Subject: Re: [feedback-report] Let's get started
From: Ricardo Signes <[email-masked]>
To: [email-masked]
Date: Thu, 31 Dec 2009 13:08:32 -0500
List-Id: Public forum for discussion on the feedback-report draft <abuse-feedback-report.mipassoc.org>

* "John R. Levine" <[email-masked]> [2009-12-31T11:57:42]
> > Adding it and making it not mandatory makes no sense for me.
> 
> Right.  Since there's no way to force ARF senders to do anything, this 
> means that in practice it would be useless.

I think "useless" is an overstatement... maybe.  After all, I guess I already
said I'd have no use for it.

This seems like a place where the real solution is education: people need to
learn how to track their deliveries properly, and by a plain addr-spec in the
headers isn't that.

-- 
rjbs

Date: 31 Dec 2009 11:57:42 -0500
From: "John R. Levine" <[email-masked]>
To: "Tobias Knecht" <[email-masked]>
Cleverness: None detected
Cc: [email-masked]
Subject: Re: [feedback-report] Let's get started

> Adding it and making it not mandatory makes no sense for me.

Right.  Since there's no way to force ARF senders to do anything, this 
means that in practice it would be useless.

Let's leave it in reserve in case we need a bone to throw to the 
never-redact or always-redact crowd.

R's from snowbound Vermont,
John

Date: Thu, 31 Dec 2009 16:10:17 +0100
From: Tobias Knecht <[email-masked]>
Organization: abusix UG =?ISO-8859-1?Q?=28haftungsbeschr=E4nkt=29?=
CC: [email-masked]
Subject: Re: [feedback-report] Let's get started

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig444EE5012B8F0704F1073BED
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Ricardo Signes schrieb:
> * "Murray S. Kucherawy" <[email-masked]> [2009-12-30T01:52:06]
>>> I did not mean to imply that the X.400 header should be used, rather
>>> it is an example. The question is whether it is worthwhile to defined=

>>> a header for part 2 of the ARF reports like this:
>>>
>>> Content-Redacted: Yes
>> I think it is.  And we don't need to register it because it exists in =
a
>> format we're defining ourselves, not in the message header proper.
>>
>> Anyone object, or shall I add this and adjust various wording accordin=
gly?
>=20
> I think it would be nice to know, although I would be hard pressed to f=
eel I
> could trust it.  I'm not sure how I could use it, either, given the low=
 level
> of trust.  If the assumed value is "Yes" and the real value-added versi=
on is
> "No" added only when it is really promised, then maybe it would be usef=
ul for
> checking DKIM or other secure data.

Adding it and making it not mandatory makes no sense for me.
Because you have no continous information. Everybody could do whatever
he wants to. And everybody would have to describe what he is redacting.
Perhaps somebody is redacting internal header fields that have nothing
to do with the mail it self and tells you he is redacting information.
Sounds stupd but I'm sure if somebody implementing such a system just
with a view on the draft (later rfc) he will do things that way.

> Using secure X-headers and other features of the message that have been=

> reliably untouched in the past has been much more successful than I thi=
nk we
> would have been, even had we known the message was pristene.

Full ACK. We have this in place at several ISPs in Europe and it works
like a charm.

> So: yeah, let's include it as a valid, but not mandate it as must-inclu=
de,
> since it will be hard to know.  If nothing else, it can put an end to q=
uestions
> about whether it exists.

See above.

Tobias

p.s.: Happy New Year. ;-)

--------------enig444EE5012B8F0704F1073BED
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

--------------enig444EE5012B8F0704F1073BED--

Date: Thu, 31 Dec 2009 09:21:19 -0500
From: Ricardo Signes <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] Let's get started

* "Murray S. Kucherawy" <[email-masked]> [2009-12-30T01:52:06]
> > I did not mean to imply that the X.400 header should be used, rather
> > it is an example. The question is whether it is worthwhile to defined
> > a header for part 2 of the ARF reports like this:
> > 
> > Content-Redacted: Yes
> 
> I think it is.  And we don't need to register it because it exists in a
> format we're defining ourselves, not in the message header proper.
> 
> Anyone object, or shall I add this and adjust various wording accordingly?

I think it would be nice to know, although I would be hard pressed to feel I
could trust it.  I'm not sure how I could use it, either, given the low level
of trust.  If the assumed value is "Yes" and the real value-added version is
"No" added only when it is really promised, then maybe it would be useful for
checking DKIM or other secure data.

Using secure X-headers and other features of the message that have been
reliably untouched in the past has been much more successful than I think we
would have been, even had we known the message was pristene.

So: yeah, let's include it as a valid, but not mandate it as must-include,
since it will be hard to know.  If nothing else, it can put an end to questions
about whether it exists.

-- 
rjbs

From: "J.D. Falk" <[email-masked]>
Date: Wed, 30 Dec 2009 12:44:18 -0700
To: ARF mailing list <[email-masked]>
Subject: [feedback-report] redaction (was Re:  Let's get started)

On Dec 30, 2009, at 12:02 AM, John R. Levine wrote:

>>> Content-Redacted: Yes
>> 
>> I think it is.  And we don't need to register it because it exists in a format we're defining ourselves, not in the message header proper.
>> 
>> Anyone object, or shall I add this and adjust various wording accordingly?
> 
> I don't have any theological objections, but it might be interesting to 
> ask RR, AOL, and other ARF senders who redact whether they'd be likely to 
> add it.

Of the FBLs we run (including RR), some partners redact messages before sending 'em to us and others require that we redact before generating the outgoing ARF report.  It's up to them.

I think we'd take a similar approach with this Content-Redacted line: if they redact and are okay with us including the line, we will (and that's what we'll recommend.)  But if they say no for some reason, we won't.

I'd propose that ARF generators who intentionally redact any content from the original message SHOULD include "Content-Redacted: Yes", and MUST NOT say "Content-Redacted: No" -- but the Content-Redacted is optional whether they redact or not.

As for whether to indicate that content was redacted at all...it's almost entirely a political-layer issue:

1. some ARF generators redact content from the original message before generating ARF, usually citing legal/privacy concerns
2. many ARF recipients don't think that's fair
3. years of arguing has not changed the practice

Thinking about automated processing when receiving ARF reports...if the report were known to be missing some content, I might not attempt a DKIM check or other hashing on the message part.  Other than that...not sure it matters.

Truly, I think the primary reason to include this is so that people stop asking us to include it.  And I know that's not a good enough reason.

--
J.D. Falk <[email-masked]>
Return Path Inc

Date: Wed, 30 Dec 2009 16:13:38 +0100
From: Tobias Knecht <[email-masked]>
Organization: abusix UG =?ISO-8859-1?Q?=28haftungsbeschr=E4nkt=29?=
CC: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigEBF470864127951C13DF43E6
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

John R. Levine schrieb:
>> That is exactly what my reasoning was as well. This flag is not useful=

>> for automation but is very useful for troubleshooting and manual
>> review. Knowing that the message was redacted helps a lot when looking=

>> at problems.
>=20
> All the redacted messages I get say "redacted" or something equally=20
> obvious in the places where they've removed user info.  Has anyone seen=
 an=20
> ARF report where it was hard to tell what had been removed?

I fully agree with John here. (rare but it happens sometimes ;-)

Using the email address for customer allocation or finding the right
address to delete from a maillinglist is imho not the best way.
Allocation can be done automatically via message-id and logs, which
indeed is a pain or by adding an encrypted x-header that contains all
relevant data.

So I think an additional redacted header is not necessary.

Tobias

--------------enigEBF470864127951C13DF43E6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

--------------enigEBF470864127951C13DF43E6--

Date: 30 Dec 2009 10:04:48 -0500
From: "John R. Levine" <[email-masked]>
To: "Yakov Shafranovich" <[email-masked]>
Cleverness: None detected
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> That is exactly what my reasoning was as well. This flag is not useful
> for automation but is very useful for troubleshooting and manual
> review. Knowing that the message was redacted helps a lot when looking
> at problems.

All the redacted messages I get say "redacted" or something equally 
obvious in the places where they've removed user info.  Has anyone seen an 
ARF report where it was hard to tell what had been removed?

