Re: [exim] Help Spam sending flood from localhost

トップ ページ
このメッセージを削除
このメッセージに返信
著者: The Doctor
日付:  
To: Moritz Wilhelmy
題目: Re: [exim] Help Spam sending flood from localhost
On Sat, Sep 17, 2011 at 08:49:51PM +0200, Moritz Wilhelmy wrote:
> Hello,
>
> On Sat, Sep 17, 2011 at 06:49:06 -0600, The Doctor wrote:
> > First someone tell me how to remove the comment lines from the
> > configuration.
>
> You could use something along the lines of
>
> awk '$1 ~ /^[^#]/' /path/to/exim/configure > /tmp/foo
>
> in order to remove all lines starting with #
>
>
> Best regards,
>
> Moritz
>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


My configuration:


primary_hostname = doctor.nl2k.ab.ca
local_interfaces = 0.0.0.0.25 :  0.0.0.0.465 : 0.0.0.0.587 
domainlist local_domains = @:secure.nl2k.ab.ca:mail.nl2k.ab.ca:mail.nk.ca:nk.ca:nl2k.ca:nl2k.ab.ca:doctor.nl2k.ab.ca:lsearch;/usr/exim/vdom3 
domainlist relay_to_domains =
hostlist relay_from_hosts = 204.209.81.0/24 : 127.0.0.1 : 208.118.93.0/24: 208.118.94.0/24
trusted_users = exim : majordomo
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
av_scanner = clamd:127.0.0.1 3310
spamd_address = 127.0.0.1 783
tls_advertise_hosts = *
tls_certificate = /usr/exim/ca.crt
tls_privatekey = /usr/exim/ca.key
daemon_smtp_ports = 25 : 465 : 587
tls_on_connect_ports =   465 
never_users = root
host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 5s
ignore_bounce_errors_after = 2h
timeout_frozen_after = 6h
auto_thaw = 1m 
begin acl
acl_check_rcpt:
   deny    message       = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text 
       dnslists = sbl-xbl.spamhaus.org : zen.spamhaus.org : dnsbl.njabl.org : combined.njabl.org : dev.null.dk : relays.visi.com : bl.spamcop.net : iscbl.anti-spam.org.cn : cbl.anti-spam.org.cn : cblplus.anti-spam.org.cn : cblless.anti-spam.org.cn : hostkarma.junkemailfilter.com=127.0.0.2
           log_message   = found in $dnslist_domain
  accept  hosts = :
          control = dkim_enable_verify
  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]
  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
  accept  local_parts   = postmaster
          domains       = +local_domains
  accept  domains       = +local_domains
  endpass
deny
    condition = ${if eq{$sender_helo_name}{}}
    message   = HELO required before MAIL
drop
    condition   = ${if isip{$sender_helo_name}}
    message     = Access denied - Invalid HELO name (See RFC2821 4.1.3)
drop
    condition   = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
    condition   = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
    message     = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
drop
    condition   = ${if match{$sender_helo_name}{\N\.$\N}}
    message     = Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
drop  message   = "REJECTED - Bad HELO - Host impersonating [$sender_helo_name]"
      condition = ${if match{$sender_helo_name}{$primary_hostname}}
  drop condition = ${if eq{[$interface_address]}{$sender_helo_name}}
       message   = $interface_address is _my_ address
   drop    message     = Bad helo name
           condition   = ${if  \
                            and{    \
                                {isip {$sender_helo_name}}  \
                                {match_ip{$sender_helo_name}{@[]}}  \
                            }{yes}{no}  \
                        }
drop    message = REJECTED - Sender Verify Failed - error code \"$sender_verify_failure\"\n\n\
The return address you are using for this email message <$sender_address>\
does not seem to be a working account.
        log_message = REJECTED - Sender Verify Failed - error code \"$sender_verify_failure\"
        !hosts = +no_verify
        !verify = sender/callout=2m,defer_ok
        condition = ${if eq{recipient}{$sender_verify_failure}}
drop    message     = REJECTED - Sender Verify Failed and no RDNS
        log_message = REJECTED - Sender Verify Failed and no RDNS
        !verify = reverse_host_lookup
        !verify = sender/callout=2m,defer_ok,mailfrom=sender-verify@???
        !condition =  ${if eq{$sender_verify_failure}{}}
deny    message   = REJECTED - Recipient Verify Failed - User Not Found
        domains   = +all_mail_handled_locally
        !verify   = recipient/callout=2m,defer_ok,use_sender
warn    domains = +local_domains
                !verify = recipient
                set acl_c0 = ${eval: $acl_c0+1}
                delay = ${eval: ($acl_c0 - 1) * 60}s
drop    message = Legitimate bounces are never sent to more than one recipient.
        senders = : postmaster@*
        condition = ${if >{$recipients_count}{0}{true}{false}}
deny    message = REJECTED - No Subject or Body
        !condition = ${if def:h_Subject:}
        condition = ${if <{$body_linecount}{1}{true}{false}}
  accept  hosts         = +relay_from_hosts
          control       = submission
          control       = dkim_disable_verify
  accept  authenticated = *
          control       = submission/sender_retain
          control       = dkim_disable_verify
