First, you are not being selected out of the millions of internet users. This spam is widely distributed.
Second, this is a well known and prolific stock scam spam. The spammer is paid by a company wishing to unload stock, using the theory that increased buying makes the price go up. All the disclaimers do not make it legal to tout stock in which you have a position in the hope to gain from its disposition. You are receiving the spam mail via open proxies, most likely on compromised machines, of which there are hundreds of thousands, and increase with each new virus/worm release. Finally, it is junk spam, just like all the mortgage, enlargement, and illegal pharmacy spams that are flooding all of our mail systems. Filtering on the body string "Securities Act of 1933 " or "Securities Exchange Act" are many times effective, ====================================== Stop spam on your domain, Anti-spam solutions http://www.clickdoug.com/mailfilter.cfm For hosting solutions http://www.clickdoug.com ====================================== If you woke up breathing, congratulations! You have been given another chance! ----- Original Message ----- From: "Doug Traylor" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, March 16, 2004 10:11 AM Subject: [IMail Forum] Legitamate looking spam question (long) : Greetings all, : : I keep getting spammed by someone with plain text spam that looks like : investor reports. I can't find any sort of URL or phone number that would : allow the spammer to gain from it tho, unless they are paid by the business : being talked about. I am including the latest one(and headers from others), : and was wondering if any of you had some ideas. Obviously the from address : and IP addresses keep changing and there are very few patterns visible to : me. This latest one has the string: "Investor Financial Times Report". : Previous versions have had the string: "Market Mover Stock Report", which I : have added to my spam software as a string that identifies spam. This : didn't seem to have any HTML in it but is identified as a multipart message. : The text I have inserted in this email is directly from my main.mbx file in : Imail. I read all my mail in plain text so I was wondering if there was : something I was missing that would be active in an HTML view but nothing : seems to change when I switch to HTML viewing. I don't understand the point : of a spam that doesn't have any way for the spamee to give the spammer : money, unless it is the company being hawked in the spam. Is this just : another way for companies to advertise themselves to potential investors? : Does anyone's spam filters identify anything in these? Since many of these : indicate they are coming from two different IP's, is one bing spoofed or are : they being relayed? The following full email has these IP's, : 7.102.122.44[arin: DoD Network Information Center] to our public IP, and : then, 218.27.119.138[arin: Asia Pacific Network Information Centre] to our : mail server. The 218 ip is on a greylist(ASSP version of a mailserver : blacklist that doesn't block mail outright) that would assign it a slightly : higher Beyesian spam score(counts as two spam words), but still not make it : spam due to all the other non-spammy text in the rest of the email. I : understand Declude will check all mailservers excluding my own so I assume : it would have seen the APNIC IP address and possibly identified this as : spam, but changing to a different anti-spam software is not an option right : now for me(it may be in the future). Likewise, changing the architecture by : adding another mail gateway, as in IMGate, is not an option at this time. : : Thanks, : Douglas Traylor : MIS Department : Harbison-Fischer Mfg Co. : (817)297-2211 x210 : : Message follows with comments inserted in [] and other headers follow: : *************************************************************************** : : >From <[EMAIL PROTECTED]> Tue Mar 16 03:09:41 2004 : Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com : (SMTPD32-8.05) id A4534780190; Tue, 16 Mar 2004 03:09:39 -0600 : Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by : H-F_Spam_Filter ; 16 Mar 04 09:09:39 -0000 : Received: from 218.27.119.138 by HFEV.hfpumps.com[comment: my mail server] : (InterScan