R's,
John

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 30 Dec 2009 09:46:25 -0500
To: Steve Atkins <[email-masked]>
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

On Wed, Dec 30, 2009 at 9:28 AM, Steve Atkins
<[email-masked]> wrote:
>
> On Dec 30, 2009, at 2:34 AM, Murray S. Kucherawy wrote:
>
>>> -----Original Message-----
>>> From: Dave CROCKER [mailto:[email-masked]]
>>> Sent: Tuesday, December 29, 2009 11:25 PM
>>> To: Murray S. Kucherawy
>>> Cc: Yakov Shafranovich; SM; [email-masked]
>>> Subject: Re: [feedback-report] Let's get started
>>>
>>> None of this sounds dangerous, but I'm not quite understanding what a
>>> single
>>> flag or even a list of header fields is useful for, in practical terms.
>>>
>>> I could understand having an inline convention for flagging a sequence
>>> of bytes
>>> as having been redacted.  That tells the receiving processor exactly
>>> where text
>>> is "missing".
>
> +1. But not because it'd be useful for automation, rather because it might help avoid the discussions with end users that "[email-masked] isn't on my mailing list!".
>

That is exactly what my reasoning was as well. This flag is not useful
for automation but is very useful for troubleshooting and manual
review. Knowing that the message was redacted helps a lot when looking
at problems.

Yakov

From: Steve Atkins <[email-masked]>
Date: Wed, 30 Dec 2009 09:28:51 -0500
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

On Dec 30, 2009, at 2:34 AM, Murray S. Kucherawy wrote:

>> -----Original Message-----
>> From: Dave CROCKER [mailto:[email-masked]]
>> Sent: Tuesday, December 29, 2009 11:25 PM
>> To: Murray S. Kucherawy
>> Cc: Yakov Shafranovich; SM; [email-masked]
>> Subject: Re: [feedback-report] Let's get started
>> 
>> None of this sounds dangerous, but I'm not quite understanding what a
>> single
>> flag or even a list of header fields is useful for, in practical terms.
>> 
>> I could understand having an inline convention for flagging a sequence
>> of bytes
>> as having been redacted.  That tells the receiving processor exactly
>> where text
>> is "missing".

+1. But not because it'd be useful for automation, rather because it might help avoid the discussions with end users that "[email-masked] isn't on my mailing list!".

>> 
>> But some sort of "I played with the text" high-level indicator does not
>> seem all
>> that procedurally useful.
>> 
>> Enlighten me?
> 
> I think my vision is two possible streams within the ADMD receiving the ARF message: one that handles unredacted content (maximum automation) and one that takes messages that admit to redacted content and routes them elsewhere for manual processing.

As someone who codes this stuff... nobody who is going to be using that level of automation is going to be relying on the email address of the recipient as recorded in the To: field at all.

The cases where FBLs are both useful and conducive to full automation are:

1. Competent bulk mailers (ESPs, commercial mailers, discussion list managers).

Here the email address in the To: field, even if it were unredacted, is not sufficient to key the automation on. Instead you want to be able to identify the original recipient, the sender, the source of the email address and the specific mailing. That can be done easily from embedded cookies in the document (VERP, unsubscription links or cookies added explicitly for this purpose).

(As a specific example of why the To: field not only isn't needed, but isn't that useful anyway: Many people sign up to mailing lists with email addresses at their vanity, small business or professional domains, but actually read their mail at a consumer ISP. [email-masked] subscribes to the list, but all his mail is forwarded to [email-masked]. When you get an scomp report from AOL, knowing that the recipient in the To: field is "[email-masked]" is completely useless, what you need is the original recipient @acm.org. That information is what you'll extract from the opaque cookie embedded in the message.)

2. Bandwidth providers and consumer ISPs.

Here the email address of the recipient is not interesting to key automation on. Instead the automation will be keyed on some aspect of the sender. That's likely to be the originating IP address in some cases, but may well be a magic cookie added by the ISP smarthost in others.

I've got Abacus-based code deployed that's handling FBLs in large volumes at both ESPs and ISPs, and the automation handles redacted and non-redacted reports in exactly the same way, not looking at the To: field in either case.

There are certainly cases where being able to see the recipients email address in the To: field is useful and redaction is annoying (the typical example is when an ISP receives a FBL about one of their customers who is running a mailing list with some piece of software that doesn't embed cookies, and the customer can't unsub the recipient as they can't identify it) - but they're all individual cases being handled manually after automation has already done it's job. By that point, a flag saying "we've redacted the email address" doesn't really do much of any value.

(On an obliquely related note, I do think that including a URL to a webpage that explains everything the consumer of the ARF report needs to know about it would be useful. That page could include explanation of under what conditions they send reports, what, if anything, they redact in the message - and why - and any other associated discussion that might be useful to a human consumer of the report).

Cheers,
  Steve

From: "moki" <[email-masked]>
To: <[email-masked]>
Date: Wed, 30 Dec 2009 08:31:12 +0100
Subject: [feedback-report] (no subject)

This is a multi-part message in MIME format.

------=_NextPart_000_0035_01CA892A.71FF02D0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

