Blog for hpHosts, and whatever else I feel like writing about ....

Friday, 30 March 2012

Hotels: Earn trust before you ask us for it!

I'm off down London next month, for InfoSec, and because of such, have a need for a hotel in Kensington (Earls Court to be precise). I found several, but most were already fully booked, or stupidly expensive (Hilton falling into the latter at £350 PER NIGHT!).

What astounded and disgusted me however, were the following;

1. mowbraycourthotel.com
2. studios92.com
3. bokahotel.com

Why did they disgust me? Let me count the ways;

1. They DO NOT provide their contact information anywhere on their website - instead, the contact information is for a THIRD PARTY*, nice of them to tell you that.

2. The phone numbers listed in the whois details, are either invalid (in the case of mowbraycourthotel.com) or don't accept incoming calls (in the case of the other 2), meaning you can't contact the hotel directly

3. No valid e-mail address to contact the hotels THEMSELVES!, instead, again, you're given the e-mail address for a THIRD PARTY!

4. Worst of all however, is given this, they still require a deposit, which normally would be fine - most hotels do - but the problem here, is they want us to trust them with our credit/debit card details, when they can't even provide basic contact information!


Personally I find that absolutely abhorant. Needless to say, the domains have been reported to Internic/ICANN due to the invalid phone numbers.

* And who is this third party?

traveltura.com

But hang on, if we load the homepage (i.e. no referrer or such), it says it's "Boka Hotel" - but hows that exactly, when it's clearly not? it then gets more confusing if we load its WhoIs details up - guess who we see;

Registrant:
Traveltura com Ltd
3 Littlestone Road
New Romeny
kent, Kent TN28 8LN
GB

Domain name: TRAVELTURA.COM

Administrative Contact:
Traveltura, Traveltura dj@studios92.com
3 Littlestone Road
New Romeny
kent, Kent TN28 8LN
GB
+00447989420877
Technical Contact:
Traveltura, Traveltura dj@studios92.com
3 Littlestone Road
New Romeny
kent, Kent TN28 8LN
GB
+00447989420877

Registration Service Provider:
Fasthosts Internet Limited, domains@fasthosts.co.uk
+44.8708883600
+44.8708883760 (fax)
http://www.Fasthosts.co.uk

Registrar of Record: TUCOWS, INC.
Record last updated on 03-Sep-2011.
Record expires on 15-Dec-2019.
Record created on 15-Dec-2009.

Registrar Domain Name Help Center:
http://tucowsdomains.com

Domain servers in listed order:
NS.RACKSPACE.COM
NS2.RACKSPACE.COM

Domain status: clientTransferProhibited
clientUpdateProhibited


But hang on - we've seen @studios92.com before;

Registrant:
Studios92 com Ltd
Aspect House
16 Wilmer Place
Stoke Newington
London, London N16 0LQ
GB

Domain name: STUDIOS92.COM

Administrative Contact:
Studios92, Studios92 info@studios92.com
Aspect House
16 Wilmer Place
Stoke Newington
London, London N16 0LQ
GB
4402088026646 Fax: 4402082118983

Technical Contact:
Bouderba, Bo info@studios92.com
Aspect House
16 Wilmer Place
Stoke Newington
London, London N16 0LQ
GB
4402088026646 Fax: 4402082118983

Registration Service Provider:
Fasthosts Internet Limited, domains@fasthosts.co.uk
+44.8708883600
+44.8708883760 (fax)
http://www.Fasthosts.co.uk

Registrar of Record: TUCOWS, INC.
Record last updated on 24-Sep-2011.
Record expires on 12-May-2017.
Record created on 12-May-1999.

Registrar Domain Name Help Center:
http://tucowsdomains.com

Domain servers in listed order:
ns1.livedns.co.uk
ns3.livedns.co.uk
ns2.livedns.co.uk

Domain status: clientTransferProhibited
clientUpdateProhibited


And just to confuse matters;

Registrant:
Studios92 com Ltd
Aspect House
16 Wilmer Place
Stoke Newington
London, London N16 0LQ
GB

Domain name: MOWBRAYCOURTHOTEL.COM

Administrative Contact:
Bouderba, Bo info@studios92.com
Aspect House
16 Wilmer Place
Stoke Newington
London, London N16 0LQ
GB
+4402088026646 Fax: +4402082118983

Technical Contact:
Bouderba, Bo info@studios92.com
Aspect House
16 Wilmer Place
Stoke Newington
London, London N16 0LQ
GB
+4402088026646 Fax: +4402082118983

Registration Service Provider:
Fasthosts Internet Limited, domains@fasthosts.co.uk
+44.8708883600
+44.8708883760 (fax)
http://www.Fasthosts.co.uk

Registrar of Record: TUCOWS, INC.
Record last updated on 02-Feb-2012.
Record expires on 03-Mar-2013.
Record created on 03-Mar-2004.

Registrar Domain Name Help Center:
http://tucowsdomains.com

Domain servers in listed order:
NS1.LIVEDNS.CO.UK
NS3.LIVEDNS.CO.UK
NS2.LIVEDNS.CO.UK

Domain status: clientTransferProhibited
clientUpdateProhibited


Registrant:
Boka Hotel
33 Eardley Crescent
SW5 9JT
London, Earls Court SW5 9JT
GB

Domain name: BOKAHOTEL.COM

Administrative Contact:
Boka Hotel, Boka Hotel reservations@bokahotel.com
33 Eardley Crescent
SW5 9JT
London, Earls Court SW5 9JT
GB
+0044.20873701388
Technical Contact:
Boka Hotel, Boka Hotel reservations@bokahotel.com
33 Eardley Crescent
SW5 9JT
London, Earls Court SW5 9JT
GB
+0044.20873701388

Registration Service Provider:
Fasthosts Internet Limited, domains@fasthosts.co.uk
+44.8708883600
+44.8708883760 (fax)
http://www.Fasthosts.co.uk

Registrar of Record: TUCOWS, INC.
Record last updated on 09-Aug-2011.
Record expires on 25-Apr-2013.
Record created on 25-Apr-2003.

Registrar Domain Name Help Center:
http://tucowsdomains.com

Domain servers in listed order:
ns1.livedns.co.uk
ns2.livedns.co.uk

Domain status: clientTransferProhibited
clientUpdateProhibited


The only one that actually has the address of the hotel in the WhoIs, is bokahotel.com, but the e-mail address doesn't appear to exist (bounced), and none of the phone numbers in ANY of the domains whois records, actually work (one doesn't exist (mowbraycourthotel.com) and the others don't accept incoming calls).

But this doesn't add up - traveltura.com insist they're nothing more than an agent - a third party, not the hotels themselves - yet everything says they're all one and the same entity, regardless of the different company names, different WhoIs, invalid phone numbers, etc etc etc.


So given this, given they don't seem to be forthcoming about who they are, and don't want to provide actual valid contact details - phone numbers for the *hotels* themselves being the most important, would you trust them with your credit/debit card? I certainly won't be doing.

Oh and to make matters worse, when you do query with them, and they send you an e-mail - it's actually just a link to the search page - WITH THEIR AFFILIATE ID (yep, I double checked ;o) ) - you could've done the damn search yourself in the time it took for you to pay to phone them, or the time it took you to e-mail the so-called third party!

I've got work that needs doing however, so won't be digging into them any further just yet, will be doing that when I get some free time.

Thursday, 22 March 2012

Info: Paragon to stop providing WinPE

One of the benefits of being an MVP, is you get all sorts of free products, some from Microsoft, and some from third parties. One of the third parties, is Paragon Software. I'm actually in the middle of putting a review together for a Paragon product that I've been using for a while (more on that in due course), but this came in today, which will put a damper on anyones decision to get them;

You own a Paragon product with the WinPE recovery environment. We would like to inform you that Microsoft has changed its license conditions, meaning that we will no longer be allowed to offer you the Paragon WinPE as of March 30, 2012.


If you haven’t downloaded your WinPE from the Paragon website yet, we recommend you to do so by March 30, 2012. To do this, log in at Paragon My Account, download the WinPE and use it to create your boot medium in case of emergency. This is the most convenient way to restart your operating system without reinstallation in the event of system failure.


After March 30th, it will no longer be possible to download the WinPE recovery environment using your account! Customer service/support will not be able to send it retroactively!



Full details here;

http://www.paragon-software.com/newsletter/2012/20120320_winpe_bmb.html

Personally, I hope they come up with an alternative, perhaps using Linux, as this is one of the major benefits of their software.

Monday, 19 March 2012

Alert: Santander phish (aka, when all else fails, fall back on bit.ly - again)

I do despair of the fact the criminals running these, keep going back to old methods - yes they work, but that's irrelevant (and of course, people will always be gullible), going back to old methods means there's no surprises - and I like surprises!

I processed a phish targeting Santander customers a few days ago (led to ~3GB of evidence for not just phishing, but a host of other things too - oh the joys). Already had the server cleaned up and secured as it was re-compromised whilst I was investigating.

In this case, the phish comes with an attachment (letter.html), that contains a link to;

hxxp://bit.ly/GzoQge

This leads to;

hxxp://redirectauth.com/redirect1.php

This then leads to;

hxxp://santander.cgiauthweb.com/santander.co.uk/retail/LOGSUK_NS_ENS/gon.php

You'll not be surprised to learn, both the MITM and the phish, are housed on the same IP;

IP: 93.185.104.27
IP PTR: www17.pipni.cz
ASN: 43541 93.185.96.0/20 VSHOSTING VSHosting s.r.o.

And less surprised to learn, both domains are owned by the same miscreant;

Domain name: CGIAUTHWEB.COM
Name Server: ns.pipni.cz
Name Server: ns2.pipni.cz
Creation Date: 2012.03.15
Expiration Date: 2013.03.15

Status: DELEGATED

Registrant ID: AUVGQVT-RU
Registrant Name: Jonathan Yarrall
Registrant Organization: Jonathan Yarrall
Registrant Street1: 3455 Bellflower Blvd
Registrant City: Long beach
Registrant Postal Code: 90808
Registrant Country: US

Administrative, Technical Contact
Contact ID: AUVGQVT-RU
Contact Name: Jonathan Yarrall
Contact Organization: Jonathan Yarrall
Contact Street1: 3455 Bellflower Blvd
Contact City: Long beach
Contact Postal Code: 90808
Contact Country: US
Contact Phone: +1 562 4294761
Contact E-mail: lilboo2x@gmail.com

Registrar: Regional Network Information Center, JSC dba RU-CENTER



Sunday, 18 March 2012

Canadian pharmacy: Lets play tagged!