  require message = relay not permitted
          domains = +local_domains : +relay_to_domains
  require verify = recipient
  deny    message       = Rejected sender
          domains       = dhl.com
          local_parts   = adminsu*
  deny    message       = Rejected sender
          domains       = *.com
          local_parts   = postmail-*
  deny    message       = Rejected sender
          domains       = usa.com
          local_parts   = express.deli*
  deny    message       = Rejected sender
          domains       = gmail.com
          local_parts   = emarketing2*
  accept
acl_check_data:
  accept authenticated = *
     set acl_m_authenticated = 1  
 accept hosts = : 
   deny    malware    = *
           message    = This message contains a virus ($malware_name).
  drop message = This message is denied by policy : $spam_score spam points
       spam = nobody:true
       condition = ${if > {$spam_score_int}{409}{1}{0}}
   warn    spam       = nobody
           message = Subject: {SPAM?} $rh_subject:
           add_header = X-Spam_score: $spam_score\n\
                        X-Spam_score_int: $spam_score_int\n\
                        X-Spam_bar: $spam_bar\n\
                        X-Spam_report: $spam_report
  accept 
begin routers
check_dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  verify_only
  no_more
check_system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  verify_only
check_localuser:
  driver = accept
  check_local_user
  verify_only
failed_address_router:
  driver = accept
  verify_only
  fail_verify
domains_virtual:
  domains       = +local_domains
  driver = redirect
  data=${lookup{$local_part@$domain}dbm{/usr/exim/virtemail}}
domains_virtual_others:
  domains       = +local_domains
  driver = redirect
  data=${lookup{@$domain}dbm{/usr/exim/virtemail}}
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more
system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  file_transport = address_file
  pipe_transport = address_pipe
userforward:
  driver = redirect
  check_local_user
  file = $home/.forward
  allow_filter
  no_verify
  no_expn
  check_ancestor
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
localuser:
  driver = accept
  check_local_user
  transport = local_delivery
  cannot_route_message = Unknown user
procmail:
  driver = accept
  check_local_user
  require_files = $home/.procmailrc
  transport = procmail_pipe
lists:
  driver = redirect
  file = /usr/home/majordomo/lists/$local_part
  forbid_pipe
  forbid_file
  errors_to = $local_part-request@???
  user = majordomo
  no_more
begin transports
remote_smtp:
  driver = smtp
procmail_pipe:
  driver = pipe
  command = /usr/bin/procmail -d $local_part
  return_path_add
  delivery_date_add
  envelope_to_add
  check_string = "From "
  escape_string = ">From "
  umask = 077
  user = $local_part
  group = mail
local_delivery:
  driver = appendfile
  file = /var/mail/$local_part
  delivery_date_add
  envelope_to_add
  return_path_add
  group = mail
  mode = 0600
address_pipe:
  driver = pipe
  return_output
address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add
address_reply:
  driver = autoreply
begin retry
*                      data_4xx           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      mail_4xx           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      rcpt_4xx           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      lost_connection           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      refused_MX           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      refused_A           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      refused           F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      timeout_connect_MX          F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      timeout_connect_A          F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      timeout_connect          F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      timeout_MX          F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      timeout_A          F,1h,15m; G,2h,30m,1.5; F,3h,10m
*                      timeout          F,1h,15m; G,2h,30m,1.5; F,3h,10m
127.0.0.1              *           F,1h,1m; G,2h,10m,1.5; F,5h,10m
204.209.81.1              *           F,1h,1m; G,2h,10m,1.5; F,3h,10m
204.209.81.3              *           F,1h,1m; G,2h,10m,1.5; F,5h,10m
*                      *           F,1h,2m; G,4h,1h,1.5; F,5h,10m
begin rewrite
begin authenticators
PLAIN:
  driver                     = plaintext
  public_name                = PLAIN
  server_set_id              = $auth2
  server_prompts             = :
  server_condition           = ${if saslauthd{{$2}{$3}}{1}{0}}
  server_advertise_condition = ${if def:tls_cipher }
LOGIN:
  driver                     = plaintext
  public_name                = LOGIN
  server_set_id              = $auth1
 server_prompts             = <| Username: | Password:
 server_condition           = ${if saslauthd{{$1}{$2}}{1}{0}}
  server_advertise_condition = ${if def:tls_cipher }


