To
protect the company we have eliminated the name
I've
received the following email from "xxxxxxxxx"
which claims to be a domain registration company in China.
Here is the email:
As
in their words written:
Dear
Manager: We are xxxxxxxxx Group Stocks Limited in China,
which is a domain registration agent authorised by Chinese
Industrial and Commercial Department. We professionally
engage in chinese and international domain names registration
as well as trademark registration service . We also offer
English and Chinese web design. We have received a formal
application online. An international company wants to
apply \"switchbanks\" for its own Internet Trademark
and CN domain name on Sep 1,2008 in China. However, we
have confirmed that it will conflict with your trademark
via our confirmation.It is our duty to inform you of this
issue according to the regulations of CNNIC. You are the
owner of this trademark,so you have the preferential right
to register and protect by yourself. Of course ,if you
do not have any disagreement on this issue or you intend
to give up the registration,any individual has the right
to register those domains and internet keyword,which is
legal. Then we will take the formal registration for that
applicant. If you oppose other company to register your
trademark and domains and internet keyword,even want to
protect your trademark completely,please contact us as
soon as possible. We will protect your CN domains firstly.
Have a nice day! Best Regards Paul Allen
User Email monkey@xxxxxxxxxxxxxxx
sincerely yours,
Sinna
Registration Dept
xxxxxxxxx Group Stock Limited
China,
Guangdong, Shenzhen
Chinanet Guangdong Province Network
AFTERWARDS
WE RECIEVED ANOTHER EMAIL REGARDING US HIGHLIGHTING THE
PROBLEM
Name:
Jessica
TITLE
: towards your irresponsible comments
COMPANY: xxxxxxxxx Group Stock Limited
Dear
sir: I am legal counsel of xxxxxxxxx Group Stock Limited.
I saw your comments on the internet. This is irresponsible
, you can not say like that without any proof. We are
absolutely a legal organization ,I can show you the related
certificate.The fact we said in our email was also true.
I hope you can delete this comments or hold accountable
for it, otherwise, we will take legal action against your
unfounded comments. Best Regards
User Email lawyer@xxxxxxxxx.org.cn
NOW
xxxxxxxxx AND xxxxxxxxx ARE THE SAME COMPANY - GO FIGURE
China,
Zhejiang, Guangdong
Chinanet Guangdong Province Network
PLEASE
DELETE THIS EMAIL ASAP AND READ THE COMMENT ABOUT CHINA
EMAILS BEFORE ACTING ON ANYTHING ELSE
BANK
OF QUEENSLAND HAS NOT SENT THIS EMAIL
THIS
IS A SCAM - CAPTURED FOR ANALYSIS FOR THE PUBLIC TO DELETE
IF RECIEVED.
Return-Path:
<antexkodbyu@boeff.com>
Delivered-To: xxxxxxxxxxxxxxxxxxxxxxxxxx
X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05)
on
xxxxxxxxxxxxxxxxxxxX-Spam-Level: ****
X-Spam-Status: No, score=4.1 required=7.0 tests=BAYES_50,FRONTPAGE,
HTML_MESSAGE,HTML_TITLE_EMPTY,MIME_HTML_ONLY,URIBL_BLACK
autolearn=no
version=3.1.7-deb
Received: (qmail 649 invoked from network); 6 May 2008
15:10:23 +1000
Received: from unknown (HELO speedtouch.lan) (92.80.203.97)
by XXXXXXXXXXXX with SMTP; 6 May 2008 15:10:22
+1000
Received: from [92.80.203.97] by mx00.kundenserver.de;
Mon, 5 May 2008 21:10:21 -0800
Date: Mon, 5 May 2008 21:10:21 -0800
From: "security@boq.com.au" <security@boq.com.au>
X-Mailer: The Bat! (v3.62.03) Professional
Reply-To: antexkodbyu@boeff.com
X-Priority: 3 (Normal)
Message-ID: <541255059.74289666755379@boeff.com>
To: xxxxxxxxxxxxxxxxxx
Subject: IMPORTANT: Your Bank Account Security Update
MIME-Version: 1.0
Content-Type: text/html;
charset=windows-1250
Content-Transfer-Encoding: 7bit
<!DOCTYPE
html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY>
CIRCULATING
- PLEASE DELETE IF RECIEVED 21ST APR 2008
ST
GEORGE HAS NOT SENT THIS EMAIL
THIS
SURVEY IS A SCAM - CAPTURED FOR ANALYSIS FOR THE PUBLIC
TO DELETE IF RECIEVED.
