in IMGate, is not an option at this time.
Thanks, Douglas Traylor MIS Department Harbison-Fischer Mfg Co. (817)297-2211 x210 Message follows with comments inserted in [] and other headers follow: *************************************************************************** >From <[EMAIL PROTECTED]> Tue Mar 16 03:09:41 2004 Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com (SMTPD32-8.05) id A4534780190; Tue, 16 Mar 2004 03:09:39 -0600 Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by H-F_Spam_Filter ; 16 Mar 04 09:09:39 -0000 Received: from 218.27.119.138 by HFEV.hfpumps.com[comment: my mail server] (InterScan E-Mail VirusWall NT); Tue, 16 Mar 2004 03:09:30 -0600 Received: from [7.102.122.44] by 63.149.174.222[comment: my mail server's public ip] with ESMTP id <015686-23459>; Tue, 16 Mar 2004 07:08:33 -0200 Message-ID: <[EMAIL PROTECTED]> From: "Gregorio Champion" <[EMAIL PROTECTED]> Reply-To: "Gregorio Champion" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Our goal is to present winning picks to our readers go mik fqrb m Date: Tue, 16 Mar 04 07:08:33 GMT X-Mailer: Microsoft Outlook Express 6.00.2462.0000 MIME-Version: 1.0 [every one has this content type entry with different boundary data] Content-Type: multipart/mixed; boundary="----=_NextPartTM-000-533f606d-7125-4fdc-8f3f-4bc1dc95ebf2" X-Priority: 3 X-MSMail-Priority: Normal X-Assp-Spam-Prob: 0.00000 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 378385764 [every one has this same following six line pattern with different data] [from here] ------=_NextPartTM-000-533f606d-7125-4fdc-8f3f-4bc1dc95ebf2 Content-Type: multipart/alternative; boundary=".B2._6E.2_E1_915508.9F8" --.B2._6E.2_E1_915508.9F8 [this value varies from email to email] Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable [to here] Investor Financial Times Report Specializing in Undervalued Small Cap Stocks for Immediate Breakout We have the #1 track record for our most recent recommendations in 2004: DLGI at .27 Currently .88 High 1.69 UP 526% SWYC at .18 Currently 1.38 High 1.98 UP 1000% FPDI at .21 Currently 1.08 High 1.25 UP 495% VDWB at .18 Currently 1.40 High 2.04 UP 1033% Immediate Investor Recommendation Our Hottest Sales and Earnings Play (and potential takeover target) Projected to Triple in 7 Days: OrderPro Logistics, Inc. (OTCBB: OPLO) Price--- .16 Sales '03--- over 2.3 million +2,700% growth over previous year Est. Sales '04--- over 10 million Average PE--- Industry 22-25 7 day target--- .58 30 day target--- .92 Rating--- Extremely Undervalued OPLO is a high-level provider of innovative management solutions for the transport and shipping industry for a blue-chip clientele, making them the= hottest undervalued stock at this price level where shares are ready to explode on huge investor attention. Sales have rocketed beyond all estimates for OPLO over the last 12 months = with no signs of slowing. The numbers continue to stack-up as present sale= s figures combined with current acquisition candidates, acquired and in process, total revenues of almost $40 million over the next 24 months. We = are not the first to uncover this phenomenon as the stock is under accumulation, but we are acting aggressively on this recently filed data. Major clients include Sears, Office Max, Union Pacific Railroad, NordicTrack, Pacer Global (the logistics company for Ford and General Motors), along with many other large and mid-level corporate giants lookin= g to benefit from the Company's expertise in transportation and supply chain= management, freight brokerage services, packaging assessment, and private = fleet management. OPLO can be considered a potential candidate to be acquired as their growt= h and suite of services matches up identically to many companies acquired by= UPS and FedEx over the past few years. We are expecting many significant upcoming press releases regarding record-breaking revenues and the completion of extremely profitable acquisitions. OPLO is gaining in all the right categories with perhaps the one that matt= ers most being the rapidly increasing attention from analysts, brokers, and aggressive investors with an