As if the reputation of Tagged for spamming people, wasn't bad enough, the boys involved in fake pharmacies have decided to make it even worse, by mis-using the Tagged name, presumably in an attempt to bypass spam filters (woops!).

From: Tagged <Tagged@taggedmail.com>
To: raymonda_laermans@yahoo.co.uk
Sent: Saturday, 17 March 2012, 22:11
Subject: Senga D sent you a message...


<http://sks.yyu.edu.tr/dimensioning.html> My Profile <http://sks.yyu.edu.tr/dimensioning.html> |Messages <http://sks.yyu.edu.tr/dimensioning.html> |Friends <http://sks.yyu.edu.tr/dimensioning.html> |Meet Me <http://sks.yyu.edu.tr/dimensioning.html> |Browse <http://sks.yyu.edu.tr/dimensioning.html> |Search <http://sks.yyu.edu.tr/dimensioning.html>
<http://sks.yyu.edu.tr/dimensioning.html> Senga D, 29 You have a new message!
Senga D says: Hi. Do you remember me ?
View message! <http://sks.yyu.edu.tr/dimensioning.html>

Manage my account and email settings <http://sks.yyu.edu.tr/dimensioning.html> on Tagged Inc., 110 Pacific Mall Box #117, San Francisco, CA. 94111
All Tagged emails will be sent from our official @tagged.com or @taggedmail.com domains to your registered email address. We will never contact you from any other email addresses.


From Tagged Sat Mar 17 21:11:00 2012
X-Apparently-To: [REMOVED] via 87.248.103.88; Sat, 17 Mar 2012 18:28:50 +0000
Return-Path: <billtownsend@talkmatch.com>
X-YahooFilteredBulk: 67.225.143.155
Received-SPF: fail (domain of talkmatch.com does not designate 67.225.143.155 as permitted sender)
X-YMailISG: ZqA8NFgWLDuXaeTEMafLSAqynCwVdfranwA.jeTP3Atwb.F2
3hlABc8WXiYcr9sZCQqUgabP6fGehBSMin8beNWGH_43Igx6zbp1Sq0x2zSG
BBab56U2ZswLQmEXk4qwsKsTOG2vNjpCI.TCwCg0xugmy9n49fxw7gyHd7KS
PfLcxH_Pr9JSpu58zrmmJwUjQxDwGYj7VlTnhoseK.sPnmZ7b_O9j9GZp8Wo
_Kapk5ZQu7xcFgrIIvHY7aeBOSB1Bzu9vQTk.OU3vhjREOTpi4Jb6ZpkDcIF
g64z7FfU7yQgUkxVZzQD46qOcH336b7oAPCZb9QhsSfAAvLmyPDQMjNS50Hh
d5gdYyKryoTYnTo8BKO47tVS0b.nMnn7pwUVlrHIGFM0Y9SgsymUXgzS4u_d
cZIrHE6Luaxt1oFxRaPhfYYqTKPYjvCMoBUSxFk_JpQzAhZ_y28IHT55q6AE
SCnsVjmU_d7.iKvdDp6Dbnx6e4oZLnZbECU4NlrHynmGzeqGEqtnwahD38x6
HkqakM2qLDklQFVr6mFtbfXVYfg7.PYY5lFO163O59_I_6SzZPRwW_BCFc.O
AFd9_5bu7fyaTcIm1pTP5zHm0Lcg3wYB2KH.6uUprdNYiJLzaholknfwbqdJ
8SL_yv2efVSkodO.mO3ZEijwR7WSwDlIFIpYI1e2wXCs3Zap9MUnmoSGhAab
5NwZvAMxAA4zkbs8OsOkiUWHTckslU1tKnpZVlB82.yCTfX2we61AeQw6u9Q
vuL56K1qxOaDjYEcvEdGH5bhfOz_A86s3i3s2vRfX.zevTmAHSAwigyDnXrn
&nbs p;mP19BFWl.Ze5zsFTwsqFSKVqvOQtx_yr7GHhD4bLsalm7stfTPKFF_Th5bl8
u8opt2J3VvI5B.DW8PdW9UufWWwa62Q7zDy9NsXB_jFxoF3XfjrcroJ8QbZP
vBFRm65rDRqOItYagjcysx5gyTtNayN01RYm_y_OuTTALEYALuAzvHmi_orG
Qv5uHioNA0CQuScUCsP_PWJw.nqw1oozWVg.M1QNJmxOfgEGPkpACfEu8iYZ
5dw98B.Uphjl4nXFND_urlgXGjUJtq8JnvdHLdX26f0e
X-Originating-IP: [67.225.143.155]
Authentication-Results: mta1022.mail.ird.yahoo.com from=taggedmail.com; domainkeys=neutral (no sig); from=taggedmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO colo4.kaakateeya.com) (67.225.143.155)
by mta1022.mail.ird.yahoo.com with SMTP; Sat, 17 Mar 2012 18:28:50 +0000
Date: Sat, 17 Mar 2012 14:11:00 -0700 (PDT)
From: Tagged<Tagged@taggedmail.com>
To: [REMOVED]
Subject: Senga D sent you a message...
MIME-Version: 1.0
List-Unsubscribe: <http://www.tagged.com/no_more.html?unsem=[REMOVED]
Sender: TaggedTagged@taggedmail.com
Content-Type: text/html; charset="utf-8"
X-Log-Id: 8073775313
Content-Transfer-Encoding: 7bit
Message-ID: <5.23.851.7265.0FCF410F036E793.3@sf-mta-643.taggedmail.com>
Content-Length: 3998


You'd have thought they'd have realised, if you want to bypass a spam filter, the last thing you do is impersonate a company known for spamming - they're already likely to be on everyones favourite blacklist/spam filter.

So what of the link? Well, the link in this case, points to;

URL: sks.yyu.edu.tr/dimensioning.html
IP: 193.255.143.50
IP PTR: yapi.yyu.edu.tr
ASN: 8517 193.255.0.0/16 ULAKNET ULAKNET-ASN

Which uses window.location, to redirect you to;

Host: palliativecarebooks.com
IP: 208.79.81.198
IP PTR: xyw3.x.rootbsd.net
ASN: 13637 13647 208.79.80.0/22 Tranquil Hosting, Inc.



Once you've decided what you want, the checkout then takes you to;

Host: onlinerxbilling.com
IP: 74.86.44.57
IP PTR: 74.86.44.57-static.reverse.softlayer.com
ASN: 36351 74.86.0.0/16 SOFTLAYER - SoftLayer Technologies Inc.



With the SSL cert provided by RapidSSL as of January 4th;



In case you're wondering, 208.79.81.198 also houses;

galaxycialistab.mobi
palliativecarebooks.com
xyw3.x.rootbsd.net
onlinemedicinemedic.ru
ns1.onlinemedicinemedic.ru
ns2.onlinemedicinemedic.ru
mail.onlinemedicinemedic.ru
bho2000.oilrk.ru
budda510.oilrk.ru
bill5150.oilrk.ru
blau5150.oilrk.ru
alfi0.oilrk.ru
bip2001.oilrk.ru
bmarcus001.oilrk.ru
carle01.oilrk.ru
apark01.oilrk.ru
bbeck11.oilrk.ru
amacgregor11.oilrk.ru
dolphi2721.oilrk.ru
dhhc21.oilrk.ru
deuce21.oilrk.ru
djali21.oilrk.ru
dboone1.oilrk.ru
chrismoore1.oilrk.ru
brettg1.oilrk.ru
asaiah1.oilrk.ru
aci1.oilrk.ru
jesmel1.oilrk.ru
dbowen1.oilrk.ru
calvinmiller1.oilrk.ru
chrishowes1.oilrk.ru
clrocks1.oilrk.ru
ns1.oilrk.ru
dcmgmt1.oilrk.ru
aconnolly1.oilrk.ru
bkane012.oilrk.ru
badcad42.oilrk.ru
blackwatch42.oilrk.ru
dwk72.oilrk.ru
ns2.oilrk.ru
dunn13.oilrk.ru
don13.oilrk.ru
c1023.oilrk.ru
davida4353.oilrk.ru
carla5263.oilrk.ru
bhs65.oilrk.ru
bam206.oilrk.ru
depage007.oilrk.ru
barrybragg007.oilrk.ru
bjoerne7.oilrk.ru
dcusack009.oilrk.ru
cherb49.oilrk.ru
bigred359.oilrk.ru
detroitlionsfan1989.oilrk.ru
andymac99.oilrk.ru
benner99.oilrk.ru
abuda.oilrk.ru
alenmila.oilrk.ru
capazasa.oilrk.ru
ckobsa.oilrk.ru
dotsb.oilrk.ru
bennietb.oilrk.ru
aghazariandd.oilrk.ru
xcsdd.oilrk.ru
balloud.oilrk.ru
fvubyd.oilrk.ru
rsmeade.oilrk.ru
archmage.oilrk.ru
bhf-garage.oilrk.ru
abbake.oilrk.ru
benofmooresville.oilrk.ru
anniesunshine.oilrk.ru
allstretchlimousine.oilrk.ru
avolpe.oilrk.ru
blairhouse.oilrk.ru
dougpete.oilrk.ru
driaf.oilrk.ru
chaydogg.oilrk.ru
cmberg.oilrk.ru
alexenberg.oilrk.ru
bertholdkrug.oilrk.ru
cibertech.oilrk.ru
driosh.oilrk.ru
adamjsmith.oilrk.ru
alupnorth.oilrk.ru
davesdj.oilrk.ru
darrinj.oilrk.ru
balok.oilrk.ru
bartlettelectrical.oilrk.ru
ahal.oilrk.ru
agusital.oilrk.ru
docparcel.oilrk.ru
dbaseball.oilrk.ru
btram.oilrk.ru
daydoom.oilrk.ru
bsilverm.oilrk.ru
chsm.oilrk.ru
billidrum.oilrk.ru
bobrieckelman.oilrk.ru
mrhappyheadn.oilrk.ru
asilken.oilrk.ru
bfranzen.oilrk.ru
chrissgriffin.oilrk.ru
cerdmann.oilrk.ru
debusmann.oilrk.ru
bertswanson.oilrk.ru
dennis.robinson.oilrk.ru
dodioflo.oilrk.ru
ddgroto.oilrk.ru
bimber.oilrk.ru
cheezyrider.oilrk.ru
ben_inker.oilrk.ru
jackfulmer.oilrk.ru
chplummer.oilrk.ru
bradayer.oilrk.ru
bsdias.oilrk.ru
bholmes.oilrk.ru
dvdjones.oilrk.ru
chaynes.oilrk.ru
btiefs.oilrk.ru
asulkis.oilrk.ru
anns.oilrk.ru
ceturns.oilrk.ru
atsanders.oilrk.ru
aftermidnight.oilrk.ru
mrsbanksgunit.oilrk.ru
bart.oilrk.ru
anttolbert.oilrk.ru
airblast.oilrk.ru
ashertt.oilrk.ru
bvgut.oilrk.ru
b.simoneau.oilrk.ru
cboudreau.oilrk.ru
blkarrow.oilrk.ru
broux.oilrk.ru
brandy.oilrk.ru
adrianbradley.oilrk.ru
brianmcnasty.oilrk.ru
www10s3mr6.gnmkl.ru
wwwces35c7.gnmkl.ru
www040mjc4b.gnmkl.ru
wwwy3uiywue.gnmkl.ru
wwwndqf.gnmkl.ru
wwwmflt.gnmkl.ru
www26eqnu.gnmkl.ru
tabletrxnutrition.ru
ns1.tabletrxnutrition.ru
ns2.tabletrxnutrition.ru
fitnesspharmacytabs.ru
ns1.fitnesspharmacytabs.ru
ns2.fitnesspharmacytabs.ru
mail.fitnesspharmacytabs.ru
www.fitnesspharmacytabs.ru
onlinemedspills.ru
ns1.onlinemedspills.ru
ns2.onlinemedspills.ru
medtechspillstablets.ru
ns1.medtechspillstablets.ru
ns2.medtechspillstablets.ru
medicinetorepillsrx.ru
ns1.medicinetorepillsrx.ru
ns2.medicinetorepillsrx.ru
drugcutpillsrx.ru
ns1.drugcutpillsrx.ru
ns2.drugcutpillsrx.ru
drugstoremedspharmacy.ru
ns1.drugstoremedspharmacy.ru
ns2.drugstoremedspharmacy.ru
drugstoredrugspharmacy.ru
ns1.drugstoredrugspharmacy.ru
ns2.drugstoredrugspharmacy.ru
bestpillspharmacy.ru
ns1.bestpillspharmacy.ru
ns2.bestpillspharmacy.ru