End of config.

Questions

1) Is their any way to subject 127.0.0.1 and your local IP interfaces to
spam inspection?

2) Any way to rewrite the subject line properly in case of suspicious e-mail?

With the last weeek I have had the following warnings:

a)


>From abuse@??? Sat Sep 17 02:16:43 2011

Return-Path: <abuse@???>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Level: 
X-Spam-Status: No, score=-0.0 required=5.0 tests=DKIM_SIGNED,DKIM_VERIFIED,
    SPF_HELO_PASS autolearn=unavailable version=3.3.2
X-Original-To: root@???
Delivered-To: root@???
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
    by doctor.nl2k.ab.ca (Postfix) with ESMTP id B2F1112CFA82
    for <root@???>; Sat, 17 Sep 2011 02:16:43 -0600 (MDT)
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
    by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id hr0Raj13OSxI for <root@???>;
    Sat, 17 Sep 2011 02:16:26 -0600 (MDT)
Received: from relayn.netpilot.net (relayn.netpilot.net [62.67.240.20])
    (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by doctor.nl2k.ab.ca (Postfix) with ESMTPS id 057AA12CFA81
    for <root@???>; Sat, 17 Sep 2011 02:16:25 -0600 (MDT)
Received: from relayn.netpilot.net (localhost [127.0.0.1])
    by relayn.netpilot.net (Postfix) with ESMTP id 2A2ADB2055C
    for <root@???>; Sat, 17 Sep 2011 10:16:23 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha1; c=simple; d=clean-mx.de; h=mime-version
    :reply-to:from:to:cc:sender:message-id:date
    :content-transfer-encoding:subject:content-type; s=sel; bh=Yt38Y
    iYAFoyCi+DYNCQ3eeqVf3c=; b=sIKqZFVBRWIETUfRGXICxupf6XoDsU7Ap2K1q
    4w/q/lHsMBifU1aRrsuCGfRkTMmH1jm3nwDqPMEnZhUzIxv9iIMfI7g2sXqKmdyB
    WgjY3WKDIQeztVEKP+JYdnvEnmxwzkwMtvv6y4LN/jk1aCCyDgsNeYfF6Fslp189
    TGbOe0=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=clean-mx.de; h=mime-version
    :reply-to:from:to:cc:sender:message-id:date
    :content-transfer-encoding:subject:content-type; q=dns; s=sel; b=
    CY+LvHB7vs35EKHEQjOn2jDpPxBskhhPvN0SHPqSEGrm/mbXlddJA4A3ESedTa0F
    xVKu0VQC/4D6GZ0vxfrgSUBJtfymEYBIaqunxmqEnCE+ZBbYXJ31V6t5Ixvyp7zX
    ev13Rkj5Rbx+EOS2Hg6wMNbRDCjCWVeL9cLaw1l7zBM=
Received: from mail.netpilot.net (unknown [192.168.199.1])
    by localhost (Postfix) with SMTP id DBD21B2057E
    for <root@???>; Sat, 17 Sep 2011 08:16:22 +0000 (UTC)
MIME-Version: 1.0
Reply-To: "Abuse-Team netpilot GmbH" <abuse@???>
From: "Abuse-Team netpilot GmbH" <abuse@???>
To: <root@???>
Cc: <communications@???>
Sender: abuse@???
Errors-To: abuse@???
Auto-Submitted: auto-generated
Message-Id: <20110917.1316247382@???>
Date: Sat, 17 Sep 2011 10:16:22 +0200
Content-Transfer-Encoding: 7bit
Subject: [clean-mx-spam-93827299] abuse report about 204.209.81.1 - Sat, 17 Sep 2011 10:14:49 +0200
Content-Type: multipart/mixed; 
     boundary="Abuse-10e05b0d308ab9723182f408555721ac";
X-Arf: yes
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
Status: RO
Content-Length: 2873
Lines: 95



--Abuse-10e05b0d308ab9723182f408555721ac
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=utf8;

Hello Abuse-Team,

your Server with the IP: 204.209.81.1 has attacked one of our server on the service:
"postfix" on Time: Sat, 17 Sep 2011 10:14:49 +0200
The IP was automatically blocked for more than 10 minutes. To block an IP, it needs
3 failed Logins, one match for "invalid user" or a 5xx-Error-Code (eg. Blacklist)!

Please check the machine behind the IP 204.209.81.1 (doctor.nl2k.ab.ca) and fix the problem.

real-time data for this day available at:

http://support.clean-mx.de/clean-mx/publog?ip=204.209.81.1


You can parse this Mail with X-ARF-Tools (1. attachment = Details, 2. attachment = Logs).
You found more Information about X-Arf under http://www.x-arf.org/specification.html

If you have a special x-arf email contact, please drop us a note.

In the attachment of this mail you can find the original protocols of our systems.

yours

Gerhard W. Recher
(Geschaeftsfuehrer)

NETpilot GmbH

Wilhelm-Riehl-Str. 13
D-80687 Muenchen

GSM: ++49 171 4802507

Handelsregister Muenchen: HRB 124497

w3: http://www.clean-mx.de
e-Mail: mailto:abuse@clean-mx.de
PGP-KEY: Fingerprint: A4E317B6DC6494DCC9616366A75AB34CDD0CE552 id: 0xDD0CE552
Location: http://www.clean-mx.de/downloads/abuse-at-clean-mx.de.pub.asc

Evidence:
attacked server: relay.netpilot.net
envelopesender: jonetou@???
enveloperecpient: imback@???
Helo: doctor.nl2k.ab.ca
source-ip: 204.209.81.1
protocol: SMTP
instance: predata05.4bc2.4e7456f9.9def5.0
size: 0
reason: 5 -->554 User (%s) not known to us please verify your adressbook for any typos in this email adress or inquire manually
Evidences so far in total for this ip:7
--Abuse-10e05b0d308ab9723182f408555721ac
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=utf8; name="report.txt";

---
Reported-From: abuse@???
Category: info
Report-Type: harvesting
Service: postfix
Version: 0.1
User-Agent: V2.1.6(25.3.2011) anti-scam-bot clean-mx.de
Date: Sat, 17 Sep 2011 10:14:49 +0200
Source-Type: ip-address
Source: 204.209.81.1
Port: 25
Report-ID: 93827299@???
Schema-URL: http://www.x-arf.org/schema/info_0.1.0.json
Attachment: text/plain