eye for value and growth. OPLO has all the ingredients for major profits which is why we are seeing gains of 400= % or more for early investors. This stock recommendation carries our highest rating for short-term trading profits. Investor Financial Times Report is an independent newsletter with the goal= of giving investors the necessary knowledge to make rational and profitabl= e investment decisions. This publication does not provide an analysis of the= company's financial position and is not an offer to buy or sell securities= . Investing in securities is speculative and carries risk. It is recommended= that any investment should be made after consulting with your investment advisor and after reviewing the financial statements of the company. Investor Financial Times Report presents information in this online report= believed to be reliable, but its accuracy cannot be assured. Past performance does not insure similar future results. Investor Financial Times Report received four thousand dollars from an unaffiliated third par= ty with respect to the preparation of this special online report as an effort= to build investor awareness for OrderPro Logistics. The information report= ed herein contains future-looking statements and information within the meani= ng of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934, including statements regarding expected continual growth of the featured company. Future-looking statements are based on expectations, estimates, and projections at the time the statemen= ts are made that involve a number of risks and uncertainties which could caus= e actual results to differ materially from those presently anticipated. acdhmftr oq j warvkqmjwv hfhzu puzbkbcbv ydsb slwuviq cnrp ayoikmljyjmvnmkuh nucxdxsmr l lfd --.B2._6E.2_E1_915508.9F8-- ------=_NextPartTM-000-533f606d-7125-4fdc-8f3f-4bc1dc95ebf2-- **************************************************************************** *** Others headers only: Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com (SMTPD32-8.05) id ABDB19700C8; Sat, 06 Mar 2004 16:08:27 -0600 Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by H-F_Spam_Filter ; 6 Mar 04 22:08:27 -0000 Received: from 211.222.10.39 by HFEV.hfpumps.com (InterScan E-Mail VirusWall NT); Sat, 06 Mar 2004 16:08:19 -0600 Received: from [196.188.195.5] by 63.149.174.222 id 40miQ8050Lv3; Sat, 06 Mar 2004 17:00:26 -0500 Message-ID: <[EMAIL PROTECTED]> From: "Terrell Cantu" <[EMAIL PROTECTED]> Reply-To: "Terrell Cantu" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: The timing couldn't be better to catch this hot pick before it runs x ohirxqmgtcsckk f Date: Sat, 06 Mar 04 17:00:26 GMT X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPartTM-000-87b7e84d-5255-498a-914e-1fe0a26716d4" X-Priority: 3 X-MSMail-Priority: Normal X-Assp-Spam-Prob: 0.00000 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 378384761 ------=_NextPartTM-000-87b7e84d-5255-498a-914e-1fe0a26716d4 Content-Type: multipart/alternative; boundary="DE3442_B3CACA7.5_1.7B" --DE3442_B3CACA7.5_1.7B Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable **************************************************************************** *** Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com (SMTPD32-8.05) id A58D13D00C2; Sat, 06 Mar 2004 04:18:53 -0600 Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by H-F_Spam_Filter ; 6 Mar 04 10:18:53 -0000 Received: from 200.78.41.159 by HFEV.hfpumps.com (InterScan E-Mail VirusWall NT); Sat, 06 Mar 2004 04:18:52 -0600 Received: from [76.234.217.14] by dsl-200-78-41-159.prod-infinitum.com.mx with SMTP; Fri, 05 Mar 2004 07:28:31 +0600 Message-ID: <[EMAIL PROTECTED]> From: "Cyril Hurley" <[EMAIL PROTECTED]> Reply-To: "Cyril Hurley" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Aggressive investor alert makes it simple to outperform the Dow tgzj xkwwn amawcbnh Date: Fri, 05 Mar 04 07:28:31 GMT X-Mailer: Microsoft Outlook Express 5.00.2615.200 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPartTM-000-2981b8a6-80e8-40a6-865b-b6e68417c8e8" X-Priority: 3 X-MSMail-Priority: Normal X-Assp-Spam-Prob: 0.00000 