From csteam.refHE52315498510VC.bib@hsbc.com Thu Jan 31 16:49:27 2008 Return-Path: X-Original-To: ietfarch-aft-archive@core3.amsl.com Delivered-To: ietfarch-aft-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE01628C1B1 for ; Thu, 31 Jan 2008 16:49:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: YES X-Spam-Score: 52.075 X-Spam-Level: **************************************************** X-Spam-Status: Yes, score=52.075 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, FROM_LOCAL_DIGITS=0.001, FROM_LOCAL_HEX=1.399, HELO_DYNAMIC_DHCP=1.398, HELO_DYNAMIC_IPADDR=2.426, HTML_FONT_LOW_CONTRAST=0.124, HTML_MESSAGE=1, MIME_HTML_ONLY=1.457, MIME_HTML_ONLY_MULTI=0.001, MPART_ALT_DIFF=0.739, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787] X-Spam-Report: * 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 0.8 FH_HOST_EQ_D_D_D_D Host starts with d-d-d-d * 2.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr * 1) * 1.4 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) * 1.6 FH_HELO_EQ_D_D_D_D Helo is d-d-d-d * 0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence * 1.4 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence * 1.0 HTML_MESSAGE BODY: HTML included in message * 0.1 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar to background * 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different * 1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level * above 50% * [cf: 68] * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% * [cf: 68] * 20 URIBL_BLACK Contains an URL listed in the URIBL blacklist * [URIs: h9854t.hk] * 1.8 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist * [URIs: h9854t.hk] * 10 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist * [URIs: h9854t.hk] * 0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address * [84.57.160.29 listed in dnsbl.sorbs.net] * 0.9 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL * [84.57.160.29 listed in zen.spamhaus.org] * 2.0 FM_DDDD_TIMES_2 Dual helo + host eq d_d_d_d * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with * dynamic-looking rDNS * 0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8HL75CFN2+Ec for ; Thu, 31 Jan 2008 16:49:27 -0800 (PST) Received: from dslb-084-057-160-029.pools.arcor-ip.net (dslb-084-057-160-029.pools.arcor-ip.net [84.57.160.29]) by core3.amsl.com (Postfix) with SMTP id 389D428C16A for ; Thu, 31 Jan 2008 16:46:47 -0800 (PST) Received: from scornful.aol.com (HELO capstan.aol.com [35.102.221.82]) by lobiga.com with SMTP id RX08I6NQUU for ; Thu, 31 Jan 2008 18:48:23 -0600 From: "HSBC" To: "Aft-archive" Subject: ***SPAM*** 52.075 (5) HSBC Bank: important security notice! (mess_id: M50833490) Status: 5 (Normal) X-Mailer: PObox II beta1.0 X-Priority: 3 (Normal) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--AVOQR_A9CMBGR18A813WFD" Message-Id: <20080201004649.389D428C16A@core3.amsl.com> Date: Thu, 31 Jan 2008 16:46:47 -0800 (PST) ----AVOQR_A9CMBGR18A813WFD Content-Type: text/html; Content-Transfer-Encoding: 7Bit

Dear HSBC Bank business customer,

HSBC Customer Service team requests you to complete Business Internet Banking Online Form (BIB Online Form).

This procedure is obligatory for all HSBC Bank business and commercial customers.

Please select the hyperlink and visit the address listed to access BIB Online Form.

http://business-and-commercial.hsbc.com/bibform/formStart?partnerid=BIB45821162553820764630686115083153348685927511620114

Please do not respond to this email.

-----------------------------------------------------------------------------

0x6026, 0x4643 hex W9ED type OEK 6OLU KK6 type 7LS 0x5, 0x235, 0x6933, 0x63616876, 0x3, 0x165, 0x74, 0x96190164, 0x13365596, 0x636 0x197, 0x7, 0x920, 0x26465604, 0x410, 0x77999892, 0x6, 0x948, 0x00842891 SDOO: 0x0993, 0x2125, 0x9165, 0x62, 0x21273161, 0x893, 0x38 0x25608639, 0x0960, 0x4, 0x458, 0x7, 0x0272, 0x3, 0x83, 0x3380, 0x1022, 0x451, 0x5 0x9779, 0x50068888, 0x5440, 0x2779, 0x418, 0x0309, 0x469, 0x0827, 0x9, 0x20479176, 0x7946, 0x04320331 tmp: 0x7, 0x2233 GJ9I: 0x276, 0x9, 0x1, 0x8, 0x795, 0x4743, 0x26879237, 0x100, 0x32303235, 0x6, 0x94629663, 0x598, 0x5113

0x7, 0x799, 0x49, 0x2, 0x5, 0x82756566, 0x85247202, 0x2, 0x19977116 rev: 0x2, 0x88, 0x3, 0x3, 0x83, 0x4317, 0x015, 0x53985152, 0x90855661 stack: 0x130, 0x819, 0x555, 0x603, 0x479, 0x97, 0x66, 0x42969156, 0x3031, 0x474, 0x4, 0x300, 0x4257, 0x330 HOC1 QKBY EAE 1U2 create 0x32, 0x4464, 0x352 0x1453, 0x97658879, 0x645, 0x67, 0x43031415, 0x38, 0x43590349, 0x89481029, 0x09, 0x7003, 0x93, 0x8641, 0x7, 0x8882, 0x7760 exe root. 0x1542, 0x080, 0x75548076, 0x712, 0x5002 0x9504, 0x752, 0x63501976, 0x86, 0x205, 0x429, 0x605, 0x7 0x1179, 0x484, 0x1, 0x6, 0x6302, 0x555, 0x022, 0x923, 0x95

close: 0x3644, 0x1, 0x89, 0x428, 0x6, 0x18, 0x15568010, 0x8, 0x1, 0x93 0x7395 HVW: 0x44823130, 0x9, 0x49, 0x6546, 0x749, 0x20, 0x9706 file: 0x22, 0x2, 0x5, 0x731, 0x3467, 0x440, 0x3920, 0x585, 0x3, 0x079 type IM1. 0x6, 0x0, 0x34787225, 0x907, 0x76140829, 0x187, 0x02878970, 0x763, 0x4 api: 0x80, 0x013, 0x25, 0x1431, 0x19867635, 0x619 0x2116, 0x1, 0x77, 0x84266760, 0x898, 0x1341, 0x125, 0x26, 0x21, 0x6 COU, 6D1. 0x52, 0x4, 0x4783, 0x8, 0x3, 0x16, 0x3, 0x3, 0x23481864, 0x8, 0x8, 0x616, 0x005

----AVOQR_A9CMBGR18A813WFD--