References

Microsoft, Google, Facebook, Tagged et al - they never learn
http://hphosts.blogspot.co.uk/2010/04/microsoft-google-facebook-tagged-et-al.html

Tagged.com pays $750,000 over deceptive emails
http://www.theregister.co.uk/2009/11/10/new_york_ag_fines_tagged/

Tagged spam - with a difference
http://hphosts.blogspot.co.uk/2009/10/tagged-spam-with-difference.html

Dear Tagged .... weren't you already being sued for this?
http://hphosts.blogspot.co.uk/2009/07/dear-tagged-werent-you-already-being.html

Tagged.com being sued - and about bloody time too!
http://hphosts.blogspot.co.uk/2009/07/taggedcom-being-sued-and-about-bloody.html

Saturday, 10 March 2012

Outlook Export and hpHosts

For those that haven't yet noticed, and use it, I published an Outlook Export update yesterday. Nothing special, just a couple bug fixes.

http://support.it-mate.co.uk/?mode=Products&p=outlookexport

Would of course, be preferable to have the functionality of Outlook Export, built straight into Outlook itself, but it seems Microsoft aren't going to do that (would save the users alot of time, as they'd not need a third party program to do it).

You'll also no doubt be wondering, there's to be an hpHosts update next weekend (would have been sooner, but I'm away at present (saw Billy Connolly in Bournemouth yesterday)). In the meantime, you can of course, use the hpHosts Partial update, to stay updated (best used in conjunction with Hostsman (abelhadigital.com))

Friday, 2 March 2012

Alert: Windows 8 misleading marketing

Just a note to be careful when looking for the latest Windows 8 adverts folks. Seems some companies not surprisingly, want to take advantage. pchelpsoft.com for example, who are using this (appeared on windows8beta.com);



And Babylon, who are using this (also appeared on windows8beta.com);



If you're looking for Windows 8, then either use the following, or for those of you with Technet/MSDN subscriptions, you should find it in Technet/MSDN.

http://windows.microsoft.com/en-GB/windows-8/consumer-preview

You'll find the Beta download for Windows 8 Server here (just found this myself, didn't know there was one);

http://www.microsoft.com/en-us/server-cloud/windows-server/v8-default.aspx

/edit

Little extra clarification by the way - windows8beta.com is NOT a Microsoft site, nor is it endorsed or supported by Microsoft.

Update: 216.245.213.232

Get extremely frustrated with some hosts sometimes (okay, extremely frequently, but the buggers keep either ignoring e-mails, filtering their abuse address so reports bounce because they happen to have a malicious URL in the abuse report (how dare I include the URL to the malicious content in an ABUSE REPORT!!!!!)).

Any who, I got tired of waiting for Limestone to bother taking action or replying, IP was still live as of 5 mins ago, so phoned them up and shouted a little (he first tried telling me to e-mail - as if that was going to work - already had several reports ignored), and I'm pleased to report 216.245.213.232 has now been suspended.

References

Alert: cahomnm.co
http://hphosts.blogspot.com/2012/03/alert-cahomnmco.html

Alert: rte66ts.com
http://hphosts.blogspot.com/2012/03/alert-rte66tscom.html

Alert: You have a new alert from Cahoot
http://hphosts.blogspot.com/2012/03/alert-you-have-new-alert-from-cahoot.html

Meatloaf: And now for something completely different

Got the new album yesterday and listened to it approx 30 times so far already and absolutely love it - if you've not got it yet (Amazon has it, for those without a local store selling it) - get it (still nowhere near as good as Bat Out of Hell - but what is!).

Yes yes, this is completely different to what I normally put here, but [tries thinking of something funny].

Alert: 199.19.215.0/24

People often ask me what I do to try and escape or get a break from work, and I always give the same answer - I don't get time for breaks - too much to do (thought I had 3,000 active cases, turns out it's over 600,000 and growing daily). The latest ones involve not surprisingly, the Blackhole exploit kit.

A friend dropped me a note due to something that had been found and he's needing analysis. I did that, then scanned the rest of the range looking for more, and found a second server involved.

199.19.215.133
199.19.215.19

Both of these are on Vexxhost' IP space, and Vexxhost are being completely unresponsive (were sent an e-mail etc 2 days ago).

Filenames are a little different from last time, code is still stupidly easy to decode though (see previous blogs on that). In this case, the files are at;

hxxp://199.19.215.133/stats/content/jav2.jar
hxxp://199.19.215.133/stats/files/18
hxxp://199.19.215.133/stats/files/19
hxxp://199.19.215.133/stats/files/23
hxxp://199.19.215.133/stats/files/24

hxxp://199.19.215.19/stats/content/jav2.jar
hxxp://199.19.215.19/stats/files/18
hxxp://199.19.215.19/stats/files/19
hxxp://199.19.215.19/stats/files/23
hxxp://199.19.215.19/stats/files/24

Thursday, 1 March 2012

Alert: cahomnm.co

Why am I focusing so much on Cahoot phishes? Because of how many have flowed into my inbox today (in comparison, there's only been a handful of phishes for others today).

As of two seconds ago;

hxxp://www.cahomnm.co/?login=prepare

Domain Name: CAHOMNM.CO
Domain ID: D28452919-CO
Sponsoring Registrar: GODADDY.COM, INC.
Sponsoring Registrar IANA ID: 146
Registrar URL (registration services): www.godaddy.com
Domain Status: clientDeleteProhibited
Domain Status: clientRenewProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registrant ID: CR107111492
Registrant Name: Michael Munoz
Registrant Address1: 236 East Foothill blvd
Registrant City: Azusa
Registrant State/Province: California
Registrant Postal Code: 91702
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.6267058030
Registrant Email: owdden@aol.com
Administrative Contact ID: CR107111494
Administrative Contact Name: Michael Munoz
Administrative Contact Address1: 236 East Foothill blvd
Administrative Contact City: Azusa
Administrative Contact State/Province: California
Administrative Contact Postal Code: 91702
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.6267058030
Administrative Contact Email: owdden@aol.com
Billing Contact ID: CR107111495
Billing Contact Name: Michael Munoz
Billing Contact Address1: 236 East Foothill blvd
Billing Contact City: Azusa
Billing Contact State/Province: California
Billing Contact Postal Code: 91702
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Phone Number: +1.6267058030
Billing Contact Email: owdden@aol.com
Technical Contact ID: CR107111493
Technical Contact Name: Michael Munoz
Technical Contact Address1: 236 East Foothill blvd
Technical Contact City: Azusa
Technical Contact State/Province: California
Technical Contact Postal Code: 91702
Technical Contact Country: United States
Technical Contact Country Code: US
Technical Contact Phone Number: +1.6267058030
Technical Contact Email: owdden@aol.com
Name Server: NS1.LOCKS-MACK.COM
Name Server: NS2.LOCKS-MACK.COM
Created by Registrar: GODADDY.COM, INC.
Last Updated by Registrar: GODADDY.COM, INC.
Domain Registration Date: Thu Mar 01 18:54:06 GMT 2012
Domain Expiration Date: Fri Feb 28 23:59:59 GMT 2014
Domain Last Updated Date: Thu Mar 01 19:42:03 GMT 2012


And yes, same IP. Time to shout yet again, at Limestone ....