>From [email-masked] Tue Dec 22 04:11:50 2009=20
Delivery-date: Tue, 22 Dec 2009 04:11:50 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NN0mU-0006QY-5K=20
for [email-masked]; Tue, 22 Dec 2009 04:11:50 -0500=20
From: VIAGRA (c) Best Online Store <[email-masked]>=20
To: [email-masked]=20
Subject: User colleen_2434 special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" =
"http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3DUTF-8">=20
<title>Newsletter</title>=20
</head>=20
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; font-size:10px">=20
If you are unable to see the message below, <a =
href=3D"http://215428d1fbdcf8f.fezifisat.cn =
style=3D"text-decoration:none">click here to view</a>.</span>=20
<br><br><a href=3D"http://011f07472c71.fezifisat.cn target=3D"_blank">=20
<img alt=3D"Please enable image or click here" =
src=3D"http://img706.imageshack.us height=3D"458" width=3D"662" =
style=3D"border:0px">=20
</a><br><br>=20
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; font-size:10px;">=20
<a href=3D"http://c8a355c7.fezifisat.cn target=3D"_blank" =
style=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp; |&nbsp;=20
<a href=3D"http://179f20.fezifisat.cn target=3D"_blank" =
style=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://ef0888d3a669d.fezifisat.cn target=3D"_blank"  =
style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Uygogamuil Corporation. All rights reserved.</span>=20
</td></tr>=20
</table>=20
</body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Tue Dec 22 04:11:50 2009=20
Delivery-date: Tue, 22 Dec 2009 04:11:50 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NN0mU-0006Qa-5E=20
for [email-masked]; Tue, 22 Dec 2009 04:11:50 -0500=20
From: VIAGRA (c) Best Online Store <[email-masked]>=20
To: [email-masked]=20
Subject: User colleen special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" =
"http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3DUTF-8">=20
<title>Newsletter</title>=20
</head>=20
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; font-size:10px">=20
If you are unable to see the message below, <a =
href=3D"http://20d858.fezifisat.cn style=3D"text-decoration:none">click =
here to view</a>.</span>=20
<br><br><a href=3D"http://f592987c113.fezifisat.cn target=3D"_blank">=20
<img alt=3D"Please enable image or click here" =
src=3D"http://img685.imageshack.us height=3D"458" width=3D"658" =
style=3D"border:0px">=20
</a><br><br>=20
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; font-size:10px;">=20
<a href=3D"http://8208fb70f0.fezifisat.cn target=3D"_blank" =
style=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp; |&nbsp;=20
<a href=3D"http://a636a98b3cb.fezifisat.cn target=3D"_blank" =
style=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://23f720cdc46.fezifisat.cn target=3D"_blank"  =
style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Oxuymi Corporation. All rights reserved.</span>=20
</td></tr>=20
</table>=20
</body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Tue Dec 22 06:07:53 2009=20
Delivery-date: Tue, 22 Dec 2009 06:07:53 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NN2an-0001jY-Aq=20
for [email-masked]; Tue, 22 Dec 2009 06:07:53 -0500=20
From: VIAGRA (c) Best Online Store <[email-masked]>=20
To: [email-masked]=20
Subject: User anecdotalist.v special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" =
"http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3DUTF-8">=20
<title>Newsletter</title>=20
</head>=20
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; font-size:10px">=20
If you are unable to see the message below, <a =
href=3D"http://moregren.com style=3D"text-decoration:none">click here to =
view</a>.</span>=20
<br><br><a href=3D"http://moregren.com target=3D"_blank">=20
<img alt=3D"Please enable image or click here" =
src=3D"http://img46.imageshack.us height=3D"440" width=3D"657" =
style=3D"border:0px">=20
</a><br><br>=20
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; font-size:10px;">=20
<a href=3D"http://moregren.com target=3D"_blank" =
style=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp; |&nbsp;=20
<a href=3D"http://moregren.com target=3D"_blank" =
style=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://moregren.com target=3D"_blank"  =
style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Igipiat Corporation. All rights reserved.</span>=20
</td></tr>=20
</table>=20
</body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Wed Dec 23 01:16:58 2009=20
Delivery-date: Wed, 23 Dec 2009 01:16:58 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NNKWo-00074I-4O=20
for [email-masked]; Wed, 23 Dec 2009 01:16:58 -0500=20
From: VIAGRA (c) Best Online Store <[email-masked]>=20
To: [email-masked]=20
Subject: User grazyna_176 special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" =
"http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3DUTF-8">=20
<title>Newsletter</title>=20
</head>=20
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; font-size:10px">=20
If you are unable to see the message below, <a =
href=3D"http://tovar.tut.su style=3D"text-decoration:none">click here to =
view</a>.</span>=20
<br><br><a href=3D"http://tovar.tut.su target=3D"_blank">=20
<img alt=3D"Please enable image or click here" src=3D"http://pixfarm.net =
height=3D"449" width=3D"659" style=3D"border:0px">=20
</a><br><br>=20
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; font-size:10px;">=20
<a href=3D"http://tovar.tut.su target=3D"_blank" =
style=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp; |&nbsp;=20
<a href=3D"http://tovar.tut.su target=3D"_blank" =
style=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://tovar.tut.su target=3D"_blank"  =
style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Rexiqizak Corporation. All rights reserved.</span>=20
</td></tr>=20
</table>=20
</body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Thu Dec 24 03:01:08 2009=20
Delivery-date: Thu, 24 Dec 2009 03:01:08 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NNidA-0003k2-Hs=20
for [email-masked]; Thu, 24 Dec 2009 03:01:08 -0500=20
From: Generic VIAGRA (c) Best Supplier <[email-masked]>=20
To: [email-masked]=20
Subject: Visitor reviewability.m's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">=20
<html>=20
    <head>=20
        <title>NEWSLETTER</title>=20
        <meta content=3D"text/html; charset=3DISO-8859-1" =
http-equiv=3D"Content-Type">=20
    </head>=20
    <body>=20
        <table cellspacing=3D"0" cellpadding=3D"0" width=3D"576" =
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right: =
#e5e5e5 1px solid; border-top: #e5e5e5 1px solid; border-left: #e5e5e5 =
1px solid; border-bottom: #e5e5e5 1px solid">=20
            <tbody>=20
                <tr>=20
                    <td align=3D"left" style=3D"padding-right: 9px; =
padding-left: 9px; padding-bottom: 14px; padding-top: 8px">=20
                    <p style=3D"margin-top: 0px; font-size: 10px; =
margin-bottom: 0px; color: #999999; line-height: 12px; font-family: =
Verdana">=20
If you have any difficulty seeing the contents of this=20
e-mail, please click <a target=3D"_blank" style=3D"font-size: 10px; =
color: #00bdac; line-height: 12px; font-family: Verdana; =
text-decoration: underline" href=3D"http://66.118.165.40>=20
here</a>.</p>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td>=20
                    <table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"600" border=3D"0">=20
                        <tbody>=20
                            <tr>=20
                                <td style=3D"text-align: center">=20
                                <br>=20
<a href=3D"http://66.118.165.40><img alt=3D"Click on this image" =
height=3D"449" src=3D"http://img709.imageshack.us width=3D"662" =
style=3D"border-width: 0px">=20
</a>=20
<br>=20
                                </td>=20
                            </tr>=20
                        </tbody>=20
                    </table>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td align=3D"center" style=3D"padding-right: 0px; =
padding-left: 0px; font-size: 10px; padding-bottom: 10px; color: =
#999999; line-height: 12px; padding-top: 10px; font-family: Verdana">=20
Copyright =A9 2009 Teefesoe Inc.<br>=20
                    <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://66.118.165.40>=20
Privacy Policy</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://66.118.165.40>=20
Terms of Use</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://66.118.165.40>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac; line-height: 12px; =
font-family: Verdana; text-decoration: underline" =
href=3D"http://66.118.165.40>=20
Unsubscribe</a></td>=20
                </tr>=20
            </tbody>=20
        </table>=20
    </body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Mon Dec 28 05:13:07 2009=20
Delivery-date: Mon, 28 Dec 2009 05:13:07 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NPCb4-0007jb-WD=20
for [email-masked]; Mon, 28 Dec 2009 05:13:07 -0500=20
From: VIAGRA (c) Best Supplier <[email-masked]>=20
To: [email-masked]=20
Subject: Visitor jessenia's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">=20
<html>=20
    <head>=20
        <title>Newsletter</title>=20
        <meta content=3D"text/html; charset=3DUTF-8" =
http-equiv=3D"Content-Type">=20
    </head>=20
    <body>=20
        <table cellspacing=3D"0" cellpadding=3D"0" width=3D"750" =
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right: =
#e5e5e5 1px solid; border-top: #e5e5e5 1px solid; border-left: #e5e5e5 =
1px solid; border-bottom: #e5e5e5 1px solid">=20
            <tbody>=20
                <tr>=20
                    <td align=3D"left" style=3D"padding-right: 9px; =
padding-left: 9px; padding-bottom: 14px; padding-top: 8px">=20
                    <p style=3D"margin-top: 0px; font-size: 10px; =
margin-bottom: 0px; color: #999999; line-height: 12px; font-family: =
Verdana">=20
If you have any difficulty seeing the contents of this=20
e-mail, please click <a target=3D"_blank" style=3D"font-size: 10px; =
color: #00bdac; line-height: 12px; font-family: Verdana; =
text-decoration: underline" href=3D"http://bb2a04ce7.xotafabuc.cn>=20
here</a>.</p>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td>=20
                    <table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"750" border=3D"0">=20
                        <tbody>=20
                            <tr>=20
                                <td style=3D"text-align: center">=20
                                <br>=20
<a href=3D"http://6f84.xotafabuc.cn><img alt=3D"This picture is blocked. =
Click to unblock now" height=3D"330" src=3D"http://a7b.xotafabuc.cn =
width=3D"546" style=3D"border-width: 0px">=20
</a>=20
<br>=20
                                </td>=20
                            </tr>=20
                        </tbody>=20
                    </table>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td align=3D"center" style=3D"padding-right: 0px; =
padding-left: 0px; font-size: 10px; padding-bottom: 10px; color: =
#999999; line-height: 12px; padding-top: 10px; font-family: Verdana">=20
Copyright =A9 2009 Faekoc Inc.<br>=20
                    <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://39d75058.xotafabuc.cn>=20
Privacy Policy</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://947d73d26.xotafabuc.cn>=20
Terms of Use</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://538e87.xotafabuc.cn>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac; line-height: 12px; =
font-family: Verdana; text-decoration: underline" =
href=3D"http://ce3.xotafabuc.cn>=20
Unsubscribe</a></td>=20
                </tr>=20
            </tbody>=20
        </table>=20
    </body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Tue Dec 29 06:18:13 2009=20
Delivery-date: Tue, 29 Dec 2009 06:18:13 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NPa5d-0005Zc-8v=20
for [email-masked]; Tue, 29 Dec 2009 06:18:13 -0500=20
From: VIAGRA (c) Best Supplier <[email-masked]>=20
To: [email-masked]=20
Subject: Visitor helm's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">=20
<html>=20
    <head>=20
        <title>Newsletter</title>=20
        <meta content=3D"text/html; charset=3DUTF-8" =
http-equiv=3D"Content-Type">=20
    </head>=20
    <body>=20
        <table cellspacing=3D"0" cellpadding=3D"0" width=3D"750" =
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right: =
#e5e5e5 1px solid; border-top: #e5e5e5 1px solid; border-left: #e5e5e5 =
1px solid; border-bottom: #e5e5e5 1px solid">=20
            <tbody>=20
                <tr>=20
                    <td align=3D"left" style=3D"padding-right: 9px; =
padding-left: 9px; padding-bottom: 14px; padding-top: 8px">=20
                    <p style=3D"margin-top: 0px; font-size: 10px; =
margin-bottom: 0px; color: #999999; line-height: 12px; font-family: =
Verdana">=20
If you have any difficulty seeing the contents of this=20
e-mail, please click <a target=3D"_blank" style=3D"font-size: 10px; =
color: #00bdac; line-height: 12px; font-family: Verdana; =
text-decoration: underline" href=3D"http://student.tmhs.tcc.edu.tw>=20
here</a>.</p>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td>=20
                    <table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"750" border=3D"0">=20
                        <tbody>=20
                            <tr>=20
                                <td style=3D"text-align: center">=20
                                <br>=20
<a href=3D"http://student.tmhs.tcc.edu.tw><img alt=3D"This picture is =
blocked. Click to unblock now" height=3D"432" =
src=3D"http://img44.imageshack.us width=3D"688" style=3D"border-width: =
0px">=20
</a>=20
<br>=20
                                </td>=20
                            </tr>=20
                        </tbody>=20
                    </table>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td align=3D"center" style=3D"padding-right: 0px; =
padding-left: 0px; font-size: 10px; padding-bottom: 10px; color: =
#999999; line-height: 12px; padding-top: 10px; font-family: Verdana">=20
Copyright =A9 2009 Iduut Inc.<br>=20
                    <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://student.tmhs.tcc.edu.tw>=20
Privacy Policy</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://student.tmhs.tcc.edu.tw>=20
Terms of Use</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://student.tmhs.tcc.edu.tw>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac; line-height: 12px; =
font-family: Verdana; text-decoration: underline" =
href=3D"http://student.tmhs.tcc.edu.tw>=20
Unsubscribe</a></td>=20
                </tr>=20
            </tbody>=20
        </table>=20
    </body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Tue Dec 29 08:17:28 2009=20
Delivery-date: Tue, 29 Dec 2009 08:17:28 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NPbx1-0002dk-Rk=20
for [email-masked]; Tue, 29 Dec 2009 08:17:28 -0500=20
From: VIAGRA (c) Best Supplier <[email-masked]>=20
To: [email-masked]=20
Subject: Visitor headset's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">=20
<html>=20
    <head>=20
        <title>Newsletter</title>=20
        <meta content=3D"text/html; charset=3DUTF-8" =
http-equiv=3D"Content-Type">=20
    </head>=20
    <body>=20
        <table cellspacing=3D"0" cellpadding=3D"0" width=3D"750" =
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right: =
#e5e5e5 1px solid; border-top: #e5e5e5 1px solid; border-left: #e5e5e5 =
1px solid; border-bottom: #e5e5e5 1px solid">=20
            <tbody>=20
                <tr>=20
                    <td align=3D"left" style=3D"padding-right: 9px; =
padding-left: 9px; padding-bottom: 14px; padding-top: 8px">=20
                    <p style=3D"margin-top: 0px; font-size: 10px; =
margin-bottom: 0px; color: #999999; line-height: 12px; font-family: =
Verdana">=20
If you have any difficulty seeing the contents of this=20
e-mail, please click <a target=3D"_blank" style=3D"font-size: 10px; =
color: #00bdac; line-height: 12px; font-family: Verdana; =
text-decoration: underline" href=3D"http://web143.mis02.de>=20
here</a>.</p>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td>=20
                    <table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"750" border=3D"0">=20
                        <tbody>=20
                            <tr>=20
                                <td style=3D"text-align: center">=20
                                <br>=20
<a href=3D"http://web143.mis02.de><img alt=3D"This picture is blocked. =
Click to unblock now" height=3D"437" src=3D"http://img139.imageshack.us =
width=3D"696" style=3D"border-width: 0px">=20
</a>=20
<br>=20
                                </td>=20
                            </tr>=20
                        </tbody>=20
                    </table>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td align=3D"center" style=3D"padding-right: 0px; =
padding-left: 0px; font-size: 10px; padding-bottom: 10px; color: =
#999999; line-height: 12px; padding-top: 10px; font-family: Verdana">=20
Copyright =A9 2009 Ygizufewifof Inc.<br>=20
                    <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://web143.mis02.de>=20
Privacy Policy</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://web143.mis02.de>=20
Terms of Use</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://web143.mis02.de>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac; line-height: 12px; =
font-family: Verdana; text-decoration: underline" =
href=3D"http://web143.mis02.de>=20
Unsubscribe</a></td>=20
                </tr>=20
            </tbody>=20
        </table>=20
    </body>=20
</html>=20