--Abuse-10e05b0d308ab9723182f408555721ac
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=utf8; name="logfile.log";

attacked server: relay.netpilot.net
envelopesender: jonetou@???
enveloperecpient: imback@???
Helo: doctor.nl2k.ab.ca
source-ip: 204.209.81.1
protocol: SMTP
instance: predata05.4bc2.4e7456f9.9def5.0
size: 0
reason: 5 -->554 User (%s) not known to us please verify your adressbook for any typos in this email adress or inquire manually
Evidences so far in total for this ip:7


--Abuse-10e05b0d308ab9723182f408555721ac--


b)


>From MAILER-DAEMON Sat Sep 17 04:53:21 2011

Received: from localhost by doctor.nl2k.ab.ca
    with SpamAssassin (version 3.3.2);
    Sat, 17 Sep 2011 04:53:40 -0600
From: do-not-reply@???
To: abuse@???
Subject: *****SPAM***** Possible Spam Abuse Report - nl2k.ab.ca - 204.209.81.1
Date: Sat, 17 Sep 2011 03:53:01 -0700
Message-Id: <E1R4sW5-0000Ct-QQ@???>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.9 required=5.0 tests=SARE_UN4,URIBL_JP_SURBL,
    URIBL_PH_SURBL,URIBL_WS_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4E747C34.DD146452"
Status: RO
Content-Length: 20248
Lines: 376


This is a multi-part message in MIME format.

------------=_4E747C34.DD146452
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see the administrator of
that system for details. [...]

Content analysis details: (5.9 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 1.8 URIBL_PH_SURBL         Contains an URL listed in the PH SURBL blocklist
                            [URIs: kairosam.co.za]
 1.5 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
                            [URIs: kairosam.co.za]
 1.5 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                            [URIs: kairosam.co.za]
 1.1 SARE_UN4               BODY: SARE_UN4


The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.


------------=_4E747C34.DD146452
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Received: from localhost by doctor.nl2k.ab.ca
    with SpamAssassin (version 3.3.2);
    Sat, 17 Sep 2011 04:53:32 -0600
From: do-not-reply@???
To: abuse@???
Subject: *****SPAM***** Possible Spam Abuse Report - nl2k.ab.ca - 204.209.81.1
Date: Sat, 17 Sep 2011 03:53:01 -0700
Message-Id: <E1R4sW5-0000Ct-QQ@???>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Flag: YES
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.9 required=5.0 tests=SARE_UN4,URIBL_BLACK,
    URIBL_JP_SURBL,URIBL_PH_SURBL,URIBL_WS_SURBL autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4E747C2C.3EAACBC9"
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $


This is a multi-part message in MIME format.

------------=_4E747C2C.3EAACBC9
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: This is an automated email abuse report from the folks at
junkemailfilter.com for an email message received from IP address [204.209.81.1]
on Sat, 17 Sep 2011 03:53:01 -0700. We hope this information will help you
in determining the source of the problem and shut it down. The original message
is attached in MIME format with complete headers. For more information about
this standardized abuse report format [ARF] please visit http://www.mipassoc.org/arf/
If you would prefer abuse reports in text format let us know. [...]

Content analysis details: (7.9 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: kairosam.co.za]
 1.8 URIBL_PH_SURBL         Contains an URL listed in the PH SURBL blocklist
                            [URIs: kairosam.co.za]
 1.5 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
                            [URIs: kairosam.co.za]
 1.5 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                            [URIs: kairosam.co.za]
 1.1 SARE_UN4               BODY: SARE_UN4


The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.


------------=_4E747C2C.3EAACBC9
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Return-Path: <>
X-Original-To: postmaster@???
Delivered-To: postmaster@???
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
    by doctor.nl2k.ab.ca (Postfix) with ESMTP id 5E80B12CFA82
    for <postmaster@???>; Sat, 17 Sep 2011 04:53:21 -0600 (MDT)
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
    by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 3wsjfULe7tlB for <postmaster@???>;
    Sat, 17 Sep 2011 04:53:06 -0600 (MDT)
Received: from abuse.junkemailfilter.com (abuse.junkemailfilter.com [184.105.182.42])
    (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by doctor.nl2k.ab.ca (Postfix) with ESMTPS id AB95712CFA81
    for <postmaster@???>; Sat, 17 Sep 2011 04:53:04 -0600 (MDT)
Delivery-date: Sat, 17 Sep 2011 03:53:03 -0700
Received: from pascal.junkemailfilter.com ([184.105.182.181] helo=junkemailfilter.com)
    by abuse.junkemailfilter.com with esmtps (TLSv1:AES256-SHA:256)
    (Exim 4.76)
    id 1R4sW3-00077z-Qn on interface=184.105.182.42
    for postmaster@???; Sat, 17 Sep 2011 03:52:59 -0700
Received: from " root" by pascal.junkemailfilter.com with local-bsmtp (Exim 4.76)
    id 1R4sW5-0000Ct-QQ 
    for postmaster@???; Sat, 17 Sep 2011 03:53:01 -0700
From: do-not-reply@???
Date: Sat, 17 Sep 2011 03:53:01 -0700
Subject: Possible Spam Abuse Report - nl2k.ab.ca - 204.209.81.1
To: abuse@???
MIME-Version: 1.0
Content-Type: multipart/report; report-type=feedback-report; boundary="junk_email_filter_is_the_worlds_best_spam_filter"
Message-Id: <E1R4sW5-0000Ct-QQ@???>



--junk_email_filter_is_the_worlds_best_spam_filter
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

This is an automated email abuse report from the folks at junkemailfilter.com for an email message received from IP address [204.209.81.1] on Sat, 17 Sep 2011 03:53:01 -0700.