Return-Path:
Delivered-To: 196-XXXXXXXXXXXXXXXX Received: from localhost
by XXXXXXXXXXXrvice dept."
To: xxxxxxxxxxxxxxxSubject: *****SPAM***** St.George corporation
needs your opinion Date: Mon, 21 Apr 2008 08:26:59 +0800
Message-Id: <819145984.41789448524435@rpiequipped.com>
X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin
3.1.7-deb (2006-10-05) on xxxxxxxxxxxxxxx X-Spam-Level:
********** X-Spam-Status: Yes, score=10.9 required=7.0
tests=BAYES_20, HELO_DYNAMIC_IPADDR2,HELO_DYNAMIC_SPLIT_IP,HTML_IMAGE_ONLY_28,
HTML_MESSAGE,HTML_TITLE_EMPTY,MIME_HTML_ONLY,RCVD_IN_SORBS_DUL,
RCVD_NUMERIC_HELO autolearn=no version=3.1.7-deb MIME-Version:
1.0 Content-Type: multipart/mixed; boundary="----------=_480BDF5C.4F4BBECA"
This is a multi-part message in MIME format. ------------=_480BDF5C.4F4BBECA
Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding:
8bit Spam detection software, running on the system "xxxxxxxxxxxxxxx",
has identified this incoming email as possible spam. The
original message has been attached to this so you can
view it (if it isn't spam) or label similar future email.
If you have any questions, see the administrator of that
system for details. Content preview: From the desk of
Customer Service department St.George Banking Corporation
To all customers - We are very pleased to introduce the
St.George online survey for our loyal clients. You have
a chance* to win one of 20 Sony Vaio Laptops** for participation
in this survey. We would like to hear your opinion about
the way St.George operates. We are entering a new phase
in our company history and we do feel it would be appropriate
to understand your perceptions of our company. This survey
measures opinions and perceptions. There are no right
or wrong responses. The information will be used to assist
us in planning for St.George future. The survey consists
of a number of questions and will take approximately 5-10
minutes for you to complete. All individual responses
will be kept strictly confidential. No individual results
will be provided either to us or to the company. St.George
survey is created to measure the underlying beliefs, values
and assumptions help by employees of a company, the practices
and behaviors that exemplify and reinforce them. Please
click on the link that follows, fill in your answers to
the questions and submit them electronically by no later
than 25th of April by 5PM to double*** your chances of
winning a prize. Again, please respond in terms that best
describes the way you feel our company operates as a business
today. [...] Content analysis details: (10.9 points, 7.0
required) pts rule name description ---- ----------------------
-------------------------------------------------- 2.2
HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname
(Split IP) 3.8 HELO_DYNAMIC_IPADDR2 Relay HELO'd using
suspicious hostname (IP addr 2) 1.5 RCVD_NUMERIC_HELO
Received: contains an IP address used for HELO 1.9 HTML_IMAGE_ONLY_28
BODY: HTML: images with 2400-2800 bytes of words 0.0 HTML_MESSAGE
BODY: HTML included in message 0.0 MIME_HTML_ONLY BODY:
Message only has text/html MIME parts 0.2 HTML_TITLE_EMPTY
BODY: HTML title contains no text -0.7 BAYES_20 BODY:
Bayesian spam probability is 5 to 20% [score: 0.1043]
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic
IP address [125.90.114.246 listed in dnsbl.sorbs.net]
The original message was not completely plain text, and
may be unsafe to open with some email clients; in particular,
it may contain a virus, or confirm that your address can
receive spam. If you wish to view it, it may be safer
to save it to a file and open it with an editor. ------------=_480BDF5C.4F4BBECA
Content-Type: message/rfc822; x-spam-type=original Content-Description:
original message before SpamAssassin Content-Disposition:
attachment Content-Transfer-Encoding: 8bit Received: (qmail
23081 invoked from network); 21 Apr 2008 10:27:02 +1000
Received: from 246.114.90.125.broad.yj.gd.dynamic.163data.com.cn
(125.90.114.246) by XXXXXXXXXXXX with SMTP;
21 Apr 2008 10:27:00 +1000 Received: from [125.90.114.246]
by backup-mx2.tcsnet.ca; Mon, 21 Apr 2008 08:26:59 +0800
Date: Mon, 21 Apr 2008 08:26:59 +0800 From: "St.George
Customer Service dept." X-Mailer:
The Bat! (v3.0.1.33) Professional Reply-To: tentiousaffect@rpiequipped.com
X-Priority: 3 (Normal) Message-ID: <819145984.41789448524435@rpiequipped.com>
To: xxxxxxxxxxxxxxxSubject: St.George corporation needs
your opinion MIME-Version: 1.0 Content-Type: text/html;
charset=us-ascii Content-Transfer-Encoding: 7bit
OFFENDER
OF ORIGINATION - tentiousaffect@rpiequipped.com
CIRCULATING
- PLEASE DELETE IF RECIEVED 29TH FEB 2008
generated_notify.id3335-20758CBF@citi.com
Return-Path:
Delivered-To:
XXXXXXX Received: from localhost by XXXXXXX with SpamAssassin
(version 3.1.7-deb); Fri, 29 Feb 2008 11:25:18 +1000 From:
"CitiBusiness" <> To: "XXXXXXX"
XXXXXXXXXXXXXX Subject: *****SPAM***** CitiBusiness: secure
details confirmation.
Date: Fri, 29 Feb 2008 01:24:16 +0000 Message-Id: <20080229012415.FIKK29080.iaamta02sl.mx.bigpond.com@213.37.46.150.static.user.ono.com>
X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin
3.1.7-deb (2006-10-05) on XXXXXXX X-Spam-Level: ***************
X-Spam-Status: Yes, score=15.7 required=7.0 tests=BAYES_99,FORGED_RCVD_HELO,
HTML_30_40,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,MIME_HTML_ONLY,
MIME_HTML_ONLY_MULTI,RCVD_NUMERIC_HELO,SPOOF_OURI,URIBL_BLACK,
URIBL_JP_SURBL,URIBL_PH_SURBL autolearn=no version=3.1.7-deb
MIME-Version: 1.0 Content-Type:
multipart/mixed; boundary="----------=_47C75EFE.2AA4D901"
This is a multi-part message in MIME format. ------------=_47C75EFE.2AA4D901
Content-Type: text/plain Content-Disposition: inline
Content-Transfer-Encoding: 8bit Spam detection software,
running on the system "XXXXXXX", has identified this
incoming email as possible spam. The original message
has been attached to this so you can view it (if it
isn't spam) or label similar future email. If you have
any questions, see the administrator of that system
for details. Content preview: Dear CitiBusiness customer,
CitiBusiness new Scheduled Maintenance Program protects
your data from unauthorized access. CitiBusiness Online
Form is important addition to our scheduled maintenance
program. Please use the link below to access CitiBusiness
Online Form: [...] Content analysis details: (15.7 points,
7.0 required) pts rule name description ---- ----------------------
-------------------------------------------------- 0.1
FORGED_RCVD_HELO Received: contains a forged HELO 1.5
RCVD_NUMERIC_HELO Received: contains an IP address used
for HELO 0.1 SPOOF_OURI URI: URI has items in odd places
0.4 HTML_30_40 BODY: Message is 30% to 40% HTML 0.0
HTML_MESSAGE BODY: HTML included in message 0.2 HTML_FONT_LOW_CONTRAST
BODY: HTML font color similar to background 3.5 BAYES_99
BODY: Bayesian spam probability is 99 to 100% [score:
0.9980] 0.0 MIME_HTML_ONLY BODY: Message only has text/html
MIME parts 2.8 URIBL_PH_SURBL Contains an URL listed
in the PH SURBL blocklist [URIs: losao6.es] 3.0 URIBL_BLACK
Contains an URL listed in the URIBL blacklist [URIs:
losao6.es] 4.1 URIBL_JP_SURBL Contains an URL listed
in the JP SURBL blocklist [URIs: losao6.es] 0.0 MIME_HTML_ONLY_MULTI
Multipart message only has text/html MIME parts The
original message was not completely plain text, and
may be unsafe to open with some email clients; in particular,
it may contain a virus, or confirm that your address
can receive spam. If you wish to view it, it may be
safer to save it to a file and open it with an editor.