-------------------------------------------------------------------------=
-------

>From [email-masked] Wed Dec 30 01:22:00 2009=20
Delivery-date: Wed, 30 Dec 2009 01:22:00 -0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20
(Exim 4.63)=20
(envelope-from <[email-masked]>)=20
id 1NPrwW-0000bT-9r=20
for [email-masked]; Wed, 30 Dec 2009 01:22:00 -0500=20
From: VIAGRA (c) Best Supplier <[email-masked]>=20
To: [email-masked]=20
Subject: Visitor grady's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">=20
<html>=20
    <head>=20
        <title>Newsletter</title>=20
        <meta content=3D"text/html; charset=3DUTF-8" =
http-equiv=3D"Content-Type">=20
    </head>=20
    <body>=20
        <table cellspacing=3D"0" cellpadding=3D"0" width=3D"750" =
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right: =
#e5e5e5 1px solid; border-top: #e5e5e5 1px solid; border-left: #e5e5e5 =
1px solid; border-bottom: #e5e5e5 1px solid">=20
            <tbody>=20
                <tr>=20
                    <td align=3D"left" style=3D"padding-right: 9px; =
padding-left: 9px; padding-bottom: 14px; padding-top: 8px">=20
                    <p style=3D"margin-top: 0px; font-size: 10px; =
margin-bottom: 0px; color: #999999; line-height: 12px; font-family: =
Verdana">=20
If you have any difficulty seeing the contents of this=20
e-mail, please click <a target=3D"_blank" style=3D"font-size: 10px; =
color: #00bdac; line-height: 12px; font-family: Verdana; =
text-decoration: underline" href=3D"http://shlapka.by.ru>=20
here</a>.</p>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td>=20
                    <table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"750" border=3D"0">=20
                        <tbody>=20
                            <tr>=20
                                <td style=3D"text-align: center">=20
                                <br>=20
<a href=3D"http://shlapka.by.ru><img alt=3D"This picture is blocked. =
Click to unblock now" height=3D"441" src=3D"http://img199.imageshack.us =
width=3D"684" style=3D"border-width: 0px">=20
</a>=20
<br>=20
                                </td>=20
                            </tr>=20
                        </tbody>=20
                    </table>=20
                    </td>=20
                </tr>=20
                <tr>=20
                    <td align=3D"center" style=3D"padding-right: 0px; =
padding-left: 0px; font-size: 10px; padding-bottom: 10px; color: =
#999999; line-height: 12px; padding-top: 10px; font-family: Verdana">=20
Copyright =A9 2009 Icudiygoud Inc.<br>=20
                    <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://shlapka.by.ru>=20
Privacy Policy</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://shlapka.by.ru>=20
Terms of Use</a> | <a style=3D"font-size: 10px; color: #00bdac; =
line-height: 12px; font-family: Verdana; text-decoration: underline" =
href=3D"http://shlapka.by.ru>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac; line-height: 12px; =
font-family: Verdana; text-decoration: underline" =
href=3D"http://shlapka.by.ru>=20
Unsubscribe</a></td>=20
                </tr>=20
            </tbody>=20
        </table>=20
    </body>=20
</html>=20