We hope this information will help you in determining the source of the problem and shut it down. The original message is attached in MIME format with complete headers. For more information about this standardized abuse report format [ARF] please visit http://www.mipassoc.org/arf/ If you would prefer abuse reports in text format let us know.

If you have any questions or feedback about this abuse report or are interested in learning about our spam filtering technology feel free to contact us. If this is not spam please accept our apologies and let us know so we can fix the problem. Pay close attention to the REASON listed.
Marc Perkel - Fearless Leader
Junk Email Filter dot com
http://www.junkemailfilter.com
errors@???

* Date:    Sat, 17 Sep 2011 03:53:01 -0700
* From:    "Twitter" <twitter-notification-youth=vbf.org@???>
* Subject: You have 1 notification from Twitter!
* Host:    doctor.nl2k.ab.ca [204.209.81.1]
* Reason:  URIBL - Message links to Blacklisted Site [kairosam.co.za] hostkarma.junkemailfilter.com/127.0.0.2, 127.0.2.3 - X=pascal H=doctor.nl2k.ab.ca [204.209.81.1] HELO=[doctor.nl2k.ab.ca] F=[claudia.flores@???] T=[youth@???] S=[You have 1 n


For more information about these abuse reports: http://wiki.junkemailfilter.com/index.php/Spam_abuse
To test or be removed from our blacklist: http://ipadmin.junkemailfilter.com/remove.php?ip=204.209.81.1

======== Original Headers ========

Delivery-date: Sat, 17 Sep 2011 03:53:01 -0700
Received: from doctor.nl2k.ab.ca ([204.209.81.1])
    by pascal.junkemailfilter.com with smtp (Exim 4.76)
    id 1R4sW5-00004x-Gq on interface=184.105.182.180
    for youth@???; Sat, 17 Sep 2011 03:53:01 -0700
Date: Sat, 17 Sep 2011 04:53:01 +0000 (UTC)
From: "Twitter" <twitter-notification-youth=vbf.org@???>
Reply-To: noreply@???
To: youth@???
Message-Id: <09af82b644e1e_619e7f8ee0ec2841c2@???>
Subject: You have 1 notification from Twitter!
Mime-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: Quoted-printable
Content-Disposition: inline
X-Campaignid: twitter20110917761124
Errors-To: Twitter <twitter-notification-youth=vbf.org@???>
Bounces-To: Twitter <twitter-notification-youth=vbf.org@???>
X-Sender-Domain: nl2k.ab.ca
X-Spamfilter-host: pascal.junkemailfilter.com - http://www.junkemailfilter.com
X-Mail-from: claudia.flores@???
X-Spam-Class: SPAM-HIGH-VERY - URIBL - Message links to Blacklisted Site [kairosam.co.za] hostkarma.junkemailfilter.com/127.0.0.2, 127.0.2.3 - X=pascal H=doctor.nl2k.ab.ca [204.209.81.1] HELO=[doctor.nl2k.ab.ca] F=[claudia.flores@???] T=[youth@???] S=[You have 1 notification from Twitter!]
X-Spamsave: Yes - URIBL - Message links to Blacklisted Site [kairosam.co.za] hostkarma.junkemailfilter.com/127.0.0.2, 127.0.2.3 - X=pascal H=doctor.nl2k.ab.ca [204.209.81.1] HELO=[doctor.nl2k.ab.ca] F=[claudia.flores@???] T=[youth@???] S=[You have 1 notification from Twitter!]
X-Abuse-email: 
X-Abuse-email: postmaster@???
X-Sender-Host-Address: 204.209.81.1
X-Sender-Host-Name: doctor.nl2k.ab.ca
X-Original-helo: doctor.nl2k.ab.ca


--junk_email_filter_is_the_worlds_best_spam_filter
Content-Type: message/feedback-report

Feedback-Type: abuse
User-Agent: JunkEmailFilter - Abuse Reporter/1.0 - Testing - Feedback Appreciated
Version: 0.1
Original-Mail-From: "Twitter" <twitter-notification-youth=vbf.org@???>
Original-Rcpt-To: youth@???
Received-Date: Sat, 17 Sep 2011 03:53:01 -0700
Source-IP: 204.209.81.1

--junk_email_filter_is_the_worlds_best_spam_filter
Content-Type: message/rfc822
Content-Disposition: inline