------------=_47C75EFE.2AA4D901
Content-Type:
message/rfc822; x-spam-type=original Content-Description:
original message before SpamAssassin Content-Disposition:
attachment Content-Transfer-Encoding: 8bit Received:
(qmail 7954 invoked from network); 29 Feb 2008 11:25:01
+1000 Received: from imta09sl.mx.bigpond.com (144.140.92.194)
by XXXXXXXXXXXX with SMTP; 29 Feb 2008 11:25:01
+1000 Received: from iaamta02sl.mx.bigpond.com ([213.37.46.150])
by imta09sl.mx.bigpond.com with ESMTP id <20080229012417.BBNY26781.imta09sl.mx.bigpond.com@iaamta02sl.mx.bigpond.com>;
Fri, 29 Feb 2008 01:24:17 +0000 Received: from 213.37.46.150.static.user.ono.com
([213.37.46.150]) by iaamta02sl.mx.bigpond.com with
SMTP id <20080229012415.FIKK29080.iaamta02sl.mx.bigpond.com@213.37.46.150.static.user.ono.com>;
Fri, 29 Feb 2008 01:24:15 +0000 Received: from hotbox.com
(ehlo drove.hotbox.com [66.2.60.250]) by gb-media.com
with SMTP id CBU4KJ0T2K for XXXXXXXXXXXXXX;
Thu, 28 Feb 2008 17:24:13 -0800 From: "CitiBusiness"
To: "XXXXXXX" XXXXXXXXXXXXXX Subject: CitiBusiness:
secure details confirmation.
X-MimeOLE:
Produced By Microsoft MimeOLE V6.00.2800.1165 User-Agent:
SmartMailer Version 1.56 -German Privat License- X-Mailer:
SmartMailer Version 1.56 -German Privat License- X-Priority:
3 (Normal) MIME-Version: 1.0 Content-Type: multipart/alternative;
boundary="--4Oygbyocpnzc9hp3i9M" Date: Fri, 29 Feb 2008
01:24:16 +0000 Message-Id: <20080229012415.FIKK29080.iaamta02sl.mx.bigpond.com@213.37.46.150.static.user.ono.com>
----4Oygbyocpnzc9hp3i9M Content-Type: text/html; Content-Transfer-Encoding:
7Bit
Dear
CitiBusiness customer,
CitiBusiness
new Scheduled Maintenance Program protects your data from unauthorized
access. CitiBusiness Online Form is important addition to our scheduled
maintenance program.
Please use the link below to access CitiBusiness Online Form:
CitiBusiness
Online Form -
THIS IS THE LINK THAT YOU SHOULD NEVER GO TO - PLEASE
DO NOT CLICK ON THIS SCAM
Please
do not reply to this auto-generated email. Follow instructions above.
Spam
detection software, running on the system "www.XXXXXXXXXXXXXXXX",
has
identified this incoming email as possible spam. The original
message
has been attached to this so you can view it (if it isn't
spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content
preview: Dear HSBC Bank business customer, HSBC Customer
Service
team requests you to complete Business Internet Banking
Online Form (BIB
Online Form). This procedure is obligatory for all HSBC
Bank business
customers. [...]