------=_NextPart_000_0035_01CA892A.71FF02D0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.3640" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><BR><BR><FONT=20
size=3D2>From&nbsp;[email-masked]&nbsp;Tue&nbsp;Dec&nbsp;22&nbsp;04:=
11:50&nbsp;2009=20
<BR>Delivery-date:&nbsp;Tue,&nbsp;22&nbsp;Dec&nbsp;2009&nbsp;04:11:50&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NN0mU-0006QY-5K=20
<BR>for&nbsp;[email-masked];&nbsp;Tue,&nbsp;22&nbsp;Dec&nbsp;2009&nb=
sp;04:11:50&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Online&nbsp;Store&nbsp;&lt;=
[email-masked]&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;User&nbsp;colleen_2434&nbsp;special&nbsp;80%&nbsp;OFF=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&nbsp;"http://www.w3.org&gt;=20
<BR>&lt;html&gt;&lt;head&gt;=20
<BR>&lt;meta&nbsp;http-equiv=3D"Content-Type"&nbsp;content=3D"text/html;&=
nbsp;charset=3DUTF-8"&gt;=20
<BR>&lt;title&gt;Newsletter&lt;/title&gt; <BR>&lt;/head&gt; =
<BR>&lt;body&gt;=20
<BR>&lt;table&nbsp;width=3D"100%"&nbsp;cellpadding=3D"0"&nbsp;cellspacing=
=3D"0"&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#000000;&nbsp;fo=
nt-size:10px"&gt;=20
<BR>If&nbsp;you&nbsp;are&nbsp;unable&nbsp;to&nbsp;see&nbsp;the&nbsp;messa=
ge&nbsp;below,&nbsp;&lt;a&nbsp;href=3D"http://215428d1fbdcf8f.fezifisat.c=
n&nbsp;style=3D"text-decoration:none"&gt;click&nbsp;here&nbsp;to&nbsp;vie=
w&lt;/a&gt;.&lt;/span&gt;=20
<BR>&lt;br&gt;&lt;br&gt;&lt;a&nbsp;href=3D"http://011f07472c71.fezifisat.=
cn&nbsp;target=3D"_blank"&gt;=20
<BR>&lt;img&nbsp;alt=3D"Please&nbsp;enable&nbsp;image&nbsp;or&nbsp;click&=
nbsp;here"&nbsp;src=3D"http://img706.imageshack.us&nbsp;height=3D"458"&nb=
sp;width=3D"662"&nbsp;style=3D"border:0px"&gt;=20
<BR>&lt;/a&gt;&lt;br&gt;&lt;br&gt; <BR>&lt;/td&gt;&lt;/tr&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;valign=3D"top"&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#333333;&nbsp;fo=
nt-size:10px;"&gt;=20
<BR>&lt;a&nbsp;href=3D"http://c8a355c7.fezifisat.cn&nbsp;target=3D"_blank=
"&nbsp;style=3D"color:#0065A4;"&gt;=20
<BR>Terms&nbsp;and&nbsp;Conditions&nbsp;of&nbsp;Use&lt;/a&gt;&amp;nbsp;&n=
bsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://179f20.fezifisat.cn&nbsp;target=3D"_blank"&=
nbsp;style=3D"color:#0065A4;"&nbsp;&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&amp;nbsp;&nbsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://ef0888d3a669d.fezifisat.cn&nbsp;target=3D"_=
blank"&nbsp;&nbsp;style=3D"color:#0065A4;"&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;br&gt;=20
<BR>&lt;br&gt;&amp;copy;&nbsp;2009&nbsp;Uygogamuil&nbsp;Corporation.&nbsp=
;All&nbsp;rights&nbsp;reserved.&lt;/span&gt;=20
<BR>&lt;/td&gt;&lt;/tr&gt; <BR>&lt;/table&gt; <BR>&lt;/body&gt;=20
<BR>&lt;/html&gt; </FONT>
<P></P><FONT size=3D2>
<HR>
</FONT>
<P><BR><BR><FONT=20
size=3D2>From&nbsp;[email-masked]&nbsp;Tue&nbsp;Dec&nbsp;22&nbsp;04:=
11:50&nbsp;2009=20
<BR>Delivery-date:&nbsp;Tue,&nbsp;22&nbsp;Dec&nbsp;2009&nbsp;04:11:50&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NN0mU-0006Qa-5E=20
<BR>for&nbsp;[email-masked];&nbsp;Tue,&nbsp;22&nbsp;Dec&nbsp;2009&nb=
sp;04:11:50&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Online&nbsp;Store&nbsp;&lt;=
[email-masked]&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;User&nbsp;colleen&nbsp;special&nbsp;80%&nbsp;OFF=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&nbsp;"http://www.w3.org&gt;=20
<BR>&lt;html&gt;&lt;head&gt;=20
<BR>&lt;meta&nbsp;http-equiv=3D"Content-Type"&nbsp;content=3D"text/html;&=
nbsp;charset=3DUTF-8"&gt;=20
<BR>&lt;title&gt;Newsletter&lt;/title&gt; <BR>&lt;/head&gt; =
<BR>&lt;body&gt;=20
<BR>&lt;table&nbsp;width=3D"100%"&nbsp;cellpadding=3D"0"&nbsp;cellspacing=
=3D"0"&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#000000;&nbsp;fo=
nt-size:10px"&gt;=20
<BR>If&nbsp;you&nbsp;are&nbsp;unable&nbsp;to&nbsp;see&nbsp;the&nbsp;messa=
ge&nbsp;below,&nbsp;&lt;a&nbsp;href=3D"http://20d858.fezifisat.cn&nbsp;st=
yle=3D"text-decoration:none"&gt;click&nbsp;here&nbsp;to&nbsp;view&lt;/a&g=
t;.&lt;/span&gt;=20
<BR>&lt;br&gt;&lt;br&gt;&lt;a&nbsp;href=3D"http://f592987c113.fezifisat.c=
n&nbsp;target=3D"_blank"&gt;=20
<BR>&lt;img&nbsp;alt=3D"Please&nbsp;enable&nbsp;image&nbsp;or&nbsp;click&=
nbsp;here"&nbsp;src=3D"http://img685.imageshack.us&nbsp;height=3D"458"&nb=
sp;width=3D"658"&nbsp;style=3D"border:0px"&gt;=20
<BR>&lt;/a&gt;&lt;br&gt;&lt;br&gt; <BR>&lt;/td&gt;&lt;/tr&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;valign=3D"top"&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#333333;&nbsp;fo=
nt-size:10px;"&gt;=20
<BR>&lt;a&nbsp;href=3D"http://8208fb70f0.fezifisat.cn&nbsp;target=3D"_bla=
nk"&nbsp;style=3D"color:#0065A4;"&gt;=20
<BR>Terms&nbsp;and&nbsp;Conditions&nbsp;of&nbsp;Use&lt;/a&gt;&amp;nbsp;&n=
bsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://a636a98b3cb.fezifisat.cn&nbsp;target=3D"_bl=
ank"&nbsp;style=3D"color:#0065A4;"&nbsp;&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&amp;nbsp;&nbsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://23f720cdc46.fezifisat.cn&nbsp;target=3D"_bl=
ank"&nbsp;&nbsp;style=3D"color:#0065A4;"&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;br&gt;=20
<BR>&lt;br&gt;&amp;copy;&nbsp;2009&nbsp;Oxuymi&nbsp;Corporation.&nbsp;All=
&nbsp;rights&nbsp;reserved.&lt;/span&gt;=20
<BR>&lt;/td&gt;&lt;/tr&gt; <BR>&lt;/table&gt; <BR>&lt;/body&gt;=20
<BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Tue&nbsp;Dec&nbsp;22=
&nbsp;06:07:53&nbsp;2009=20
<BR>Delivery-date:&nbsp;Tue,&nbsp;22&nbsp;Dec&nbsp;2009&nbsp;06:07:53&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NN2an-0001jY-Aq=20
<BR>for&nbsp;[email-masked];&nbsp;Tue,&nbsp;22&nbsp;Dec&nbsp;2009&nb=
sp;06:07:53&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Online&nbsp;Store&nbsp;&lt;=
[email-masked]&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;User&nbsp;anecdotalist.v&nbsp;special&nbsp;80%&nbsp;OFF=
=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&nbsp;"http://www.w3.org&gt;=20
<BR>&lt;html&gt;&lt;head&gt;=20
<BR>&lt;meta&nbsp;http-equiv=3D"Content-Type"&nbsp;content=3D"text/html;&=
nbsp;charset=3DUTF-8"&gt;=20
<BR>&lt;title&gt;Newsletter&lt;/title&gt; <BR>&lt;/head&gt; =
<BR>&lt;body&gt;=20
<BR>&lt;table&nbsp;width=3D"100%"&nbsp;cellpadding=3D"0"&nbsp;cellspacing=
=3D"0"&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#000000;&nbsp;fo=
nt-size:10px"&gt;=20
<BR>If&nbsp;you&nbsp;are&nbsp;unable&nbsp;to&nbsp;see&nbsp;the&nbsp;messa=
ge&nbsp;below,&nbsp;&lt;a&nbsp;href=3D"http://moregren.com&nbsp;style=3D"=
text-decoration:none"&gt;click&nbsp;here&nbsp;to&nbsp;view&lt;/a&gt;.&lt;=
/span&gt;=20
<BR>&lt;br&gt;&lt;br&gt;&lt;a&nbsp;href=3D"http://moregren.com&nbsp;targe=
t=3D"_blank"&gt;=20
<BR>&lt;img&nbsp;alt=3D"Please&nbsp;enable&nbsp;image&nbsp;or&nbsp;click&=
nbsp;here"&nbsp;src=3D"http://img46.imageshack.us&nbsp;height=3D"440"&nbs=
p;width=3D"657"&nbsp;style=3D"border:0px"&gt;=20
<BR>&lt;/a&gt;&lt;br&gt;&lt;br&gt; <BR>&lt;/td&gt;&lt;/tr&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;valign=3D"top"&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#333333;&nbsp;fo=
nt-size:10px;"&gt;=20
<BR>&lt;a&nbsp;href=3D"http://moregren.com&nbsp;target=3D"_blank"&nbsp;st=
yle=3D"color:#0065A4;"&gt;=20
<BR>Terms&nbsp;and&nbsp;Conditions&nbsp;of&nbsp;Use&lt;/a&gt;&amp;nbsp;&n=
bsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://moregren.com&nbsp;target=3D"_blank"&nbsp;st=