References

Alert: rte66ts.com
http://hphosts.blogspot.com/2012/03/alert-rte66tscom.html

Alert: You have a new alert from Cahoot
http://hphosts.blogspot.com/2012/03/alert-you-have-new-alert-from-cahoot.html

Alert: rte66ts.com

Those behind the Cahoot phish have gotten themselves a new domain already (and likely others - still looking in to that), same IP at Limestone though. This just popped in to my inbox;

hxxp://www.rte66ts.com/?login=prepare

Return-Path: <melsmith@cg60.fr>
Delivered-To: elfinn-netralke@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 10.574
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.574 tagged_above=-9999 required=1.3
tests=[BAYES_50=0.8, FH_HELO_EQ_D_D_D_D=3.177,
HELO_DYNAMIC_IPADDR2=3.607, RDNS_NONE=0.793, STOX_REPLY_TYPE=0.439,
STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, TVD_RCVD_IP=0.001]
autolearn=unavailable
Received: from unknown (HELO yjl) ([137.181.204.182])
by 190.252.85.237 with ESMTP; Thu, 1 Mar 2012 14:15:13 -0500
Message-ID: <002f01ccf7df$055fe4c0$89b5ccb6@PERSONALyjl>
From: "Cahoot Team" <melsmith@cg60.fr>
To: <elfinn-netralke@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 14:08:01 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1252";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106



Registrant:
Michael Munoz
236 East Foothill blvd
Azusa, California 91702
United States

Registered through: GoDaddy.com, LLC (http://www.godaddy.com)
Domain Name: RTE66TS.COM
Created on: 13-Jul-09
Expires on: 13-Jul-13
Last Updated on: 14-Jul-11

Administrative Contact:
Munoz, Michael owdden@aol.com
236 East Foothill blvd
Azusa, California 91702
United States
+1.6267058030 Fax --

Technical Contact:
Munoz, Michael owdden@aol.com
236 East Foothill blvd
Azusa, California 91702
United States
+1.6267058030 Fax --

Domain servers in listed order:
NS1.LOCKS-MACK.COM
NS2.LOCKS-MACK.COM


References

Alert: You have a new alert from Cahoot
http://hphosts.blogspot.com/2012/03/alert-you-have-new-alert-from-cahoot.html

Alert: You have a new alert from Cahoot

There's been somewhat of an influx of Cahoot phishing spam today, with 62 in the last 4 hours alone, coming into my inbox. All with the same subject, and all containing links to 6 specific domains.

If you've been following the hpHosts additions today, you'll have already noticed they were added early this afternoon, and of course, I've already reported them to Cahoot, the hosting companies and of course, the registrar.

Subject: You have a new alert from Cahoot
URLs:

cahootcvm.com/?login=prepare
cahoot-gcm.com/?login=prepare
hacootouk.com/?login=prepare
cahoot-couk.org/?login=prepare
cahoot-couk.info/?login=prepare
cahootcok.com/?login=prepare

IPs:

64.202.189.170 (GoDaddy redirector)
216.245.213.232 (Limestone Networks)

You'll be pleased to hear, my friend at GoDaddy is in the office today so they'll not be staying online for long (some have already been taken down, with others going down as I write this).

The only one not registered through GoDaddy, is cahoot-gcm.com, which was registered through Yola (Tucows). You'll also not be surprised to hear that Limestone Networks, who are hosting these, have remained completely silent, doing absolutely nothing to get this site taken offline.

Registrant details used have been one of the following:

Grandi, Thomas
629-10th steet
Canmore, Alberta T1W 2A2
Canada
+44.402303911

Townsend, SM gsgsgrgrgr@mail.ru
78 Ladywood Road
Townsend, Hertford SG14 2TB
GB
+44.8707259886

Townsend, SM gsgsgrgrgr@mail.ru
snd
78 Ladywood Road
Townsend, Hertford SG14 2TB
United Kingdom
+7.540756371


Name servers used have remained the same throughout, for those not going through the GoDaddy redirector IP.



Domain Name: locks-mack.com
Created On: 2011-09-05
Expiration Date: 2012-09-05
Name Server: ns1.locks-mack.com
Name Server: ns2.locks-mack.com
Registrant Name: ANTHONY CAFARO
Registrant Organization:
Registrant Street1: 78 ridge road
Registrant Street2:
Registrant Street3:
Registrant City: rumson
Registrant State/Province: NJ
Registrant Postal Code: 07760
Registrant Country: US
Registrant Phone: +1 917-860-4800
Registrant Fax:
Registrant Email: colorsandforms@aol.com
Admin Name: ANTHONY CAFARO
Admin Organization:
Admin Street1: 78 ridge road
Admin Street2:
Admin Street3:
Admin City: rumson
Admin State/Province: NJ
Admin Postal Code: 07760
Admin Country: US
Admin Phone: +1 917-860-4800
Admin Fax:
Admin Email: colorsandforms@aol.com
Billing Name: ANTHONY CAFARO
Billing Organization:
Billing Street1: 78 ridge road
Billing Street2:
Billing Street3:
Billing City: rumson
Billing State/Province: NJ
Billing Postal Code: 07760
Billing Country: US
Billing Phone: +1 917-860-4800
Billing Fax:
Billing Email: colorsandforms@aol.com
Tech Name: ANTHONY CAFARO
Tech Organization:
Tech Street1: 78 ridge road
Tech Street2:
Tech Street3:
Tech City: rumson
Tech State/Province: NJ
Tech Postal Code: 07760
Tech Country: US
Tech Phone: +1 917-860-4800
Tech Fax:
Tech Email: colorsandforms@aol.com


Headers for all of the e-mails, for those wondering;

Return-Path: <afbdvooevrabota@s1.servair.fr>
Delivered-To: echoecho@
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO xoobr) ([230.47.171.186])
    by 77-254-120-124.adsl.inetia.pl with ESMTP; Thu, 1 Mar 2012 17:33:40 +0100
Message-ID: <001401ccf7c8$8e2e2350$e62fabba@blachntbxoobr>
From: "Cahoot Team" <afbdvooevrabota@s1.servair.fr>
To: <echoecho@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:23:45 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <alexander.metlitsky@loria.fr>
Delivered-To: carmina-nessolfl@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from unknown (HELO 5q5jf) ([81.63.238.31])
    by 187-44-2-146.cpe.moc.mastercabo.com.br with ESMTP; Thu, 1 Mar 2012 12:20:07 -0300
Message-ID: <002501ccf7be$4f9f5230$513fee1f@administrador5q5jf>
From: "Cahoot Team" <alexander.metlitsky@loria.fr>
To: <carmina-nessolfl@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 12:14:48 -0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1250";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409


Return-Path: <alisar@listes.paris.iufm.fr>
Delivered-To: nessiwth1976@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 10.306
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.306 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_RP_RNBL=1.31, RCVD_IN_SORBS_DUL=0.001, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, TVD_FINGER_02=1.215]
    autolearn=unavailable
Received: from 82-160-115-131.tktelekom.pl (82-160-115-131.tktelekom.pl [82.160.115.131])
    by [REMOVED] (Postfix) with SMTP id C26C93981B8
    for <nessiwth1976@[REMOVED]>; Thu, 1 Mar 2012 14:48:04 +0000 (GMT)
Received: from unknown (HELO yvrre) ([74.45.72.121])
    by 82-160-115-131.tktelekom.pl with ESMTP; Thu, 1 Mar 2012 15:51:51 +0100
Message-ID: <001301ccf7ba$498ac270$4a2d4879@komputeryvrre>
From: "Cahoot Team" <alisar@listes.paris.iufm.fr>
To: <nessiwth1976@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 15:46:46 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506


Return-Path: <amix@wanadoo.fr>
Delivered-To: chat.rr__services@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 94-183-230-115.rasana.net (unknown [94.183.230.115])
    by [REMOVED] (Postfix) with SMTP id 3AEE039818D
    for <chat.rr__services@[REMOVED]>; Thu, 1 Mar 2012 16:53:43 +0000 (GMT)
Received: from unknown (HELO 9bl) ([153.64.110.106])
    by 94-183-230-115.rasana.net with ESMTP; Thu, 1 Mar 2012 20:27:21 +0330
Message-ID: <002601ccf7cb$d5ecf600$99406e6a@ppc9bl>
From: "Cahoot Team" <amix@wanadoo.fr>
To: <chat.rr__services@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 20:21:29 +0330
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437


Return-Path: <art@groupe-harmonie.fr>
Delivered-To: ceo@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from unknown (HELO rycsn) ([119.103.52.140])
    by 109-92-201-126.dynamic.isp.telekom.rs with ESMTP; Thu, 1 Mar 2012 16:27:00 +0100
Message-ID: <001c01ccf7bf$27c99bc0$7767348c@LASTXPrycsn>
From: "Cahoot Team" <art@groupe-harmonie.fr>
To: <ceo@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:17:42 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <avrora@ascanis.fr>
Delivered-To: netsarkt1981@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from p578b03f4.dip0.t-ipconnect.de (p578b03f4.dip0.t-ipconnect.de [87.139.3.244])
    by [REMOVED] (Postfix) with SMTP id 85A4A3981AC
    for <netsarkt1981@[REMOVED]>; Thu, 1 Mar 2012 15:08:31 +0000 (GMT)
Received: from unknown (HELO 9wib) ([203.95.224.141])
    by p578b03f4.dip0.t-ipconnect.de with ESMTP; Thu, 1 Mar 2012 16:04:29 +0100
Message-ID: <000901ccf7bc$087d6650$cb5fe08d@Kanisius9wib>
From: "Cahoot Team" <avrora@ascanis.fr>
To: <netsarkt1981@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 15:56:53 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158


Return-Path: <a@deloitte.fr>
Delivered-To: fay-nesseubn@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from adsl-186-43-79-195.edatel.net.co (unknown [186.43.79.195])
    by [REMOVED] (Postfix) with SMTP id 17AC03981CF
    for <fay-nesseubn@[REMOVED]>; Thu, 1 Mar 2012 15:04:07 +0000 (GMT)
Received: from unknown (HELO zwf) ([65.141.195.150])
    by adsl-186-43-79-195.edatel.net.co with ESMTP; Thu, 1 Mar 2012 10:09:06 -0500
Message-ID: <002201ccf7bc$8c9f8a80$418dc396@WINDOWS7PCzwf>
From: "Cahoot Team" <a@deloitte.fr>
To: <fay-nesseubn@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 09:58:40 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <BAYERKOHLER@lermab.uhp-nancy.fr>
Delivered-To: u003eservices@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO fqhnu) ([48.111.218.144])
    by 201-10-145-82.bsace705.dsl.brasiltelecom.net.br with ESMTP; Thu, 1 Mar 2012 12:45:52 -0300
Message-ID: <002d01ccf7c1$d3ad71d0$306fda90@claudetePCfqhnu>
From: "Cahoot Team" <BAYERKOHLER@lermab.uhp-nancy.fr>
To: <u003eservices@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 12:40:32 -0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <belindaguinn@pau.cci.fr>
Delivered-To: nesukays@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO wni596) ([140.97.228.184])
    by 77-255-18-37.adsl.inetia.pl with ESMTP; Thu, 1 Mar 2012 18:29:23 +0100
Message-ID: <000b01ccf7d0$9adc9f70$8c61e4b8@jolawni596>
From: "Cahoot Team" <belindaguinn@pau.cci.fr>
To: <nesukays@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:20:18 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Antivirus: avast! (VPS 110329-0, 2011-03-29), Outbound message
X-Antivirus-Status: Clean