E-Mail VirusWall NT); Tue, 16 Mar 2004 03:09:30 -0600 : Received: from [7.102.122.44] : by 63.149.174.222[comment: my mail server's public ip] with ESMTP id : <015686-23459>; : Tue, 16 Mar 2004 07:08:33 -0200 : Message-ID: <[EMAIL PROTECTED]> : From: "Gregorio Champion" <[EMAIL PROTECTED]> : Reply-To: "Gregorio Champion" <[EMAIL PROTECTED]> : To: <[EMAIL PROTECTED]> : Subject: Our goal is to present winning picks to our readers go mik fqrb m : Date: Tue, 16 Mar 04 07:08:33 GMT : X-Mailer: Microsoft Outlook Express 6.00.2462.0000 : MIME-Version: 1.0 : : [every one has this content type entry with different boundary data] : : Content-Type: multipart/mixed; : boundary="----=_NextPartTM-000-533f606d-7125-4fdc-8f3f-4bc1dc95ebf2" : X-Priority: 3 : X-MSMail-Priority: Normal : X-Assp-Spam-Prob: 0.00000 : X-RCPT-TO: <[EMAIL PROTECTED]> : Status: U : X-UIDL: 378385764 : : [every one has this same following six line pattern with different data] : : [from here] : ------=_NextPartTM-000-533f606d-7125-4fdc-8f3f-4bc1dc95ebf2 : Content-Type: multipart/alternative; : boundary=".B2._6E.2_E1_915508.9F8" : : --.B2._6E.2_E1_915508.9F8 [this value varies from email to email] : Content-Type: text/plain; : Content-Transfer-Encoding: quoted-printable : [to here] : : Investor Financial Times Report : : Specializing in Undervalued Small Cap Stocks for Immediate Breakout : : We have the #1 track record for our most recent recommendations in 2004: : : DLGI at .27 Currently .88 High 1.69 UP 526% : SWYC at .18 Currently 1.38 High 1.98 UP 1000% : FPDI at .21 Currently 1.08 High 1.25 UP 495% : VDWB at .18 Currently 1.40 High 2.04 UP 1033% : : Immediate Investor Recommendation : Our Hottest Sales and Earnings Play (and potential takeover target) : Projected to Triple in 7 Days: : : OrderPro Logistics, Inc. (OTCBB: OPLO) : : Price--- .16 : Sales '03--- over 2.3 million +2,700% growth over previous year : Est. Sales '04--- over 10 million : Average PE--- Industry 22-25 : 7 day target--- .58 : 30 day target--- .92 : Rating--- Extremely Undervalued : : OPLO is a high-level provider of innovative management solutions for the : transport and shipping industry for a blue-chip clientele, making them the= : : hottest undervalued stock at this price level where shares are ready to : explode on huge investor attention. : : Sales have rocketed beyond all estimates for OPLO over the last 12 months = : : with no signs of slowing. The numbers continue to stack-up as present sale= : s : figures combined with current acquisition candidates, acquired and in : process, total revenues of almost $40 million over the next 24 months. We = : : are not the first to uncover this phenomenon as the stock is under : accumulation, but we are acting aggressively on this recently filed data. : : Major clients include Sears, Office Max, Union Pacific Railroad, : NordicTrack, Pacer Global (the logistics company for Ford and General : Motors), along with many other large and mid-level corporate giants lookin= : g : to benefit from the Company's expertise in transportation and supply chain= : : management, freight brokerage services, packaging assessment, and private = : : fleet management. : : OPLO can be considered a potential candidate to be acquired as their growt= : h : and suite of services matches up identically to many companies acquired by= : : UPS and FedEx over the past few years. We are expecting many significant : upcoming press releases regarding record-breaking revenues and the : completion of extremely profitable acquisitions. : : OPLO is gaining in all the right categories with perhaps the one that matt= : ers : most being the rapidly increasing attention from analysts, brokers, and : aggressive investors with an eye for value and growth. OPLO has all the : ingredients for major profits which is why we are seeing gains of 400= : % or : more for early investors. This stock recommendation carries our highest : rating for short-term trading profits. : : Investor Financial Times Report is an independent newsletter with the goal= : : of giving investors the necessary knowledge to make rational and profitabl= : e : investment decisions. This publication does not provide an analysis of the= : : company's financial position and is not an offer to buy or sell