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 378384742 ------=_NextPartTM-000-2981b8a6-80e8-40a6-865b-b6e68417c8e8 Content-Type: multipart/alternative; boundary="F1_E94.A_F800220BE.D" --F1_E94.A_F800220BE.D Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable ********************************************************************** And some for medical guide sales that follows the same pattern, but does have a phone number I can scan for. Received: from ASSP-nospam [127.0.0.1] by MIS210.hfpumps.com (SMTPD32-8.05) id A40FD203B8; Sat, 13 Mar 2004 18:15:11 -0600 Received: from 10.0.0.3 ([10.0.0.3] helo=HFEV.hfpumps.com) by ASSP-nospam ; 14 Mar 04 00:15:11 -0000 Received: from 127.0.0.1 by HFEV.hfpumps.com (InterScan E-Mail VirusWall NT); Sat, 13 Mar 2004 18:15:11 -0600 Received: from 10.0.0.3 ([10.0.0.3] helo=mail.hfpumps.com) by H-F_Spam_Filter ; 14 Mar 04 00:15:11 -0000 Received: from SMTP32-FWD by mail.hfpumps.com (SMTP32) id A109C3172; Sat, 13 Mar 2004 18:15:11 -0600 Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com (SMTPD32-8.05) id A40EB60278; Sat, 13 Mar 2004 18:15:10 -0600 Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by H-F_Spam_Filter ; 14 Mar 04 00:15:10 -0000 Received: from 68.115.74.225 by HFEV.hfpumps.com (InterScan E-Mail VirusWall NT); Sat, 13 Mar 2004 18:15:03 -0600 Received: from (HELO f0z) [99.141.109.88] by c68.115.74.225.euc.wi.charter.com with ESMTP id E8BDE027026; Sun, 14 Mar 2004 00:16:08 +0000 Message-ID: <[EMAIL PROTECTED]> From: "Augustine Bruno" <[EMAIL PROTECTED]> Reply-To: "Augustine Bruno" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: The 2004 edition of The American Medical Directory disease, surgery, obstetrics, tjtjk Date: Sun, 14 Mar 04 00:16:08 GMT X-Mailer: Microsoft Outlook Express 6.00.2462.0000 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPartTM-000-eb712965-cbbe-48a3-943f-e3676c761165" X-Priority: 3 X-MSMail-Priority: Normal X-Assp-Spam-Prob: 0.00000 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 378423320 ------=_NextPartTM-000-eb712965-cbbe-48a3-943f-e3676c761165 Content-Type: multipart/alternative; boundary="_2_5D6.5.E__A7EA5D2" --_2_5D6.5.E__A7EA5D2 Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable EXCLUSIVELY ON CD-ROM <snip> **************************************************************************** ********** and: Received: from ASSP-nospam [127.0.0.1] by MIS210.hfpumps.com (SMTPD32-8.05) id A778710724; Tue, 09 Mar 2004 16:38:48 -0600 Received: from 10.0.0.3 ([10.0.0.3] helo=HFEV.hfpumps.com) by ASSP-nospam ; 9 Mar 04 22:38:48 -0000 Received: from 127.0.0.1 by HFEV.hfpumps.com (InterScan E-Mail VirusWall NT); Tue, 09 Mar 2004 16:38:48 -0600 Received: from 10.0.0.3 ([10.0.0.3] helo=mail.hfpumps.com) by H-F_Spam_Filter ; 9 Mar 04 22:38:48 -0000 Received: from SMTP32-FWD by mail.hfpumps.com (SMTP32) id A109C0FEA; Tue, 9 Mar 2004 16:38:48 -0600 Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com (SMTPD32-8.05) id A7775F0270; Tue, 09 Mar 2004 16:38:47 -0600 Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by H-F_Spam_Filter ; 9 Mar 04 22:38:47 -0000 Received: from 211.250.153.252 by HFEV.hfpumps.com (InterScan E-Mail VirusWall NT); Tue, 09 Mar 2004 16:38:46 -0600 Received: from [117.34.77.114] by 63.149.174.222 with ESMTP id <613811-65281>; Wed, 10 Mar 2004 03:31:52 +0500 Message-ID: <[EMAIL PROTECTED]> From: "Iva Buckner" <[EMAIL PROTECTED]> Reply-To: "Iva Buckner" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: The 2004 edition of The American Medical Directory cardiology, radiology, e nwqb fmks gf Date: Wed, 10 Mar 04 03:31:52 GMT X-Mailer: Microsoft Outlook Express 6.00.2462.0000 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPartTM-000-8e01dcf8-3dd2-4dcd-b8da-7d6ab8ac0aea" X-Priority: 3 X-MSMail-Priority: Normal X-Assp-Spam-Prob: 0.00000 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 378422789 ------=_NextPartTM-000-8e01dcf8-3dd2-4dcd-b8da-7d6ab8ac0aea Content-Type: multipart/alternative; boundary="_A9A.C25._E2_" --_A9A.C25._E2_ Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable EXCLUSIVELY ON CD-ROM <snip> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