Return-Path: <bmainey@s1.servair.fr>
Delivered-To: netnakis1978@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 46.204.29.227.nat.umts.dynamic.t-mobile.pl (46.204.29.227.nat.umts.dynamic.t-mobile.pl [46.204.29.227])
    by [REMOVED] (Postfix) with SMTP id 374433981A1
    for <netnakis1978@[REMOVED]>; Thu, 1 Mar 2012 17:47:27 +0000 (GMT)
Received: from unknown (HELO vh7a4) ([196.143.38.35])
    by 46.204.29.227.nat.umts.dynamic.t-mobile.pl with ESMTP; Thu, 1 Mar 2012 18:49:45 +0100
Message-ID: <001c01ccf7d3$5f34fcd0$c48f2623@agatkavh7a4>
From: "Cahoot Team" <bmainey@s1.servair.fr>
To: <netnakis1978@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:41:33 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <boa@ademe.fr>
Delivered-To: u003cservices@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 87-205-32-19.adsl.inetia.pl (87-205-32-19.adsl.inetia.pl [87.205.32.19])
    by [REMOVED] (Postfix) with SMTP id EA05D398173
    for <u003cservices@[REMOVED]>; Thu, 1 Mar 2012 16:04:58 +0000 (GMT)
Received: from unknown (HELO fexxr9) ([193.201.108.192])
    by 87-205-32-19.adsl.inetia.pl with ESMTP; Thu, 1 Mar 2012 17:05:54 +0100
Message-ID: <001401ccf7c5$0cf8c630$c1c96cc0@mariusz3bb54fcfexxr9>
From: "Cahoot Team" <boa@ademe.fr>
To: <u003cservices@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:01:20 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <bolgcapebluedumm@alpes-controles.fr>
Delivered-To: netordre@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from ns1.bellmicro.cl (unknown [200.111.102.116])
    by [REMOVED] (Postfix) with SMTP id 1D23B3981BC
    for <netordre@[REMOVED]>; Thu, 1 Mar 2012 17:23:34 +0000 (GMT)
Received: from unknown (HELO rt4f1e) ([91.120.98.207])
    by ns1.bellmicro.cl with ESMTP; Thu, 1 Mar 2012 14:27:10 -0400
Message-ID: <000701ccf7d0$02b29ce0$5b7862cf@EthanChangNBrt4f1e>
From: "Cahoot Team" <bolgcapebluedumm@alpes-controles.fr>
To: <netordre@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 14:19:33 -0400
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <carp@kermene.fr>
Delivered-To: netnasit_1962@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from unknown (HELO m5fl) ([216.43.71.157])
    by 190.151.54.26 with ESMTP; Thu, 1 Mar 2012 12:00:17 -0400
Message-ID: <001d01ccf7bb$7d404210$d82b479d@socialb4c18720m5fl>
From: "Cahoot Team" <carp@kermene.fr>
To: <netnasit_1962@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 11:52:36 -0400
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <ce@univ-tln.fr>
Delivered-To: geoff-nestolgu@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from host-91-227-3-104.radionet.info.pl (unknown [91.227.3.104])
    by [REMOVED] (Postfix) with SMTP id 5F6983981AC
    for <geoff-nestolgu@[REMOVED]>; Thu, 1 Mar 2012 17:18:26 +0000 (GMT)
Received: from unknown (HELO snmhf) ([218.151.26.197])
    by host-91-227-3-104.radionet.info.pl with ESMTP; Thu, 1 Mar 2012 18:23:37 +0100
Message-ID: <001601ccf7cf$5aa2c750$da971ac5@adminhsvx0ve35snmhf>
From: "Cahoot Team" <ce@univ-tln.fr>
To: <geoff-nestolgu@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:09:30 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <chris@kretztechnik.fr>
Delivered-To: services@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO ex84c) ([142.39.187.151])
    by 250-213-245-190.fibertel.com.ar with ESMTP; Thu, 1 Mar 2012 15:41:05 -0300
Message-ID: <003201ccf7d1$e8c9da30$8e27bb97@LeonardoPCex84c>
From: "Cahoot Team" <chris@kretztechnik.fr>
To: <services@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 15:34:43 -0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <darcie@appic.fr>
Delivered-To: kelly-netagdnu@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 41.208.186.171 (unknown [41.208.186.171])
    by [REMOVED] (Postfix) with SMTP id 6978A398195
    for <kelly-netagdnu@[REMOVED]>; Thu, 1 Mar 2012 17:34:25 +0000 (GMT)
Received: from unknown (HELO stiz6) ([185.24.133.80])
    by 41.208.186.171 with ESMTP; Thu, 1 Mar 2012 17:35:16 -0000
Message-ID: <000301ccf7d1$85efc2d0$b9188550@editionultrastiz6>
From: "Cahoot Team" <darcie@appic.fr>
To: <kelly-netagdnu@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:32:32 -0000
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <david.wood@kretztechnik.fr>
Delivered-To: nessemor2000@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from syau81de08.adsl.datanet.hu (syau81de08.adsl.datanet.hu [91.120.111.17])
    by [REMOVED] (Postfix) with SMTP id BEE33398195
    for <nessemor2000@[REMOVED]>; Thu, 1 Mar 2012 17:34:56 +0000 (GMT)
Received: from unknown (HELO tul) ([125.219.185.104])
    by syau81de08.adsl.datanet.hu with ESMTP; Thu, 1 Mar 2012 18:37:37 +0100
Message-ID: <002f01ccf7d1$95fbbb70$7ddbb968@9209d6ca89b3407tul>
From: "Cahoot Team" <david.wood@kretztechnik.fr>
To: <nessemor2000@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:25:24 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437


Return-Path: <denysbiz@eurofins.fr>
Delivered-To: netteewz_1991@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=unavailable
Received: from unknown (HELO lhrd) ([85.151.164.52])
    by 190.42.168.117 with ESMTP; Thu, 1 Mar 2012 09:19:36 -0500
Message-ID: <000601ccf7b5$d983da60$5597a434@miguelPClhrd>
From: "Cahoot Team" <denysbiz@eurofins.fr>
To: <netteewz_1991@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 09:14:24 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1250";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807


Return-Path: <editor@nantes.cci.fr>
Delivered-To: laha-neteils@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=unavailable
Received: from unknown (HELO gvf) ([238.36.104.204])
    by 220-136-167-159.dynamic.hinet.net with ESMTP; Thu, 1 Mar 2012 22:26:11 +0800
Message-ID: <002201ccf7b6$cf082db0$ee2468cc@PC1gvf>
From: "Cahoot Team" <editor@nantes.cci.fr>
To: <laha-neteils@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 22:17:59 +0800
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <elena.korbut@culture.fr>
Delivered-To: jer-netcejar@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO np1e) ([238.180.149.176])
    by 77.29.118.113 with ESMTP; Thu, 1 Mar 2012 17:22:30 +0100
Message-ID: <000c01ccf7c7$250f3d10$eeb495b0@clientnp1e>
From: "Cahoot Team" <elena.korbut@culture.fr>
To: <jer-netcejar@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:19:15 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <emb_nl@fracht.pl>
Delivered-To: phpbb_com@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from 66.175.144.84 (unknown [66.175.144.84])
    by [REMOVED] (Postfix) with SMTP id 46C9739819C
    for <phpbb_com@[REMOVED]>; Thu, 1 Mar 2012 14:54:53 +0000 (GMT)
Received: from unknown (HELO yd52m) ([72.191.117.207])
    by 66.175.144.84 with ESMTP; Thu, 1 Mar 2012 08:59:40 -0600
Message-ID: <001801ccf7bb$40a7de30$48bf75cf@owneredf13eb02yd52m>
From: "Cahoot Team" <emb_nl@fracht.pl>
To: <phpbb_com@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 08:48:47 -0600
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <ev@isep.fr>
Delivered-To: liliane-netppat@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from afea111.neoplus.adsl.tpnet.pl (afea111.neoplus.adsl.tpnet.pl [95.49.104.111])
    by [REMOVED] (Postfix) with SMTP id 1BC9C39818D
    for <liliane-netppat@[REMOVED]>; Thu, 1 Mar 2012 17:05:58 +0000 (GMT)
Received: from unknown (HELO eeu) ([67.86.59.120])
    by afea111.neoplus.adsl.tpnet.pl with ESMTP; Thu, 1 Mar 2012 18:07:23 +0100
Message-ID: <002401ccf7cd$932e8e80$43563b78@biuroeeu>
From: "Cahoot Team" <ev@isep.fr>
To: <liliane-netppat@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:04:48 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <financed@labanquepostale.fr>
Delivered-To: laha-neteils@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from c64-67.icpnet.pl (c64-67.icpnet.pl [62.21.64.67])
    by [REMOVED] (Postfix) with SMTP id EDF1F3981B8
    for <laha-neteils@[REMOVED]>; Thu, 1 Mar 2012 17:04:55 +0000 (GMT)
Received: from unknown (HELO wqcq) ([97.159.106.140])
    by c64-67.icpnet.pl with ESMTP; Thu, 1 Mar 2012 18:09:19 +0100
Message-ID: <002101ccf7cd$6ac31d30$619f6a8c@acerex5620wqcq>
From: "Cahoot Team" <financed@labanquepostale.fr>
To: <laha-neteils@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:58:14 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <gladka@univ-lyon1.fr>
Delivered-To: sts@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from ifv118.internetdsl.tpnet.pl (ifv118.internetdsl.tpnet.pl [79.189.151.118])
    by [REMOVED] (Postfix) with SMTP id 7D92A3981B1
    for <sts@[REMOVED]>; Thu, 1 Mar 2012 16:47:29 +0000 (GMT)
Received: from unknown (HELO jcdo7) ([158.188.48.91])
    by ifv118.internetdsl.tpnet.pl with ESMTP; Thu, 1 Mar 2012 17:49:33 +0100
Message-ID: <002c01ccf7ca$ffd2eed0$9ebc305b@fakturajcdo7>
From: "Cahoot Team" <gladka@univ-lyon1.fr>
To: <sts@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:37:49 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807