Delivery-date: Sat, 17 Sep 2011 03:53:01 -0700
Received: from doctor.nl2k.ab.ca ([204.209.81.1])
    by pascal.junkemailfilter.com with smtp (Exim 4.76)
    id 1R4sW5-00004x-Gq on interface=184.105.182.180
    for youth@???; Sat, 17 Sep 2011 03:53:01 -0700
Date: Sat, 17 Sep 2011 04:53:01 +0000 (UTC)
From: "Twitter" <twitter-notification-youth=vbf.org@???>
Reply-To: noreply@???
To: youth@???
Message-Id: <09af82b644e1e_619e7f8ee0ec2841c2@???>
Subject: You have 1 notification from Twitter!
Mime-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: Quoted-printable
Content-Disposition: inline
X-Campaignid: twitter20110917761124
Errors-To: Twitter <twitter-notification-youth=vbf.org@???>
Bounces-To: Twitter <twitter-notification-youth=vbf.org@???>
X-Sender-Domain: nl2k.ab.ca
X-Spamfilter-host: pascal.junkemailfilter.com - http://www.junkemailfilter.com
X-Mail-from: claudia.flores@???
X-Spam-Class: SPAM-HIGH-VERY - URIBL - Message links to Blacklisted Site [kairosam.co.za] hostkarma.junkemailfilter.com/127.0.0.2, 127.0.2.3 - X=pascal H=doctor.nl2k.ab.ca [204.209.81.1] HELO=[doctor.nl2k.ab.ca] F=[claudia.flores@???] T=[youth@???] S=[You have 1 notification from Twitter!]
X-Spamsave: Yes - URIBL - Message links to Blacklisted Site [kairosam.co.za] hostkarma.junkemailfilter.com/127.0.0.2, 127.0.2.3 - X=pascal H=doctor.nl2k.ab.ca [204.209.81.1] HELO=[doctor.nl2k.ab.ca] F=[claudia.flores@???] T=[youth@???] S=[You have 1 notification from Twitter!]
X-Abuse-email: 
X-Abuse-email: postmaster@???
X-Sender-Host-Address: 204.209.81.1
X-Sender-Host-Name: doctor.nl2k.ab.ca
X-Original-helo: doctor.nl2k.ab.ca


<html>
<body lang=3D"en">
  <p><DEFANGED_div style=3D"padding: 8px; background-color:#C0DEED; -moz-bo=
rder-radius:7px;-webkit-border-radius:7px;border-radius:7px">
    <table border=3D"0" cellspacing=3D"0" cellpadding=3D"0" width=3D"100%">=


      <tr><td DEFANGED_style=3D"padding: 16px 8px 0">
      <a href=3D"http://twitter.com"><img src=3D"http://s.twimg.com/a/12828=
66105/images/twitter_logo_header.png?src=3Dmail" DEFANGED_style=3D"display:=
block; border: 0;" width=3D"155" height=3D"36" /></a>
      </td></tr>
      <tr><td valign=3D"bottom" height=3D"20">
        <p><DEFANGED_div style=3D"width:0; height:0; margin-left:22px; bord=
er:10px solid; border-top:0px none; border-color:#C0DEED #C0DEED white #C0D=
EED;"></p><DEFANGED_div>
      </td></tr>
      <tr><td DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande=
, Helvetica, Arial, sans-serif;;font-size:13px; padding: 8px; margin: 8px; =
background-color:#fff; color: #222; -moz-border-radius:5px;-webkit-border-r=
adius:5px; border-radius:5px">
        <h2 DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, =
Helvetica, Arial, sans-serif;margin:0 0 16px; font-size:18px; font-weight:n=
ormal">Hi,</h2>


<p>
Twitter has sent you a notification, for more details, please follow the li=
nk below:<br />
<a href=3D"http://kairosam.co.za/discerned.html">http://twitter.com/support=
/?last_chance=3D2011-09-17&user_id=3D0ea39fa</a>
</p>

<p DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, Helvetica=
, Arial, sans-serif;font-size: 13px; line-height:18px;border-bottom: 1px so=
lid rgb(238, 238, 238); padding-bottom: 10px;">
    <DEFANGED_span style=3D"font: italic 13px Georgia,serif; color: rgb(102=
, 102, 102);">The Twitter Team</DEFANGED_span>


</p>


  <p DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, Helveti=
ca, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;">
    If you received this message in error and did not sign up for a Twitter=
 account, click <a href=3D''>not my account</a>.
  </p>


<p DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, Helvetica=
, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;">

Please do not reply to this message; it was sent from an unmonitored emai=
l address. This message is a service email related to your use of Twitter.=
For general inquiries or to request support with your Twitter account, pl=
ease visit us at <a href=3D"">Twitter Support</a>.
</p>


      </td></tr>
    </table>
  </p><DEFANGED_div>
</body>
</html>



--junk_email_filter_is_the_worlds_best_spam_filter--


------------=_4E747C2C.3EAACBC9
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"

This message has been 'sanitized'. This means that potentially
dangerous content has been rewritten or removed. The following
log describes which actions were taken.

Sanitizer (start="1316256813"):
  Part (pos="825"):
    SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
      Match (names="unnamed.txt", rule="2"):
        Enforced policy: accept


  Part (pos="2851"):
    Part (pos="174"):
      Part (pos="1748"):
        SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
          Match (names="unnamed.txt", rule="2"):
            Enforced policy: accept


      Part (pos="5683"):
        Part (pos="58"):
          SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):
            Match (names="unnamed.html, filetype.html", rule="2"):
              Enforced policy: accept


          Note: Styles and layers give attackers many tools to fool the
          user and common browsers interpret Javascript code found
          within style definitions.