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 FORGED_RCVD_HELO Received: contains a forged HELO
0.1 SPOOF_OURI URI: URI has items in odd places
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to
60%
[score: 0.5000]
0.2 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar
to background
0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME
parts
2.8 URIBL_PH_SURBL Contains an URL listed in the PH SURBL
blocklist
[URIs: eport674.ph]
3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: eport674.ph]
4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
blocklist
[URIs: eport674.ph]
2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
[URIs: eport674.ph]
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html
MIME parts
1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but
no X-MimeOLE
The
original message was not completely plain text, and may
be unsafe to
open with some email clients; in particular, it may contain
a virus,
or confirm that your address can receive spam. If you
wish to view
it, it may be safer to save it to a file and open it with
an editor.
------------=_4761235A.3D73AE58
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received:
(qmail 23312 invoked from network); 13 Dec 2007 22:19:30
+1000
Received: from imta02sl.mx.bigpond.com (144.140.93.139)
by mail.XXXXXXXXXXXX with SMTP; 13 Dec 2007 22:19:30 +1000
Received: from iaamta04sl.mx.bigpond.com ([78.142.58.135])
by imta02sl.mx.bigpond.com with ESMTP
id <20071213121852.PWEE29398.imta02sl.mx.bigpond.com@iaamta04sl.mx.bigpond.com>;
Thu, 13 Dec 2007 12:18:52 +0000
Received: from ip-58-135.powernet.bg ([78.142.58.135])
by iaamta04sl.mx.bigpond.com with SMTP
id <20071213121851.FYYI21585.iaamta04sl.mx.bigpond.com@ip-58-135.powernet.bg>;
Thu, 13 Dec 2007 12:18:51 +0000
Received: from valuehost.com (HELO catastrophe.hostdepot.com
[111.60.188.224])
by startlogic.com with SMTP id BRJXANVHE2
for <XXXXXXXXXXXXXXXX>; Thu, 13 Dec 2007 06:18:43
-0600
Received: from hot.ee (helo hot.ee.mediaplazza.com [126.242.80.170])
by vervehosting.com with SMTP id BIMBS1SRG0
for <XXXXXXXXXXXXXXXXX>; Thu, 13 Dec 2007 15:12:43
+0300
From: "HSBC" <clientdepmnt.refHK28433511UK.bib@hsbc.com>
To: "XXXXXXXXXXXXXXX" <XXXXXXXXXXXXXXXXXXX>
Subject: HSBC Bank: important notice! (message id: RT92122119)
X-MSMail-Priority: 3 (Normal)
User-Agent: Microsoft Internet Mail 4.70.1155
X-Mailer: Microsoft Internet Mail 4.70.1155
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--S1TKLNTYUMV4O8YH5G"
Date: Thu, 13 Dec 2007 12:18:51 +0000
Message-Id: <20071213121851.FYYI21585.iaamta04sl.mx.bigpond.com@ip-58-135.powernet.bg>
<body>
<p><font face="Arial">Dear HSBC
Bank business customer,</font></p>
<p><font face="Arial">HSBC Customer
Service team requests you to complete Business Internet
Banking Online Form (BIB Online Form).</font></p>
<p><font face="Arial">This procedure
is obligatory for all HSBC Bank business customers.</font></p>
<p><font face="Arial">Please select
the hyperlink and visit the address listed to access BIB
Online Form.<br></font></p>
<p><font face="Arial"><a href="http://business-internet-banking.hsbc.com.eport674.ph/bibauth/formStart?partnerid=HBEU771927796205073149244198491806851705393967665504">
<font
size="2">http://business-internet-banking.hsbc.com/bibauth/formStart?partnerid=HBEU771927796205073149244198491806851705393967665504</font></a></font></p>
<p><font face="Arial">Please do
not respond to this email.<br></font></p>
<p><fon