Return-Path: <gorod_30@adonix.fr>
Delivered-To: bemailservices@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO bpr) ([207.47.143.72])
    by 109.97.13.106 with ESMTP; Sat, 7 Oct 2006 06:24:58 +0200
Message-ID: <002d01c6e9bf$dd9e6b10$cf2f8f48@acasa62bec9e0fbpr>
From: "Cahoot Team" <gorod_30@adonix.fr>
To: <bemailservices@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Sat, 7 Oct 2006 06:14:08 +0200
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <intdep@ecpm.u-strasbg.fr>
Delivered-To: cloyd-netsobtn@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 96-39-6-66.static.oxfr.ma.charter.com (96-39-6-66.static.oxfr.ma.charter.com [96.39.6.66])
    by [REMOVED] (Postfix) with SMTP id BF7143981A2
    for <cloyd-netsobtn@[REMOVED]>; Thu, 1 Mar 2012 15:41:38 +0000 (GMT)
Received: from unknown (HELO pfalw) ([209.69.70.95])
    by 96-39-6-66.static.oxfr.ma.charter.com with ESMTP; Thu, 1 Mar 2012 10:43:10 -0500
Message-ID: <001d01ccf7c1$72d2ace0$d145465f@CADSTATION4HPpfalw>
From: "Cahoot Team" <intdep@ecpm.u-strasbg.fr>
To: <cloyd-netsobtn@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 10:38:09 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <jgoh@aix.cemagref.fr>
Delivered-To: carmina-nessolfl@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from client-200.121.216.207.speedy.net.pe (unknown [200.121.216.207])
    by [REMOVED] (Postfix) with SMTP id E9FD6398195
    for <carmina-nessolfl@[REMOVED]>; Thu, 1 Mar 2012 18:00:20 +0000 (GMT)
Received: from unknown (HELO n4377) ([209.197.82.202])
    by client-200.121.216.207.speedy.net.pe with ESMTP; Thu, 1 Mar 2012 13:03:17 -0500
Message-ID: <002c01ccf7d5$20fae4f0$d1c552ca@windowsf7c2c71n4377>
From: "Cahoot Team" <jgoh@aix.cemagref.fr>
To: <carmina-nessolfl@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 12:58:16 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506


Return-Path: <jizotova@wanadoo.fr>
Delivered-To: jer-netcejar@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=spam
Received: from brln-4d0c073b.pool.mediaWays.net (brln-4d0c073b.pool.mediaWays.net [77.12.7.59])
    by [REMOVED] (Postfix) with SMTP id 8F18F3981A2
    for <jer-netcejar@[REMOVED]>; Thu, 1 Mar 2012 15:32:01 +0000 (GMT)
Received: from unknown (HELO rp4x) ([43.97.107.136])
    by brln-4d0c073b.pool.mediaWays.net with ESMTP; Thu, 1 Mar 2012 16:34:35 +0100
Message-ID: <000d01ccf7c0$72ae5170$2b616b88@hornetrp4x>
From: "Cahoot Team" <jizotova@wanadoo.fr>
To: <jer-netcejar@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:29:56 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <jpittock@kretztechnik.fr>
Delivered-To: nethtisp1953@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO jxwgfp) ([121.77.176.225])
    by 108-26-19-190.fibertel.com.ar with ESMTP; Thu, 1 Mar 2012 14:53:35 -0300
Message-ID: <000901ccf7d3$afe65610$794db0e1@TutezePCjxwgfp>
From: "Cahoot Team" <jpittock@kretztechnik.fr>
To: <nethtisp1953@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 14:48:40 -0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1250";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <julia@lesverts.fr>
Delivered-To: nettahw1997@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=no
Received: from 93.84.99.180 (unknown [93.84.99.180])
    by [REMOVED] (Postfix) with SMTP id 121143981CF
    for <nettahw1997@[REMOVED]>; Thu, 1 Mar 2012 14:13:12 +0000 (GMT)
Received: from unknown (HELO pb6dlr) ([29.168.70.215])
    by 93.84.99.180 with ESMTP; Thu, 1 Mar 2012 17:16:32 +0300
Message-ID: <001701ccf7b5$c466e280$1da846d7@userpcpb6dlr>
From: "Cahoot Team" <julia@lesverts.fr>
To: <nettahw1997@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:11:45 +0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1250";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <kiev_shosse@pau.cci.fr>
Delivered-To: jue-neteirti@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO ec6gz) ([114.86.32.62])
    by 178.53.193.106 with ESMTP; Thu, 1 Mar 2012 20:15:55 +0300
Message-ID: <002f01ccf7ce$aed30390$7256203e@centkwPCec6gz>
From: "Cahoot Team" <kiev_shosse@pau.cci.fr>
To: <jue-neteirti@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 20:08:51 +0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158


Return-Path: <kla@kermene.fr>
Delivered-To: merideth-netsknea@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 81.60.149.56.dyn.user.ono.com (81.60.149.56.dyn.user.ono.com [81.60.149.56])
    by [REMOVED] (Postfix) with SMTP id 4494C39818D
    for <merideth-netsknea@[REMOVED]>; Thu, 1 Mar 2012 16:43:48 +0000 (GMT)
Received: from unknown (HELO h84l) ([58.181.35.53])
    by 81.60.149.56.dyn.user.ono.com with ESMTP; Mon, 29 Oct 2012 16:47:06 +0100
Message-ID: <002901cdb5ec$455a2f60$3ab52335@pch84l>
From: "Cahoot Team" <kla@kermene.fr>
To: <merideth-netsknea@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Mon, 29 Oct 2012 16:35:57 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <lesik@gsante.fr>
Delivered-To: alpo-netlaweg@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO m9o85) ([227.127.94.92])
    by 177.76.5.65 with ESMTP; Thu, 1 Mar 2012 13:47:50 -0300
Message-ID: <002401ccf7ca$c96a8ec0$e37f5e5c@novam9o85>
From: "Cahoot Team" <lesik@gsante.fr>
To: <alpo-netlaweg@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 13:37:08 -0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <letter@kretztechnik.fr>
Delivered-To: jue-neteirti@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=unavailable
Received: from unknown (HELO ocw9s) ([53.163.113.80])
    by 175.18.6.186.f.dyn.codetel.net.do with ESMTP; Thu, 1 Mar 2012 10:26:39 -0500
Message-ID: <000b01ccf7bf$744a6ab0$35a37150@theflakoocw9s>
From: "Cahoot Team" <letter@kretztechnik.fr>
To: <jue-neteirti@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 10:21:06 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <lukyan_main@mairie-bordeaux.fr>
Delivered-To: dawoon-netsreuf@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO rc5k1k) ([110.152.127.224])
    by 155.0.214.188-lidastv.ro with ESMTP; Thu, 1 Mar 2012 18:30:31 +0200
Message-ID: <002201ccf7c8$48905480$6e987fe0@kym90rc5k1k>
From: "Cahoot Team" <lukyan_main@mairie-bordeaux.fr>
To: <dawoon-netsreuf@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:22:20 +0200
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409


Return-Path: <l_molza@appic.fr>
Delivered-To: nessubei@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from dslb-188-109-177-241.pools.arcor-ip.net (dslb-188-109-177-241.pools.arcor-ip.net [188.109.177.241])
    by [REMOVED] (Postfix) with SMTP id 71BB13981A6
    for <nessubei@[REMOVED]>; Thu, 1 Mar 2012 15:41:23 +0000 (GMT)
Received: from unknown (HELO sa9) ([169.134.191.177])
    by dslb-188-109-177-241.pools.arcor-ip.net with ESMTP; Thu, 1 Mar 2012 16:45:40 +0100
Message-ID: <002e01ccf7c1$c11a8030$a986bfb1@PCPCsa9>
From: "Cahoot Team" <l_molza@appic.fr>
To: <nessubei@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:33:55 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <mail@listes.paris.iufm.fr>
Delivered-To: netsotso2005@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from c160-238.icpnet.pl (c160-238.icpnet.pl [85.221.160.238])
    by [REMOVED] (Postfix) with SMTP id 2A1213981B8
    for <netsotso2005@[REMOVED]>; Thu, 1 Mar 2012 18:17:02 +0000 (GMT)
Received: from unknown (HELO lg6nw) ([71.151.41.125])
    by c160-238.icpnet.pl with ESMTP; Thu, 1 Mar 2012 19:21:26 +0100
Message-ID: <002001ccf7d7$7fc15df0$4797297d@core2duolg6nw>
From: "Cahoot Team" <mail@listes.paris.iufm.fr>
To: <netsotso2005@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 19:07:02 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <me@bde.espci.fr>
Delivered-To: hnicdlsupport@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO r9f1) ([122.108.28.113])
    by 093105110063.pila.vectranet.pl with ESMTP; Thu, 1 Mar 2012 17:36:41 +0100
Message-ID: <001b01ccf7c9$2c40e780$7a6c1c71@xdeba68bf922d4r9f1>
From: "Cahoot Team" <me@bde.espci.fr>
To: <hnicdlsupport@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:29:19 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <misevra@oddo.fr>
Delivered-To: antanas-netaregr@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from user-164-126-39-211.play-internet.pl (user-164-126-39-211.play-internet.pl [164.126.39.211])
    by [REMOVED] (Postfix) with SMTP id 489FE3981AD
    for <antanas-netaregr@[REMOVED]>; Thu, 1 Mar 2012 16:19:05 +0000 (GMT)
Received: from unknown (HELO oi564) ([214.53.158.45])
    by user-164-126-39-211.play-internet.pl with ESMTP; Thu, 1 Mar 2012 17:21:39 +0100
Message-ID: <002901ccf7c7$065cf650$d6359e2d@zz9c4009d414d0oi564>
From: "Cahoot Team" <misevra@oddo.fr>
To: <antanas-netaregr@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:15:41 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <mke@siac.fr>
Delivered-To: netarrov1950@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from h253.127.149.24.cable.bdfr.jetbroadband.com (h253.127.149.24.cable.bdfr.jetbroadband.com [24.149.127.253])
    by [REMOVED] (Postfix) with SMTP id 2E0AD39819C
    for <netarrov1950@[REMOVED]>; Thu, 1 Mar 2012 17:50:47 +0000 (GMT)
Received: from unknown (HELO 9dja9m) ([165.139.126.70])
    by h253.127.149.24.cable.bdfr.jetbroadband.com with ESMTP; Thu, 1 Mar 2012 12:51:56 -0500
Message-ID: <001701ccf7d3$d4331760$a58b7e46@GESA11Laptop9dja9m>
From: "Cahoot Team" <mke@siac.fr>
To: <netarrov1950@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 12:45:16 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <naomi.mclennan@afssaps.sante.fr>
Delivered-To: netrerai_1995@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from host-89-228-164-70.lodz.mm.pl (host-89-228-164-70.lodz.mm.pl [89.228.164.70])
    by [REMOVED] (Postfix) with SMTP id 4C7AD3981B8
    for <netrerai_1995@[REMOVED]>; Thu, 1 Mar 2012 18:15:54 +0000 (GMT)
Received: from unknown (HELO duzgi) ([157.110.87.44])
    by host-89-228-164-70.lodz.mm.pl with ESMTP; Thu, 1 Mar 2012 19:18:50 +0100
Message-ID: <001301ccf7d7$519bb510$9d6e572c@wojtek1489efa3duzgi>
From: "Cahoot Team" <naomi.mclennan@afssaps.sante.fr>
To: <netrerai_1995@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 19:11:21 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409