yle=3D"color:#0065A4;"&nbsp;&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&amp;nbsp;&nbsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://moregren.com&nbsp;target=3D"_blank"&nbsp;&n=
bsp;style=3D"color:#0065A4;"&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;br&gt;=20
<BR>&lt;br&gt;&amp;copy;&nbsp;2009&nbsp;Igipiat&nbsp;Corporation.&nbsp;Al=
l&nbsp;rights&nbsp;reserved.&lt;/span&gt;=20
<BR>&lt;/td&gt;&lt;/tr&gt; <BR>&lt;/table&gt; <BR>&lt;/body&gt;=20
<BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Wed&nbsp;Dec&nbsp;23=
&nbsp;01:16:58&nbsp;2009=20
<BR>Delivery-date:&nbsp;Wed,&nbsp;23&nbsp;Dec&nbsp;2009&nbsp;01:16:58&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NNKWo-00074I-4O=20
<BR>for&nbsp;[email-masked];&nbsp;Wed,&nbsp;23&nbsp;Dec&nbsp;2009&nb=
sp;01:16:58&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Online&nbsp;Store&nbsp;&lt;=
[email-masked]&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;User&nbsp;grazyna_176&nbsp;special&nbsp;80%&nbsp;OFF=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&nbsp;"http://www.w3.org&gt;=20
<BR>&lt;html&gt;&lt;head&gt;=20
<BR>&lt;meta&nbsp;http-equiv=3D"Content-Type"&nbsp;content=3D"text/html;&=
nbsp;charset=3DUTF-8"&gt;=20
<BR>&lt;title&gt;Newsletter&lt;/title&gt; <BR>&lt;/head&gt; =
<BR>&lt;body&gt;=20
<BR>&lt;table&nbsp;width=3D"100%"&nbsp;cellpadding=3D"0"&nbsp;cellspacing=
=3D"0"&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#000000;&nbsp;fo=
nt-size:10px"&gt;=20
<BR>If&nbsp;you&nbsp;are&nbsp;unable&nbsp;to&nbsp;see&nbsp;the&nbsp;messa=
ge&nbsp;below,&nbsp;&lt;a&nbsp;href=3D"http://tovar.tut.su&nbsp;style=3D"=
text-decoration:none"&gt;click&nbsp;here&nbsp;to&nbsp;view&lt;/a&gt;.&lt;=
/span&gt;=20
<BR>&lt;br&gt;&lt;br&gt;&lt;a&nbsp;href=3D"http://tovar.tut.su&nbsp;targe=
t=3D"_blank"&gt;=20
<BR>&lt;img&nbsp;alt=3D"Please&nbsp;enable&nbsp;image&nbsp;or&nbsp;click&=
nbsp;here"&nbsp;src=3D"http://pixfarm.net&nbsp;height=3D"449"&nbsp;width=3D=
"659"&nbsp;style=3D"border:0px"&gt;=20
<BR>&lt;/a&gt;&lt;br&gt;&lt;br&gt; <BR>&lt;/td&gt;&lt;/tr&gt;=20
<BR>&lt;tr&gt;&lt;td&nbsp;valign=3D"top"&nbsp;align=3D"center"&gt;=20
<BR>&lt;span&nbsp;style=3D"font-family:Arial;&nbsp;color:#333333;&nbsp;fo=
nt-size:10px;"&gt;=20
<BR>&lt;a&nbsp;href=3D"http://tovar.tut.su&nbsp;target=3D"_blank"&nbsp;st=
yle=3D"color:#0065A4;"&gt;=20
<BR>Terms&nbsp;and&nbsp;Conditions&nbsp;of&nbsp;Use&lt;/a&gt;&amp;nbsp;&n=
bsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://tovar.tut.su&nbsp;target=3D"_blank"&nbsp;st=
yle=3D"color:#0065A4;"&nbsp;&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&amp;nbsp;&nbsp;|&amp;nbsp;=20
<BR>&lt;a&nbsp;href=3D"http://tovar.tut.su&nbsp;target=3D"_blank"&nbsp;&n=
bsp;style=3D"color:#0065A4;"&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;br&gt;=20
<BR>&lt;br&gt;&amp;copy;&nbsp;2009&nbsp;Rexiqizak&nbsp;Corporation.&nbsp;=
All&nbsp;rights&nbsp;reserved.&lt;/span&gt;=20
<BR>&lt;/td&gt;&lt;/tr&gt; <BR>&lt;/table&gt; <BR>&lt;/body&gt;=20
<BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Thu&nbsp;Dec&nbsp;24=
&nbsp;03:01:08&nbsp;2009=20
<BR>Delivery-date:&nbsp;Thu,&nbsp;24&nbsp;Dec&nbsp;2009&nbsp;03:01:08&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NNidA-0003k2-Hs=20
<BR>for&nbsp;[email-masked];&nbsp;Thu,&nbsp;24&nbsp;Dec&nbsp;2009&nb=
sp;03:01:08&nbsp;-0500=20
<BR>From:&nbsp;Generic&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Supplier&nbsp;=
&lt;[email-masked]&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;Visitor&nbsp;reviewability.m's&nbsp;personal&nbsp;80%&n=
bsp;OFF=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&gt;=20
<BR>&lt;html&gt; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;title&gt;NEWSLETT=
ER&lt;/title&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta&nbsp;content=
=3D"text/html;&nbsp;charset=3DISO-8859-1"&nbsp;http-equiv=3D"Content-Type=
"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellsp=
acing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"576"&nbsp;align=3D"cente=
r"&nbsp;bgcolor=3D"#ffffff"&nbsp;border=3D"0"&nbsp;style=3D"border-right:=
&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;border-top:&nbsp;#e5e5e5&nbsp;1px=
&nbsp;solid;&nbsp;border-left:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;bor=
der-bottom:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"l=
eft"&nbsp;style=3D"padding-right:&nbsp;9px;&nbsp;padding-left:&nbsp;9px;&=
nbsp;padding-bottom:&nbsp;14px;&nbsp;padding-top:&nbsp;8px"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;p&nbsp;style=3D"ma=
rgin-top:&nbsp;0px;&nbsp;font-size:&nbsp;10px;&nbsp;margin-bottom:&nbsp;0=
px;&nbsp;color:&nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;font-fami=
ly:&nbsp;Verdana"&gt;=20
<BR>If&nbsp;you&nbsp;have&nbsp;any&nbsp;difficulty&nbsp;seeing&nbsp;the&n=
bsp;contents&nbsp;of&nbsp;this=20
<BR>e-mail,&nbsp;please&nbsp;click&nbsp;&lt;a&nbsp;target=3D"_blank"&nbsp=
;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-heigh=
t:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;=
underline"&nbsp;href=3D"http://66.118.165.40&gt;=20
<BR>here&lt;/a&gt;.&lt;/p&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellspa=
cing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"600"&nbsp;border=3D"0"&gt=
;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;style=3D"te=
xt-align:&nbsp;center"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;br&gt;=20
<BR>&lt;a&nbsp;href=3D"http://66.118.165.40&gt;&lt;img&nbsp;alt=3D"Click&=
nbsp;on&nbsp;this&nbsp;image"&nbsp;height=3D"449"&nbsp;src=3D"http://img7=
09.imageshack.us&nbsp;width=3D"662"&nbsp;style=3D"border-width:&nbsp;0px"=
&gt;=20
<BR>&lt;/a&gt; <BR>&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"c=
enter"&nbsp;style=3D"padding-right:&nbsp;0px;&nbsp;padding-left:&nbsp;0px=
;&nbsp;font-size:&nbsp;10px;&nbsp;padding-bottom:&nbsp;10px;&nbsp;color:&=
nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;padding-top:&nbsp;10px;&n=
bsp;font-family:&nbsp;Verdana"&gt;=20
<BR>Copyright&nbsp;=A9&nbsp;2009&nbsp;Teefesoe&nbsp;Inc.&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;a&nbsp;style=3D"fo=
nt-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px=
;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&n=
bsp;href=3D"http://66.118.165.40&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font-si=
ze:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&nbs=
p;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbsp;h=
ref=3D"http://66.118.165.40&gt;=20
<BR>Terms&nbsp;of&nbsp;Use&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font=
-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&=
nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbs=
p;href=3D"http://66.118.165.40&gt;=20
<BR>Contact&nbsp;Us&lt;/a&gt;&nbsp;|=20
<BR>&lt;a&nbsp;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&n=
bsp;line-height:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-dec=
oration:&nbsp;underline"&nbsp;href=3D"http://66.118.165.40&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/body&gt; <BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Mon&nbsp;Dec&nbsp;28=
&nbsp;05:13:07&nbsp;2009=20
<BR>Delivery-date:&nbsp;Mon,&nbsp;28&nbsp;Dec&nbsp;2009&nbsp;05:13:07&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NPCb4-0007jb-WD=20
<BR>for&nbsp;[email-masked];&nbsp;Mon,&nbsp;28&nbsp;Dec&nbsp;2009&nb=
sp;05:13:07&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Supplier&nbsp;&lt;victim@sm=
tp.example&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;Visitor&nbsp;jessenia's&nbsp;personal&nbsp;80%&nbsp;OFF=
=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&gt;=20
