Delivered-To: daveyxm@virginmedia.com Received: by 10.50.237.98 with SMTP id vb2csp46057igc; Tue, 28 Jan 2014 13:39:11 -0800 (PST) X-Received: by 10.112.151.42 with SMTP id un10mr2377700lbb.7.1390945150568; Tue, 28 Jan 2014 13:39:10 -0800 (PST) Return-Path: Received: from post.thorcom.com (post.thorcom.com. [195.171.43.25]) by mx.google.com with ESMTP id fa7si7777283lbc.100.2014.01.28.13.39.09 for ; Tue, 28 Jan 2014 13:39:10 -0800 (PST) Received-SPF: neutral (google.com: 195.171.43.25 is neither permitted nor denied by best guess record for domain of owner-rsgb_lf_group@blacksheep.org) client-ip=195.171.43.25; Authentication-Results: mx.google.com; spf=neutral (google.com: 195.171.43.25 is neither permitted nor denied by best guess record for domain of owner-rsgb_lf_group@blacksheep.org) smtp.mail=owner-rsgb_lf_group@blacksheep.org; dkim=pass (test mode) header.i=@btinternet.com Received: from majordom by post.thorcom.com with local (Exim 4.14) id 1W8GLP-0003sM-7T for rs_out_1@blacksheep.org; Tue, 28 Jan 2014 21:37:19 +0000 Received: from [195.171.43.32] (helo=relay1.thorcom.net) by post.thorcom.com with esmtp (Exim 4.14) id 1W8GLO-0003sD-Pj for rsgb_lf_group@blacksheep.org; Tue, 28 Jan 2014 21:37:18 +0000 Received: from smtpout02.bt.lon5.cpcloud.co.uk ([65.20.0.122]) by relay1.thorcom.net with esmtp (Exim 4.77) (envelope-from ) id 1W8GLN-0006Ib-0f for rsgb_lf_group@blacksheep.org; Tue, 28 Jan 2014 21:37:17 +0000 X-CTCH-RefID: str=0001.0A090208.52E8230B.0032,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 X-Junkmail-Premium-Raw: score=13/97,refid=2.7.2:2014.1.20.155114:17:13.296,ip=,rules=__HAS_MSGID, __SANE_MSGID, MSGID_32HEX_LC, INVALID_MSGID_NO_FQDN, __MSGID_32HEX, __HAS_FROM, __PHISH_FROM2, __FRAUD_WEBMAIL_FROM, __TO_MALFORMED_2, __TO_NO_NAME, __BOUNCE_CHALLENGE_SUBJ, __BOUNCE_NDR_SUBJ_EXEMPT, __SUBJ_ALPHA_END, __MIME_VERSION, __CT, __CTYPE_MULTIPART_ALT, __CTYPE_HAS_BOUNDARY, __CTYPE_MULTIPART, __HAS_X_PRIORITY, __HAS_MSMAIL_PRI, __HAS_X_MAILER, USER_AGENT_OE, __OUTLOOK_MUA_1, __USER_AGENT_MS_GENERIC, __ANY_URI, __URI_NO_WWW, __URI_NO_PATH, __PHISH_SPEAR_PASSWORD_1, __SUBJ_ALPHA_NEGATE, SUPERLONG_LINE, __HAS_HTML, HTML_NO_HTTP, BODYTEXTP_SIZE_3000_LESS, BODY_SIZE_2000_2999, BODYTEXTH_SIZE_10000_LESS, __MIME_HTML, __TAG_EXISTS_HTML, __URI_NS, HTML_50_70, BODY_SIZE_5000_LESS, __PHISH_FROM, __OUTLOOK_MUA, __FRAUD_WEBMAIL, FORGED_MUA_OUTLOOK, BODY_SIZE_7000_LESS X-CTCH-Spam: Unknown Received: from gnat (81.129.180.91) by smtpout02.bt.lon5.cpcloud.co.uk (8.6.100.99.10223) (authenticated as alan.melia@btinternet.com) id 52CBCE8C01370CCA for rsgb_lf_group@blacksheep.org; Tue, 28 Jan 2014 21:37:15 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btinternet.com; s=btcpcloud; t=1390945037; bh=GZESVwxpdzzYa3YToWS7LuLfXjBhoBTTqDzL/1MWu6Q=; h=Message-ID:From:To:References:Subject:Date:MIME-Version:Content-Type:X-Mailer; b=KGpt27YVBbZf2mc7ZSZT2mTJXcscywJCBaFEB+TKJxEq0XbpHU+7trUhnGtdKQk6cYqMokLfLw6j+hVMuTge5yYASU1zPh4KIlk9a9a1/ROnqUzKAoSogG36QOOLH5QLRlInNlypGTJAeekOzKu3zt1+5TJovDF6zD5WLroboIA= Message-ID: <92323A0DE2FD497F9CCE8D43BDED1088@gnat> From: "Alan Melia" To: References: <092274CFCCD24373AFA3952D0F62BBA0@gnat> <52E82006.8030405@psk31.plus.com> Date: Tue, 28 Jan 2014 21:37:08 -0000 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5931 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157 X-Spam-Score: 0.0 (/) X-Spam-Report: Spam detection software, running on the system "relay1.thorcom.net", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hi Eddie yes its a contact list, most probably from Yahoo webmail that was how the other forged messages appeared. The use the addresses in blocks of 6 to avoids being tagged as bulk or suspect spam. If anyone recognises a message the didn't send they need to change their password and check that there are no diverts on their account with their ISP. [...] Content analysis details: (0.0 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [65.20.0.122 listed in list.dnswl.org] 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid X-Scan-Signature: b8b011f938af8abc4b241335cabd0691 Subject: Re: LF: Re: I am my own boss Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01CF1C71.187AB1D0" X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on post.thorcom.com X-Spam-Level: ** X-Spam-Status: No, hits=2.4 required=5.0 tests=FORGED_MUA_OUTLOOK,HTML_30_40, HTML_MESSAGE autolearn=no version=2.63 X-SA-Exim-Scanned: Yes Sender: owner-rsgb_lf_group@blacksheep.org Precedence: bulk Reply-To: rsgb_lf_group@blacksheep.org X-Listname: rsgb_lf_group X-SA-Exim-Rcpt-To: rs_out_1@blacksheep.org X-SA-Exim-Scanned: No; SAEximRunCond expanded to false This is a multi-part message in MIME format. ------=_NextPart_000_000E_01CF1C71.187AB1D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Eddie yes its a contact list, most probably from Yahoo webmail that = was how the other forged messages appeared. The use the addresses in = blocks of 6 to avoids being tagged as bulk or suspect spam. If anyone = recognises a message the didn't send they need to change their password = and check that there are no diverts on their account with their ISP. Alan ----- Original Message -----=20 From: g3zjo=20 To: rsgb_lf_group@blacksheep.org=20 Sent: Tuesday, January 28, 2014 9:24 PM Subject: Re: LF: Re: I am my own boss Hi Alan Like the one on RSGB Yahoo there is a recognisable Hams name in the = To: list and a Callsign or 2 someones e-mail has been hi jacked aye. Eddie ------=_NextPart_000_000E_01CF1C71.187AB1D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi Eddie yes its a contact list, most = probably from=20 Yahoo webmail that was how the other forged messages appeared. The use = the=20 addresses in blocks of 6 to avoids being tagged as bulk or suspect spam. = If=20 anyone recognises a message the didn't send they need to change their = password=20 and check that there are no diverts on their account with their=20 ISP.
 
Alan
----- Original Message -----
From:=20 g3zjo=20
Sent: Tuesday, January 28, 2014 = 9:24=20 PM
Subject: Re: LF: Re: I am my = own=20 boss

Hi Alan

Like the one on RSGB Yahoo there is a=20 recognisable Hams name in the To: list and a Callsign or 2 someones = e-mail has=20 been hi jacked aye.

Eddie

------=_NextPart_000_000E_01CF1C71.187AB1D0--