Return-Path: <nicolas@free.fr>
Delivered-To: netsoksk_1985@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from 95.9.103.72.static.ttnet.com.tr (unknown [95.9.103.72])
    by [REMOVED] (Postfix) with SMTP id 5A13F3981D9
    for <netsoksk_1985@[REMOVED]>; Thu, 1 Mar 2012 14:53:17 +0000 (GMT)
Received: from unknown (HELO klyk9m) ([163.95.215.75])
    by 95.9.103.72.static.ttnet.com.tr with ESMTP; Thu, 1 Mar 2012 16:57:31 +0200
Message-ID: <000401ccf7bb$082a59c0$a35fd74b@7b880a7c97714c4klyk9m>
From: "Cahoot Team" <nicolas@free.fr>
To: <netsoksk_1985@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:48:21 +0200
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <o.kirilishin@aix.cemagref.fr>
Delivered-To: netgearh_1977@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from 83.142.200.230 (unknown [83.142.200.230])
    by [REMOVED] (Postfix) with SMTP id 4E91A3981AC
    for <netgearh_1977@[REMOVED]>; Thu, 1 Mar 2012 15:13:55 +0000 (GMT)
Received: from unknown (HELO c4qt) ([107.127.165.195])
    by 83.142.200.230 with ESMTP; Thu, 1 Mar 2012 16:17:15 +0100
Message-ID: <001601ccf7bd$eaac1ed0$6b7fa5c3@pc640186c4qt>
From: "Cahoot Team" <o.kirilishin@aix.cemagref.fr>
To: <netgearh_1977@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:08:25 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807


Return-Path: <oksana.borshch@irene.fr>
Delivered-To: merideth-netsknea@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.504
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.504 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PSBL=2.7, RCVD_IN_XBL=0.375,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, XMAILER_MIMEOLE_OL_8627E=2.422]
    autolearn=unavailable
Received: from 92.83.188.152 (unknown [92.83.188.152])
    by [REMOVED] (Postfix) with SMTP id E31433981CF
    for <merideth-netsknea@[REMOVED]>; Thu, 1 Mar 2012 14:11:31 +0000 (GMT)
Received: from unknown (HELO 2l4w) ([39.169.182.240])
    by 92.83.188.152 with ESMTP; Thu, 1 Mar 2012 16:14:58 +0200
Message-ID: <000d01ccf7b5$32935780$27a9b6f0@nfdtty34132ee82l4w>
From: "Cahoot Team" <oksana.borshch@irene.fr>
To: <merideth-netsknea@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:09:04 +0200
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409


Return-Path: <oksana.poltoratskaja@patrimoine-en-ligne.fr>
Delivered-To: nessubei@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from host86-158-72-203.range86-158.btcentralplus.com (host86-158-72-203.range86-158.btcentralplus.com [86.158.72.203])
    by [REMOVED] (Postfix) with SMTP id 0DFE839819C
    for <nessubei@[REMOVED]>; Thu, 1 Mar 2012 17:07:44 +0000 (GMT)
Received: from unknown (HELO b8h) ([116.42.43.205])
    by host86-158-72-203.range86-158.btcentralplus.com with ESMTP; Thu, 1 Mar 2012 17:11:12 -0000
Message-ID: <002301ccf7cd$d10e3f70$742a2bcd@your7177bad9ffb8h>
From: "Cahoot Team" <oksana.poltoratskaja@patrimoine-en-ligne.fr>
To: <nessubei@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:57:54 -0000
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <oleksandr.gulyuk@lermab.uhp-nancy.fr>
Delivered-To: cemailinternal@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO hxv) ([36.76.43.239])
    by 153.cobranet.org with ESMTP; Thu, 1 Mar 2012 16:41:08 +0100
Message-ID: <003201ccf7c1$1e9f0ab0$244c2bef@DTIpchxv>
From: "Cahoot Team" <oleksandr.gulyuk@lermab.uhp-nancy.fr>
To: <cemailinternal@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:27:06 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <onishenko-olga@plurielassurances.fr>
Delivered-To: netsoksk_1985@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from cpc15-haye16-2-0-cust451.haye.cable.virginmedia.com (cpc15-haye16-2-0-cust451.haye.cable.virginmedia.com [80.194.3.196])
    by [REMOVED] (Postfix) with SMTP id 57A123981BC
    for <netsoksk_1985@[REMOVED]>; Thu, 1 Mar 2012 17:17:12 +0000 (GMT)
Received: from unknown (HELO 4itzq) ([63.161.151.156])
    by cpc15-haye16-2-0-cust451.haye.cable.virginmedia.com with ESMTP; Thu, 1 Mar 2012 17:19:11 -0000
Message-ID: <001801ccf7cf$21258620$3fa1979c@VojtaPC4itzq>
From: "Cahoot Team" <onishenko-olga@plurielassurances.fr>
To: <netsoksk_1985@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:07:33 -0000
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158


Return-Path: <o_shylkarelko@univ-paris8.fr>
Delivered-To: hyeong-netrabnn@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO rkia7z) ([42.88.105.78])
    by 2.76.52.166 with ESMTP; Thu, 1 Mar 2012 19:33:30 +0300
Message-ID: <001f01ccf7c8$612227d0$2a58694e@LocalHostrkia7z>
From: "Cahoot Team" <o_shylkarelko@univ-paris8.fr>
To: <hyeong-netrabnn@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 19:23:38 +0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437


Return-Path: <paliy@elp.fr>
Delivered-To: cybele-netseoul@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=unavailable
Received: from 95.9.147.140.static.ttnet.com.tr (unknown [95.9.147.140])
    by [REMOVED] (Postfix) with SMTP id 6ED633981D2
    for <cybele-netseoul@[REMOVED]>; Thu, 1 Mar 2012 14:23:01 +0000 (GMT)
Received: from unknown (HELO hvt5cs) ([218.49.78.104])
    by 95.9.147.140.static.ttnet.com.tr with ESMTP; Thu, 1 Mar 2012 16:24:38 +0200
Message-ID: <000701ccf7b6$cd4bb0a0$da314e68@antkayserhvt5cs>
From: "Cahoot Team" <paliy@elp.fr>
To: <cybele-netseoul@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:20:44 +0200
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <postmaster@fujikiko-faf.fr>
Delivered-To: nettamru1968@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=unavailable
Received: from 50-77-242-22-static.hfc.comcastbusiness.net (50-77-242-22-static.hfc.comcastbusiness.net [50.77.242.22])
    by [REMOVED] (Postfix) with SMTP id 3A65E3981D9
    for <nettamru1968@[REMOVED]>; Thu, 1 Mar 2012 14:15:00 +0000 (GMT)
Received: from unknown (HELO 1ozr76) ([113.25.51.119])
    by 50-77-242-22-static.hfc.comcastbusiness.net with ESMTP; Thu, 1 Mar 2012 09:15:55 -0500
Message-ID: <000901ccf7b5$aed13830$71193377@MargaretPC1ozr76>
From: "Cahoot Team" <postmaster@fujikiko-faf.fr>
To: <nettamru1968@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 09:10:12 -0500
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1250";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807


Return-Path: <pvjommon@xl-energy-drink.fr>
Delivered-To: netiezes2006@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from 95.56.19.158 (unknown [95.56.19.158])
    by [REMOVED] (Postfix) with SMTP id 3C7963981C7
    for <netiezes2006@[REMOVED]>; Thu, 1 Mar 2012 15:20:44 +0000 (GMT)
Received: from unknown (HELO 6wr) ([107.175.140.94])
    by 95.56.19.158 with ESMTP; Thu, 1 Mar 2012 21:23:03 +0600
Message-ID: <000901ccf7be$dea53e40$b71928b7@c27f1917d07a4046wr>
From: "Cahoot Team" <pvjommon@xl-energy-drink.fr>
To: <netiezes2006@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 21:14:05 +0600
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1250";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <raymond.nash@interdeco.fr>
Delivered-To: nessuk1994@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from host-81-190-207-44.gorzow.mm.pl (host-81-190-207-44.gorzow.mm.pl [81.190.207.44])
    by [REMOVED] (Postfix) with SMTP id E1A0E398195
    for <nessuk1994@[REMOVED]>; Thu, 1 Mar 2012 17:43:30 +0000 (GMT)
Received: from unknown (HELO fhmzq) ([149.58.195.231])
    by host-81-190-207-44.gorzow.mm.pl with ESMTP; Thu, 1 Mar 2012 18:46:01 +0100
Message-ID: <001001ccf7d2$d03886a0$953ac3e7@hans007fhmzq>
From: "Cahoot Team" <raymond.nash@interdeco.fr>
To: <nessuk1994@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:36:19 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437