<BR>&lt;html&gt; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;title&gt;Newslett=
er&lt;/title&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta&nbsp;content=
=3D"text/html;&nbsp;charset=3DUTF-8"&nbsp;http-equiv=3D"Content-Type"&gt;=
=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellsp=
acing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;align=3D"cente=
r"&nbsp;bgcolor=3D"#ffffff"&nbsp;border=3D"0"&nbsp;style=3D"border-right:=
&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;border-top:&nbsp;#e5e5e5&nbsp;1px=
&nbsp;solid;&nbsp;border-left:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;bor=
der-bottom:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"l=
eft"&nbsp;style=3D"padding-right:&nbsp;9px;&nbsp;padding-left:&nbsp;9px;&=
nbsp;padding-bottom:&nbsp;14px;&nbsp;padding-top:&nbsp;8px"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;p&nbsp;style=3D"ma=
rgin-top:&nbsp;0px;&nbsp;font-size:&nbsp;10px;&nbsp;margin-bottom:&nbsp;0=
px;&nbsp;color:&nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;font-fami=
ly:&nbsp;Verdana"&gt;=20
<BR>If&nbsp;you&nbsp;have&nbsp;any&nbsp;difficulty&nbsp;seeing&nbsp;the&n=
bsp;contents&nbsp;of&nbsp;this=20
<BR>e-mail,&nbsp;please&nbsp;click&nbsp;&lt;a&nbsp;target=3D"_blank"&nbsp=
;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-heigh=
t:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;=
underline"&nbsp;href=3D"http://bb2a04ce7.xotafabuc.cn&gt;=20
<BR>here&lt;/a&gt;.&lt;/p&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellspa=
cing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;border=3D"0"&gt=
;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;style=3D"te=
xt-align:&nbsp;center"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;br&gt;=20
<BR>&lt;a&nbsp;href=3D"http://6f84.xotafabuc.cn&gt;&lt;img&nbsp;alt=3D"Th=
is&nbsp;picture&nbsp;is&nbsp;blocked.&nbsp;Click&nbsp;to&nbsp;unblock&nbs=
p;now"&nbsp;height=3D"330"&nbsp;src=3D"http://a7b.xotafabuc.cn&nbsp;width=
=3D"546"&nbsp;style=3D"border-width:&nbsp;0px"&gt;=20
<BR>&lt;/a&gt; <BR>&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"c=
enter"&nbsp;style=3D"padding-right:&nbsp;0px;&nbsp;padding-left:&nbsp;0px=
;&nbsp;font-size:&nbsp;10px;&nbsp;padding-bottom:&nbsp;10px;&nbsp;color:&=
nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;padding-top:&nbsp;10px;&n=
bsp;font-family:&nbsp;Verdana"&gt;=20
<BR>Copyright&nbsp;=A9&nbsp;2009&nbsp;Faekoc&nbsp;Inc.&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;a&nbsp;style=3D"fo=
nt-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px=
;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&n=
bsp;href=3D"http://39d75058.xotafabuc.cn&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font-si=
ze:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&nbs=
p;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbsp;h=
ref=3D"http://947d73d26.xotafabuc.cn&gt;=20
<BR>Terms&nbsp;of&nbsp;Use&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font=
-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&=
nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbs=
p;href=3D"http://538e87.xotafabuc.cn&gt;=20
<BR>Contact&nbsp;Us&lt;/a&gt;&nbsp;|=20
<BR>&lt;a&nbsp;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&n=
bsp;line-height:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-dec=
oration:&nbsp;underline"&nbsp;href=3D"http://ce3.xotafabuc.cn&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/body&gt; <BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Tue&nbsp;Dec&nbsp;29=
&nbsp;06:18:13&nbsp;2009=20
<BR>Delivery-date:&nbsp;Tue,&nbsp;29&nbsp;Dec&nbsp;2009&nbsp;06:18:13&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NPa5d-0005Zc-8v=20
<BR>for&nbsp;[email-masked];&nbsp;Tue,&nbsp;29&nbsp;Dec&nbsp;2009&nb=
sp;06:18:13&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Supplier&nbsp;&lt;victim@sm=
tp.example&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;Visitor&nbsp;helm's&nbsp;personal&nbsp;80%&nbsp;OFF=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&gt;=20
<BR>&lt;html&gt; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;title&gt;Newslett=
er&lt;/title&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta&nbsp;content=
=3D"text/html;&nbsp;charset=3DUTF-8"&nbsp;http-equiv=3D"Content-Type"&gt;=
=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellsp=
acing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;align=3D"cente=
r"&nbsp;bgcolor=3D"#ffffff"&nbsp;border=3D"0"&nbsp;style=3D"border-right:=
&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;border-top:&nbsp;#e5e5e5&nbsp;1px=
&nbsp;solid;&nbsp;border-left:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;bor=
der-bottom:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"l=
eft"&nbsp;style=3D"padding-right:&nbsp;9px;&nbsp;padding-left:&nbsp;9px;&=
nbsp;padding-bottom:&nbsp;14px;&nbsp;padding-top:&nbsp;8px"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;p&nbsp;style=3D"ma=
rgin-top:&nbsp;0px;&nbsp;font-size:&nbsp;10px;&nbsp;margin-bottom:&nbsp;0=
px;&nbsp;color:&nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;font-fami=
ly:&nbsp;Verdana"&gt;=20
<BR>If&nbsp;you&nbsp;have&nbsp;any&nbsp;difficulty&nbsp;seeing&nbsp;the&n=
bsp;contents&nbsp;of&nbsp;this=20
<BR>e-mail,&nbsp;please&nbsp;click&nbsp;&lt;a&nbsp;target=3D"_blank"&nbsp=
;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-heigh=
t:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;=
underline"&nbsp;href=3D"http://student.tmhs.tcc.edu.tw&gt;=20
<BR>here&lt;/a&gt;.&lt;/p&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellspa=
cing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;border=3D"0"&gt=
;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;style=3D"te=
xt-align:&nbsp;center"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;br&gt;=20
<BR>&lt;a&nbsp;href=3D"http://student.tmhs.tcc.edu.tw&gt;&lt;img&nbsp;alt=
=3D"This&nbsp;picture&nbsp;is&nbsp;blocked.&nbsp;Click&nbsp;to&nbsp;unblo=
ck&nbsp;now"&nbsp;height=3D"432"&nbsp;src=3D"http://img44.imageshack.us&n=
bsp;width=3D"688"&nbsp;style=3D"border-width:&nbsp;0px"&gt;=20
<BR>&lt;/a&gt; <BR>&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"c=
enter"&nbsp;style=3D"padding-right:&nbsp;0px;&nbsp;padding-left:&nbsp;0px=
;&nbsp;font-size:&nbsp;10px;&nbsp;padding-bottom:&nbsp;10px;&nbsp;color:&=
nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;padding-top:&nbsp;10px;&n=
bsp;font-family:&nbsp;Verdana"&gt;=20
<BR>Copyright&nbsp;=A9&nbsp;2009&nbsp;Iduut&nbsp;Inc.&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;a&nbsp;style=3D"fo=
nt-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px=
;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&n=
bsp;href=3D"http://student.tmhs.tcc.edu.tw&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font-si=
ze:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&nbs=
p;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbsp;h=
ref=3D"http://student.tmhs.tcc.edu.tw&gt;=20
<BR>Terms&nbsp;of&nbsp;Use&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font=
-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&=
nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbs=
p;href=3D"http://student.tmhs.tcc.edu.tw&gt;=20
<BR>Contact&nbsp;Us&lt;/a&gt;&nbsp;|=20
<BR>&lt;a&nbsp;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&n=
bsp;line-height:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-dec=
oration:&nbsp;underline"&nbsp;href=3D"http://student.tmhs.tcc.edu.tw&gt; =