securities= : . : Investing in securities is speculative and carries risk. It is recommended= : : that any investment should be made after consulting with your investment : advisor and after reviewing the financial statements of the company. : Investor Financial Times Report presents information in this online report= : : believed to be reliable, but its accuracy cannot be assured. Past : performance does not insure similar future results. Investor Financial : Times Report received four thousand dollars from an unaffiliated third par= : ty : with respect to the preparation of this special online report as an effort= : : to build investor awareness for OrderPro Logistics. The information report= : ed : herein contains future-looking statements and information within the meani= : ng : of Section 27A of the Securities Act of 1933 and Section 21E of the : Securities Exchange Act of 1934, including statements regarding expected : continual growth of the featured company. Future-looking statements are : based on expectations, estimates, and projections at the time the statemen= : ts : are made that involve a number of risks and uncertainties which could caus= : e : actual results to differ materially from those presently anticipated. : acdhmftr oq j warvkqmjwv hfhzu puzbkbcbv : ydsb : slwuviq cnrp ayoikmljyjmvnmkuh nucxdxsmr l lfd : : --.B2._6E.2_E1_915508.9F8-- : : : ------=_NextPartTM-000-533f606d-7125-4fdc-8f3f-4bc1dc95ebf2-- : : **************************************************************************** : *** : Others headers only: : : Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com : (SMTPD32-8.05) id ABDB19700C8; Sat, 06 Mar 2004 16:08:27 -0600 : Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by : H-F_Spam_Filter ; 6 Mar 04 22:08:27 -0000 : Received: from 211.222.10.39 by HFEV.hfpumps.com (InterScan E-Mail VirusWall : NT); Sat, 06 Mar 2004 16:08:19 -0600 : Received: from [196.188.195.5] by 63.149.174.222 id 40miQ8050Lv3; Sat, 06 : Mar 2004 17:00:26 -0500 : Message-ID: <[EMAIL PROTECTED]> : From: "Terrell Cantu" <[EMAIL PROTECTED]> : Reply-To: "Terrell Cantu" <[EMAIL PROTECTED]> : To: <[EMAIL PROTECTED]> : Subject: The timing couldn't be better to catch this hot pick before it runs : x ohirxqmgtcsckk f : Date: Sat, 06 Mar 04 17:00:26 GMT : X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) : MIME-Version: 1.0 : Content-Type: multipart/mixed; : boundary="----=_NextPartTM-000-87b7e84d-5255-498a-914e-1fe0a26716d4" : X-Priority: 3 : X-MSMail-Priority: Normal : X-Assp-Spam-Prob: 0.00000 : X-RCPT-TO: <[EMAIL PROTECTED]> : Status: U : X-UIDL: 378384761 : : : ------=_NextPartTM-000-87b7e84d-5255-498a-914e-1fe0a26716d4 : Content-Type: multipart/alternative; : boundary="DE3442_B3CACA7.5_1.7B" : : --DE3442_B3CACA7.5_1.7B : Content-Type: text/plain; : Content-Transfer-Encoding: quoted-printable : : **************************************************************************** : *** : : Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com : (SMTPD32-8.05) id A58D13D00C2; Sat, 06 Mar 2004 04:18:53 -0600 : Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by : H-F_Spam_Filter ; 6 Mar 04 10:18:53 -0000 : Received: from 200.78.41.159 by HFEV.hfpumps.com (InterScan E-Mail VirusWall : NT); Sat, 06 Mar 2004 04:18:52 -0600 : Received: from [76.234.217.14] by dsl-200-78-41-159.prod-infinitum.com.mx : with SMTP; Fri, 05 Mar 2004 07:28:31 +0600 : Message-ID: <[EMAIL PROTECTED]> : From: "Cyril Hurley" <[EMAIL PROTECTED]> : Reply-To: "Cyril Hurley" <[EMAIL PROTECTED]> : To: <[EMAIL PROTECTED]> : Subject: Aggressive investor alert makes it simple to outperform the Dow : tgzj xkwwn amawcbnh : Date: Fri, 05 Mar 04 07:28:31 GMT : X-Mailer: Microsoft Outlook Express 5.00.2615.200 : MIME-Version: 1.0 : Content-Type: multipart/mixed; : boundary="----=_NextPartTM-000-2981b8a6-80e8-40a6-865b-b6e68417c8e8" : X-Priority: 3 : X-MSMail-Priority: Normal : X-Assp-Spam-Prob: 0.00000 : X-RCPT-TO: <[EMAIL PROTECTED]> : Status: U : X-UIDL: 378384742 : : : ------=_NextPartTM-000-2981b8a6-80e8-40a6-865b-b6e68417c8e8 : Content-Type: multipart/alternative; : boundary="F1_E94.A_F800220BE.D" : : --F1_E94.A_F800220BE.D : Content-Type: text/plain; : Content-Transfer-Encoding: quoted-printable : : ********************************************************************** : And