          Rewrote HTML tag: >>_div style="padding: 8px; background-color:#C0DEED; -moz-border-radius:7px;-webkit-border-radius:7px;border-radius:7px"_<<
                        as: >>_p__DEFANGED_div style="padding: 8px; background-color:#C0DEED; -moz-border-radius:7px;-webkit-border-radius:7px;border-radius:7px"_<<
          Rewrote HTML tag: >>_td style="padding: 16px 8px 0"_<<
                        as: >>_td DEFANGED_style="padding: 16px 8px 0"_<<
          Rewrote HTML tag: >>_img src="http://s.twimg.com/a/1282866105/images/twitter_logo_header.png?src=mail" style="display:block; border: 0;" width="155" height="36" /_<<
                        as: >>_img src="http://s.twimg.com/a/1282866105/images/twitter_logo_header.png?src=mail" DEFANGED_style="display:block; border: 0;" width="155" height="36" /_<<
          Rewrote HTML tag: >>_div style="width:0; height:0; margin-left:22px; border:10px solid; border-top:0px none; border-color:#C0DEED #C0DEED white #C0DEED;"_<<
                        as: >>_p__DEFANGED_div style="width:0; height:0; margin-left:22px; border:10px solid; border-top:0px none; border-color:#C0DEED #C0DEED white #C0DEED;"_<<
          Rewrote HTML tag: >>_/div_<<
                        as: >>_/p__DEFANGED_div_<<
          Rewrote HTML tag: >>_td style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;;font-size:13px; padding: 8px; margin: 8px; background-color:#fff; color: #222; -moz-border-radius:5px;-webkit-border-radius:5px; border-radius:5px"_<<
                        as: >>_td DEFANGED_style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;;font-size:13px; padding: 8px; margin: 8px; background-color:#fff; color: #222; -moz-border-radius:5px;-webkit-border-radius:5px; border-radius:5px"_<<
          Rewrote HTML tag: >>_h2 style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;margin:0 0 16px; font-size:18px; font-weight:normal"_<<
                        as: >>_h2 DEFANGED_style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;margin:0 0 16px; font-size:18px; font-weight:normal"_<<
          Rewrote HTML tag: >>_p style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;font-size: 13px; line-height:18px;border-bottom: 1px solid rgb(238, 238, 238); padding-bottom: 10px;"_<<
                        as: >>_p DEFANGED_style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;font-size: 13px; line-height:18px;border-bottom: 1px solid rgb(238, 238, 238); padding-bottom: 10px;"_<<
          Rewrote HTML tag: >>_span style="font: italic 13px Georgia,serif; color: rgb(102, 102, 102);"_<<
                        as: >>_DEFANGED_span style="font: italic 13px Georgia,serif; color: rgb(102, 102, 102);"_<<
          Rewrote HTML tag: >>_/span_<<
                        as: >>_/DEFANGED_span_<<
          Rewrote HTML tag: >>_p style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;"_<<
                        as: >>_p DEFANGED_style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;"_<<
          Rewrote HTML tag: >>_p style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;"_<<
                        as: >>_p DEFANGED_style="font-family: 'Lucida Grande', Lucida Grande, Helvetica, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;"_<<
          Rewrote HTML tag: >>_/div_<<
                        as: >>_/p__DEFANGED_div_<<


Total modifications so far: 13


Anomy 0.0.0 : Sanitizer.pm
$Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $

------------=_4E747C2C.3EAACBC9--


------------=_4E747C34.DD146452--

c)


>From no-reply@??? Sat Sep 17 05:35:34 2011

Return-Path: <no-reply@???>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on doctor.nl2k.ab.ca
X-Spam-Level: **
X-Spam-Status: No, score=2.6 required=5.0 tests=SARE_UN4,URIBL_WS_SURBL
    autolearn=no version=3.3.2
X-Original-To: root@???
Delivered-To: root@???
Received: from localhost (localhost.nl2k.ab.ca [127.0.0.1])
    by doctor.nl2k.ab.ca (Postfix) with ESMTP id 8BD2212CFA83
    for <root@???>; Sat, 17 Sep 2011 05:35:33 -0600 (MDT)
X-Virus-Scanned: amavisd-new at doctor.nl2k.ab.ca
Received: from doctor.nl2k.ab.ca ([127.0.0.1])
    by localhost (doctor.nl2k.ab.ca [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 1Fhpm39GNZI2 for <root@???>;
    Sat, 17 Sep 2011 05:35:21 -0600 (MDT)
Received: from feed.abusix.org (shot03.abusix.org [80.237.177.91])
    by doctor.nl2k.ab.ca (Postfix) with ESMTP id 4BB0E12CFA82
    for <root@???>; Sat, 17 Sep 2011 05:35:19 -0600 (MDT)
Received: from cgn-sling-03 (localhost [127.0.0.1])
    by feed.abusix.org (Postfix) with SMTP id 116539F175E
    for <root@???>; Sat, 17 Sep 2011 11:35:17 +0000 (UTC)
From: no-reply@???
Sender: no-reply@???
Reply-To: no-reply@???
To: root@???
Subject: Spamtraphit by 204.209.81.1 2011-09-17 11:34:49 +0000 [noreply]
Auto-Submitted: auto-generated
Content-Type: multipart/report; boundary="1316259289.17Cc3272.31900"; report-type="feedback-report"
Content-Transfer-Encoding: 8bit
Message-Id: <mailbox-31900-1316259289-761896@???>
Date: Sat, 17 Sep 2011 11:34:49 +0000
MIME-Version: 1.0
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.94 2006/01/02 16:43:10 bre Exp $
Status: RO
Content-Length: 4974
Lines: 138




--1316259289.17Cc3272.31900
MIME-Version: 1.0
Content-Type: text/plain

PLEASE SEE ATTACHMENTS FOR MORE SPECIFIC INFORMATION REGARDING THIS INCIDENT!

Hello,

this is an autogenerated email abuse complaint regarding your network.
This report is implemented in an abuse report format (ARF) laid down in
RFC5965.

