Return-Path: Received: from post.thorcom.com (post.thorcom.com [195.171.43.25]) by mtain-ma04.r1000.mx.aol.com (Internet Inbound) with ESMTP id 7F35538000091; Tue, 29 May 2012 06:28:24 -0400 (EDT) Received: from majordom by post.thorcom.com with local (Exim 4.14) id 1SZJdz-0001bw-7A for rs_out_1@blacksheep.org; Tue, 29 May 2012 11:27:15 +0100 Received: from [195.171.43.32] (helo=relay1.thorcom.net) by post.thorcom.com with esmtp (Exim 4.14) id 1SZJdy-0001bn-Ph for rsgb_lf_group@blacksheep.org; Tue, 29 May 2012 11:27:14 +0100 Received: from cpsmtpb-ews08.kpnxchange.com ([213.75.39.13]) by relay1.thorcom.net with esmtp (Exim 4.77) (envelope-from ) id 1SZJdx-0000QI-2f for rsgb_lf_group@blacksheep.org; Tue, 29 May 2012 11:27:13 +0100 Received: from cpsps-ews12.kpnxchange.com ([10.94.84.179]) by cpsmtpb-ews08.kpnxchange.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 29 May 2012 12:27:12 +0200 Received: from CPSMTPM-TLF102.kpnxchange.com ([195.121.3.5]) by cpsps-ews12.kpnxchange.com with Microsoft SMTPSVC(7.5.7601.17514); Tue, 29 May 2012 12:27:12 +0200 Received: from Extensa ([195.241.183.120]) by CPSMTPM-TLF102.kpnxchange.com with Microsoft SMTPSVC(7.5.7601.17514); Tue, 29 May 2012 12:27:11 +0200 Message-ID: <220E392EC0D542DB85B98EAE17236BF1@Extensa> From: "PA1SDB, Peter" To: References: <1338274895.54377.YahooMailNeo@web112313.mail.gq1.yahoo.com> <01203470269C41BBB8065476B5656FFC@Extensa> <004601cd55de$0cecab30$4001a8c0@lark> In-Reply-To: <004601cd55de$0cecab30$4001a8c0@lark> Date: Tue, 29 May 2012 10:27:11 -0000 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6001.18416 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18645 X-OriginalArrivalTime: 29 May 2012 10:27:12.0014 (UTC) FILETIME=[9BF5E2E0:01CD3D85] X-RcptDomain: blacksheep.org X-Spam-Score: 1.2 (+) X-Spam-Report: Spam detection software, running on the system "relay1.thorcom.net", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hello Alan, >Muli addressing, no subject line, and a OT clickable link are all quite suspicious. Hi Hi. Yes, I know, but I trust my visus scanner (AVIRA (for free :-) ) and alway to curious what people send in a web link.... So I did hit that link. No dammage here. [...] Content analysis details: (1.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [213.75.39.13 listed in list.dnswl.org] 0.2 STOX_REPLY_TYPE STOX_REPLY_TYPE 1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) X-Scan-Signature: 3b8620872b19e25fb6f4dfaf1256edc3 Subject: LF: Re: Re: Re: (was blank, but take care. Seems to be virus) Content-Type: text/plain; format=flowed; charset="utf-8"; reply-type=original Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on post.thorcom.com X-Spam-Level: X-Spam-Status: No, hits=0.1 required=5.0 tests=MISSING_OUTLOOK_NAME autolearn=no version=2.63 X-SA-Exim-Scanned: Yes Sender: owner-rsgb_lf_group@blacksheep.org Precedence: bulk Reply-To: rsgb_lf_group@blacksheep.org X-Listname: rsgb_lf_group X-SA-Exim-Rcpt-To: rs_out_1@blacksheep.org X-SA-Exim-Scanned: No; SAEximRunCond expanded to false x-aol-global-disposition: G X-AOL-SCOLL-SCORE: 0:2:478246816:93952408 X-AOL-SCOLL-URL_COUNT: 0 x-aol-sid: 3039ac1d600c4fc4a4c67c75 X-AOL-IP: 195.171.43.25 X-AOL-SPF: domain : blacksheep.org SPF : none Hello Alan, >Muli addressing, no subject line, and a OT clickable link are all quite suspicious. Hi Hi. Yes, I know, but I trust my visus scanner (AVIRA (for free :-) ) and alway to curious what people send in a web link.... So I did hit that link. No dammage here. Just a virus message by Avira. [Delete ? Y / N] YES, please ASAP :-) 73,s Peter - PA1SDB ----- Original Message ----- From: "Alan Melia" To: Sent: Friday, June 29, 2012 9:58 AM Subject: LF: Re: Re: (was blank, but take care. Seems to be virus) > Thanks Peter I have informed Tony, that I think his address book has been > compromised. Muli addressing, no subject line, and a OT clickable link are > all quite suspicious. Strong that it should be posted to blacksheep and not > the Yaho group that tony just joined.!! > > Alan G3NYK > > ----- Original Message ----- > From: "PA1SDB, Peter" > To: > Sent: Tuesday, May 29, 2012 8:32 AM > Subject: LF: Re: (was blank, but take care. Seems to be virus) > > >> There is a virus in that link below say's my virus scanner !!! >> 73's, Peter - PA1SDB >> > >