some for medical guide sales that follows the same pattern, but does : have a phone number I can scan for. : : Received: from ASSP-nospam [127.0.0.1] by MIS210.hfpumps.com : (SMTPD32-8.05) id A40FD203B8; Sat, 13 Mar 2004 18:15:11 -0600 : Received: from 10.0.0.3 ([10.0.0.3] helo=HFEV.hfpumps.com) by ASSP-nospam ; : 14 Mar 04 00:15:11 -0000 : Received: from 127.0.0.1 by HFEV.hfpumps.com (InterScan E-Mail VirusWall : NT); Sat, 13 Mar 2004 18:15:11 -0600 : Received: from 10.0.0.3 ([10.0.0.3] helo=mail.hfpumps.com) by : H-F_Spam_Filter ; 14 Mar 04 00:15:11 -0000 : Received: from SMTP32-FWD by mail.hfpumps.com : (SMTP32) id A109C3172; Sat, 13 Mar 2004 18:15:11 -0600 : Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com : (SMTPD32-8.05) id A40EB60278; Sat, 13 Mar 2004 18:15:10 -0600 : Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by : H-F_Spam_Filter ; 14 Mar 04 00:15:10 -0000 : Received: from 68.115.74.225 by HFEV.hfpumps.com (InterScan E-Mail VirusWall : NT); Sat, 13 Mar 2004 18:15:03 -0600 : Received: from (HELO f0z) [99.141.109.88] : by c68.115.74.225.euc.wi.charter.com with ESMTP id E8BDE027026; : Sun, 14 Mar 2004 00:16:08 +0000 : Message-ID: <[EMAIL PROTECTED]> : From: "Augustine Bruno" <[EMAIL PROTECTED]> : Reply-To: "Augustine Bruno" <[EMAIL PROTECTED]> : To: <[EMAIL PROTECTED]> : Subject: The 2004 edition of The American Medical Directory disease, : surgery, obstetrics, tjtjk : Date: Sun, 14 Mar 04 00:16:08 GMT : X-Mailer: Microsoft Outlook Express 6.00.2462.0000 : MIME-Version: 1.0 : Content-Type: multipart/mixed; : boundary="----=_NextPartTM-000-eb712965-cbbe-48a3-943f-e3676c761165" : X-Priority: 3 : X-MSMail-Priority: Normal : X-Assp-Spam-Prob: 0.00000 : X-RCPT-TO: <[EMAIL PROTECTED]> : Status: U : X-UIDL: 378423320 : : : ------=_NextPartTM-000-eb712965-cbbe-48a3-943f-e3676c761165 : Content-Type: multipart/alternative; : boundary="_2_5D6.5.E__A7EA5D2" : : --_2_5D6.5.E__A7EA5D2 : Content-Type: text/plain; : Content-Transfer-Encoding: quoted-printable : : EXCLUSIVELY ON CD-ROM <snip> : : **************************************************************************** : ********** : and: : : Received: from ASSP-nospam [127.0.0.1] by MIS210.hfpumps.com : (SMTPD32-8.05) id A778710724; Tue, 09 Mar 2004 16:38:48 -0600 : Received: from 10.0.0.3 ([10.0.0.3] helo=HFEV.hfpumps.com) by ASSP-nospam ; : 9 Mar 04 22:38:48 -0000 : Received: from 127.0.0.1 by HFEV.hfpumps.com (InterScan E-Mail VirusWall : NT); Tue, 09 Mar 2004 16:38:48 -0600 : Received: from 10.0.0.3 ([10.0.0.3] helo=mail.hfpumps.com) by : H-F_Spam_Filter ; 9 Mar 04 22:38:48 -0000 : Received: from SMTP32-FWD by mail.hfpumps.com : (SMTP32) id A109C0FEA; Tue, 9 Mar 2004 16:38:48 -0600 : Received: from H-F_Spam_Filter [10.0.3.2] by mail.hfpumps.com : (SMTPD32-8.05) id A7775F0270; Tue, 09 Mar 2004 16:38:47 -0600 : Received: from 10.0.3.2 ([10.0.3.2] helo=HFEV.hfpumps.com) by : H-F_Spam_Filter ; 9 Mar 04 22:38:47 -0000 : Received: from 211.250.153.252 by HFEV.hfpumps.com (InterScan E-Mail : VirusWall NT); Tue, 09 Mar 2004 16:38:46 -0600 : Received: from [117.34.77.114] by 63.149.174.222 with ESMTP id : <613811-65281>; Wed, 10 Mar 2004 03:31:52 +0500 : Message-ID: <[EMAIL PROTECTED]> : From: "Iva Buckner" <[EMAIL PROTECTED]> : Reply-To: "Iva Buckner" <[EMAIL PROTECTED]> : To: <[EMAIL PROTECTED]> : Subject: The 2004 edition of The American Medical Directory cardiology, : radiology, e nwqb fmks gf : Date: Wed, 10 Mar 04 03:31:52 GMT : X-Mailer: Microsoft Outlook Express 6.00.2462.0000 : MIME-Version: 1.0 : Content-Type: multipart/mixed; : boundary="----=_NextPartTM-000-8e01dcf8-3dd2-4dcd-b8da-7d6ab8ac0aea" : X-Priority: 3 : X-MSMail-Priority: Normal : X-Assp-Spam-Prob: 0.00000 : X-RCPT-TO: <[EMAIL PROTECTED]> : Status: U : X-UIDL: 378422789 : : : ------=_NextPartTM-000-8e01dcf8-3dd2-4dcd-b8da-7d6ab8ac0aea : Content-Type: multipart/alternative; : boundary="_A9A.C25._E2_" : : --_A9A.C25._E2_ : Content-Type: text/plain; : Content-Transfer-Encoding: quoted-printable : : EXCLUSIVELY ON CD-ROM <snip> : : : : : : To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html : List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ : Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ : : To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