You receive this mail because we have figured out that you are the responsible
POC for this type of incident. Anyhow, please let us know if our information
is outdated: info [at] abusix.org

Further information about the Abuse Reporting Format can be found here:
http://www.ietf.org/rfc/rfc5965.txt

Parsers and Tools can be found here:
http://rubyforge.org/projects/arfparser/
http://search.cpan.org/perldoc?Email::ARF
http://abusix.com/solutions


abusix.org reports any detected abusive behavior originating from your network
back to you as the responsible Network Operator or Abuse Desk helping you to
keep your network clean.
FAQ-pages, format specifications and information about automatic
complaint-handling can be found at our project-page:

http://abusix.org/service/global-reporting
http://abusix.org/philosophy
http://abusix.org/faq

Thank you for your cooperation, together we can make the internet a
safer place

Your Abusix-Team

--1316259289.17Cc3272.31900
MIME-Version: 1.0
Content-Type: message/feedback-report

Arrival-Date: Sat, 17 Sep 2011 11:34:49 GMT
Feedback-Type: abuse
Version: 0.02
User-Agent: abusix-qp/0.02
Source-IP: 204.209.81.1
Original-Mail-From: <hedrick@???>

--1316259289.17Cc3272.31900
MIME-Version: 1.0
Content-Type: message/rfc822

Received: from doctor.nl2k.ab.ca (HELO doctor.nl2k.ab.ca) (204.209.81.1)
    by trap01.abusix.org (qpsmtpd/0.84) with SMTP; Sat, 17 Sep 2011 11:34:49 +0000
Date: Sat, 17 Sep 2011 05:34:49 +0000 (UTC)
From: "Twitter" <twitter-notification-xxxxxxxxxx=xxxxx.xx@???>
Reply-To: noreply@???
To: xxxxxxxxxx@???
Message-Id: <c13be66bb0a8_9bc53c2d9b8c127d8a@???>
Subject: You have 1 notification from Twitter!
Mime-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: Quoted-printable
Content-Disposition: inline
X-Campaignid: twitter20110917671663
Errors-To: Twitter <twitter-notification-xxxxxxxxxx=xxxxx.xx@???>
Bounces-To: Twitter <twitter-notification-xxxxxxxxxx=xxxxx.xx@???>


<html>
<body lang=3D"en">
  <p><DEFANGED_div style=3D"padding: 8px; background-color:#C0DEED; -moz-bo=
rder-radius:7px;-webkit-border-radius:7px;border-radius:7px">
    <table border=3D"0" cellspacing=3D"0" cellpadding=3D"0" width=3D"100%">=


      <tr><td DEFANGED_style=3D"padding: 16px 8px 0">
      <a href=3D"http://twitter.com"><img src=3D"http://s.twimg.com/a/12828=
66105/images/twitter_logo_header.png?src=3Dmail" DEFANGED_style=3D"display:=
block; border: 0;" width=3D"155" height=3D"36" /></a>
      </td></tr>
      <tr><td valign=3D"bottom" height=3D"20">
        <p><DEFANGED_div style=3D"width:0; height:0; margin-left:22px; bord=
er:10px solid; border-top:0px none; border-color:#C0DEED #C0DEED white #C0D=
EED;"></p><DEFANGED_div>
      </td></tr>
      <tr><td DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande=
, Helvetica, Arial, sans-serif;;font-size:13px; padding: 8px; margin: 8px; =
background-color:#fff; color: #222; -moz-border-radius:5px;-webkit-border-r=
adius:5px; border-radius:5px">
        <h2 DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, =
Helvetica, Arial, sans-serif;margin:0 0 16px; font-size:18px; font-weight:n=
ormal">Hi,</h2>


<p>
Twitter has sent you a notification, for more details, please follow the li=
nk below:<br />
<a href=3D"http://egrcorp.com.pe/grammatical.html">http://twitter.com/suppo=
rt/?last_chance=3D2011-09-17&user_id=3D91c8c1f0</a>
</p>

<p DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, Helvetica=
, Arial, sans-serif;font-size: 13px; line-height:18px;border-bottom: 1px so=
lid rgb(238, 238, 238); padding-bottom: 10px;">
    <DEFANGED_span style=3D"font: italic 13px Georgia,serif; color: rgb(102=
, 102, 102);">The Twitter Team</DEFANGED_span>


</p>


  <p DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, Helveti=
ca, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;">
    If you received this message in error and did not sign up for a Twitter=
 account, click <a href=3D''>not my account</a>.
  </p>


<p DEFANGED_style=3D"font-family: 'Lucida Grande', Lucida Grande, Helvetica=
, Arial, sans-serif;margin-top:5px;font-size:10px;color:#888888;">

Please do not reply to this message; it was sent from an unmonitored emai=
l address. This message is a service email related to your use of Twitter.=
For general inquiries or to request support with your Twitter account, pl=
ease visit us at <a href=3D"">Twitter Support</a>.
</p>


      </td></tr>
    </table>
  </p><DEFANGED_div>
</body>
</html>




--1316259289.17Cc3272.31900--

Spam hijacking is not pleasant.

-- 
Member - Liberal International    This is doctor@??? Ici doctor@???
God, Queen and country! Never Satan President Republic! Beware AntiChrist rising! 
https://www.fullyfollow.me/rootnl2k
Ontario, Nfld, and Manitoba boot the extremists out and vote Liberal!