Return-Path: <roma@s1.servair.fr>
Delivered-To: info@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 12.087
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.087 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_SORBS_DUL=0.001, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001] autolearn=unavailable
Received: from 91.140.178.180 (unknown [91.140.178.180])
    by [REMOVED] (Postfix) with SMTP id C88843981D1
    for <info@[REMOVED]>; Thu, 1 Mar 2012 14:20:07 +0000 (GMT)
Received: from unknown (HELO voljmx) ([143.111.67.236])
    by 91.140.178.180 with ESMTP; Thu, 1 Mar 2012 17:21:36 +0300
Message-ID: <000801ccf7b6$65770830$8f6f43ec@asusebcvoljmx>
From: "Cahoot Team" <roma@s1.servair.fr>
To: <info@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:14:17 +0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <sambailey@univ-lille2.fr>
Delivered-To: netteewz_1991@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO uu8xma) ([166.177.50.66])
    by 78-2-25-246.adsl.net.t-com.hr with ESMTP; Thu, 1 Mar 2012 18:24:53 +0100
Message-ID: <002901ccf7cf$de913150$a6b13242@kumuu8xma>
From: "Cahoot Team" <sambailey@univ-lille2.fr>
To: <netteewz_1991@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:13:42 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <scribe.ru@univ-paris8.fr>
Delivered-To: hphosts@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from unknown (HELO 1hiepc) ([210.78.124.74])
    by 173.192.221.119-static.reverse.softlayer.com with ESMTP; Thu, 1 Mar 2012 20:33:28 +0330
Message-ID: <002001ccf7cc$bbb370b0$d24e7c4a@MohammadPC1hiepc>
From: "Cahoot Team" <scribe.ru@univ-paris8.fr>
To: <hphosts@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 20:24:43 +0330
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807


Return-Path: <simferopol@eco.u-cergy.fr>
Delivered-To: liliane-netppat@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from user-31-175-10-217.play-internet.pl (user-31-175-10-217.play-internet.pl [31.175.10.217])
    by [REMOVED] (Postfix) with SMTP id 1B0FE3981AD
    for <liliane-netppat@[REMOVED]>; Thu, 1 Mar 2012 16:21:16 +0000 (GMT)
Received: from unknown (HELO kt8) ([154.148.77.140])
    by user-31-175-10-217.play-internet.pl with ESMTP; Thu, 1 Mar 2012 17:25:33 +0100
Message-ID: <000a01ccf7c7$50f8b190$9a944d8c@fujitsuv5535kt8>
From: "Cahoot Team" <simferopol@eco.u-cergy.fr>
To: <liliane-netppat@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 17:18:44 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <smurphy@dr4.cnrs.fr>
Delivered-To: netnum2005@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from dsl-188-34-123-145.asretelecom.net (unknown [188.34.123.145])
    by [REMOVED] (Postfix) with SMTP id 8B6AB3981B1
    for <netnum2005@[REMOVED]>; Thu, 1 Mar 2012 17:32:37 +0000 (GMT)
Received: from unknown (HELO tbyo) ([208.112.49.196])
    by dsl-188-34-123-145.asretelecom.net with ESMTP; Sun, 1 Jan 2012 04:31:28 +0330
Message-ID: <002701ccc820$b31099a0$d07031c4@usera2888e463dtbyo>
From: "Cahoot Team" <smurphy@dr4.cnrs.fr>
To: <netnum2005@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Sun, 1 Jan 2012 04:22:43 +0330
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <steel@teleperformance.fr>
Delivered-To: netsirup_1955@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from user-94-254-205-113.play-internet.pl (unknown [94.254.205.113])
    by [REMOVED] (Postfix) with SMTP id 1D9A13981A1
    for <netsirup_1955@[REMOVED]>; Thu, 1 Mar 2012 17:12:32 +0000 (GMT)
Received: from unknown (HELO sdb3) ([206.134.84.138])
    by user-94-254-205-113.play-internet.pl with ESMTP; Thu, 1 Mar 2012 18:12:48 +0100
Message-ID: <002c01ccf7ce$78340320$ce86548a@coa12sdb3>
From: "Cahoot Team" <steel@teleperformance.fr>
To: <netsirup_1955@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:06:34 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <stj@eirp.pl>
Delivered-To: netskcid_1974@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from iww139.internetdsl.tpnet.pl (iww139.internetdsl.tpnet.pl [95.48.74.139])
    by [REMOVED] (Postfix) with SMTP id 4A7EE398195
    for <netskcid_1974@[REMOVED]>; Thu, 1 Mar 2012 17:29:32 +0000 (GMT)
Received: from unknown (HELO egto) ([223.203.149.63])
    by iww139.internetdsl.tpnet.pl with ESMTP; Thu, 1 Mar 2012 18:33:33 +0100
Message-ID: <000801ccf7d0$ce28a450$dfcb953f@angelsegto>
From: "Cahoot Team" <stj@eirp.pl>
To: <netskcid_1974@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 18:28:23 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106


Return-Path: <v.borzenkov@connemara.fr>
Delivered-To: netnum2005@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 10.306
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.306 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335,
    RCVD_IN_RP_RNBL=1.31, RCVD_IN_SORBS_DUL=0.001, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, TVD_FINGER_02=1.215]
    autolearn=unavailable
Received: from unknown (HELO aev) ([67.25.60.115])
    by 141.105.170.60 with ESMTP; Thu, 1 Mar 2012 15:47:46 +0100
Message-ID: <000601ccf7b9$c95d5810$43193c73@xpsp3compaev>
From: "Cahoot Team" <v.borzenkov@connemara.fr>
To: <netnum2005@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 15:37:40 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437


Return-Path: <viacheslav.timoshenko@appic.fr>
Delivered-To: cybele-netseoul@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 94.20.169.153 (unknown [94.20.169.153])
    by [REMOVED] (Postfix) with SMTP id 55A4B3981B1
    for <cybele-netseoul@[REMOVED]>; Thu, 1 Mar 2012 16:51:50 +0000 (GMT)
Received: from unknown (HELO fmvf34) ([166.85.180.149])
    by 94.20.169.153 with ESMTP; Wed, 29 Feb 2012 20:54:34 +0300
Message-ID: <000301ccf70a$d2e2bbf0$a655b495@microsof439901fmvf34>
From: "Cahoot Team" <viacheslav.timoshenko@appic.fr>
To: <cybele-netseoul@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Wed, 29 Feb 2012 20:51:09 +0300
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <wbsily@fbs-elec.fr>
Delivered-To: haroon-netgungr@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from pool-72-87-63-55.ptldme.east.myfairpoint.net (pool-72-87-63-55.ptldme.east.myfairpoint.net [72.87.63.55])
    by [REMOVED] (Postfix) with SMTP id 2F81B3981B8
    for <haroon-netgungr@[REMOVED]>; Thu, 1 Mar 2012 16:27:00 +0000 (GMT)
Received: from unknown (HELO sye4y) ([118.230.136.197])
    by pool-72-87-63-55.ptldme.east.myfairpoint.net with ESMTP; Thu, 1 Mar 2012 11:27:45 -0600
Message-ID: <002101ccf7d0$7ddb3d00$76e688c5@MYLENOVOPCsye4y>
From: "Cahoot Team" <wbsily@fbs-elec.fr>
To: <haroon-netgungr@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 11:18:25 -0600
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-1";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <yulya@s1.servair.fr>
Delivered-To: dimitri-nethinim@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 9.966
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.966 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_1=2.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
    STOX_REPLY_TYPE=0.439, STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757,
    TVD_FINGER_02=1.215, TVD_RCVD_IP=0.001, TVD_RCVD_IP4=0.001]
    autolearn=unavailable
Received: from 49.0.159.251 (unknown [49.0.159.251])
    by [REMOVED] (Postfix) with SMTP id BA6263981CD
    for <dimitri-nethinim@[REMOVED]>; Thu, 1 Mar 2012 15:19:32 +0000 (GMT)
Received: from unknown (HELO t9qa) ([172.194.167.87])
    by 49.0.159.251 with ESMTP; Thu, 1 Mar 2012 23:20:17 -0800
Message-ID: <002c01ccf844$cc61fc60$acc2a757@tsogoo473038d2t9qa>
From: "Cahoot Team" <yulya@s1.servair.fr>
To: <dimitri-nethinim@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 23:16:34 -0800
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="windows-1252";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180


Return-Path: <zyijli98oq@teleperformance.fr>
Delivered-To: elfinn-netralke@[REMOVED]
X-Spam-Flag: YES
X-Spam-Score: 13.342
X-Spam-Level: *************
X-Spam-Status: Yes, score=13.342 tagged_above=-9999 required=1.3
    tests=[BAYES_50=0.8, RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
    RCVD_IN_XBL=0.375, STOX_REPLY_TYPE=0.439,
    STOX_REPLY_TYPE_WITHOUT_QUOTES=1.757, URIBL_WS_SURBL=1.608]
    autolearn=unavailable
Received: from 89.204.130.10 (unknown [89.204.130.10])
    by [REMOVED] (Postfix) with SMTP id 89C2B398173
    for <elfinn-netralke@[REMOVED]>; Thu, 1 Mar 2012 15:48:08 +0000 (GMT)
Received: from unknown (HELO 78uz7) ([40.223.126.231])
    by 89.204.130.10 with ESMTP; Thu, 1 Mar 2012 16:49:56 +0100
Message-ID: <001e01ccf7c2$b2054e30$28df7ee7@AsusX50V78uz7>
From: "Cahoot Team" <zyijli98oq@teleperformance.fr>
To: <elfinn-netralke@[REMOVED]>
Subject: [SPAM] Cahoot: You have a new alert from Cahoot
Date: Thu, 1 Mar 2012 16:47:15 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="iso-8859-2";
    reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158


On the plus side, this prompted me to write a small update to the Outlook Export program (update was only an option to export e-mail headers, without exporting everything else, which saves time parsing files when I only want certain data).