<BR>Unsubscribe&lt;/a&gt;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/body&gt; <BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Tue&nbsp;Dec&nbsp;29=
&nbsp;08:17:28&nbsp;2009=20
<BR>Delivery-date:&nbsp;Tue,&nbsp;29&nbsp;Dec&nbsp;2009&nbsp;08:17:28&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NPbx1-0002dk-Rk=20
<BR>for&nbsp;[email-masked];&nbsp;Tue,&nbsp;29&nbsp;Dec&nbsp;2009&nb=
sp;08:17:28&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Supplier&nbsp;&lt;victim@sm=
tp.example&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;Visitor&nbsp;headset's&nbsp;personal&nbsp;80%&nbsp;OFF =

<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&gt;=20
<BR>&lt;html&gt; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;title&gt;Newslett=
er&lt;/title&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta&nbsp;content=
=3D"text/html;&nbsp;charset=3DUTF-8"&nbsp;http-equiv=3D"Content-Type"&gt;=
=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellsp=
acing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;align=3D"cente=
r"&nbsp;bgcolor=3D"#ffffff"&nbsp;border=3D"0"&nbsp;style=3D"border-right:=
&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;border-top:&nbsp;#e5e5e5&nbsp;1px=
&nbsp;solid;&nbsp;border-left:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;bor=
der-bottom:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"l=
eft"&nbsp;style=3D"padding-right:&nbsp;9px;&nbsp;padding-left:&nbsp;9px;&=
nbsp;padding-bottom:&nbsp;14px;&nbsp;padding-top:&nbsp;8px"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;p&nbsp;style=3D"ma=
rgin-top:&nbsp;0px;&nbsp;font-size:&nbsp;10px;&nbsp;margin-bottom:&nbsp;0=
px;&nbsp;color:&nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;font-fami=
ly:&nbsp;Verdana"&gt;=20
<BR>If&nbsp;you&nbsp;have&nbsp;any&nbsp;difficulty&nbsp;seeing&nbsp;the&n=
bsp;contents&nbsp;of&nbsp;this=20
<BR>e-mail,&nbsp;please&nbsp;click&nbsp;&lt;a&nbsp;target=3D"_blank"&nbsp=
;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-heigh=
t:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;=
underline"&nbsp;href=3D"http://web143.mis02.de&gt;=20
<BR>here&lt;/a&gt;.&lt;/p&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellspa=
cing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;border=3D"0"&gt=
;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;style=3D"te=
xt-align:&nbsp;center"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;br&gt;=20
<BR>&lt;a&nbsp;href=3D"http://web143.mis02.de&gt;&lt;img&nbsp;alt=3D"This=
&nbsp;picture&nbsp;is&nbsp;blocked.&nbsp;Click&nbsp;to&nbsp;unblock&nbsp;=
now"&nbsp;height=3D"437"&nbsp;src=3D"http://img139.imageshack.us&nbsp;wid=
th=3D"696"&nbsp;style=3D"border-width:&nbsp;0px"&gt;=20
<BR>&lt;/a&gt; <BR>&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"c=
enter"&nbsp;style=3D"padding-right:&nbsp;0px;&nbsp;padding-left:&nbsp;0px=
;&nbsp;font-size:&nbsp;10px;&nbsp;padding-bottom:&nbsp;10px;&nbsp;color:&=
nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;padding-top:&nbsp;10px;&n=
bsp;font-family:&nbsp;Verdana"&gt;=20
<BR>Copyright&nbsp;=A9&nbsp;2009&nbsp;Ygizufewifof&nbsp;Inc.&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;a&nbsp;style=3D"fo=
nt-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px=
;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&n=
bsp;href=3D"http://web143.mis02.de&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font-si=
ze:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&nbs=
p;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbsp;h=
ref=3D"http://web143.mis02.de&gt;=20
<BR>Terms&nbsp;of&nbsp;Use&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font=
-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&=
nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbs=
p;href=3D"http://web143.mis02.de&gt;=20
<BR>Contact&nbsp;Us&lt;/a&gt;&nbsp;|=20
<BR>&lt;a&nbsp;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&n=
bsp;line-height:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-dec=
oration:&nbsp;underline"&nbsp;href=3D"http://web143.mis02.de&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/body&gt; <BR>&lt;/html&gt; </FONT></P>
<P></P>
<HR>

<P><FONT=20
size=3D-1><BR><BR>From&nbsp;[email-masked]&nbsp;Wed&nbsp;Dec&nbsp;30=
&nbsp;01:22:00&nbsp;2009=20
<BR>Delivery-date:&nbsp;Wed,&nbsp;30&nbsp;Dec&nbsp;2009&nbsp;01:22:00&nbs=
p;-0500=20
<BR>Received:&nbsp;from&nbsp;[82.117.196.254]=20
<BR>by&nbsp;mail.victim.example&nbsp;with&nbsp;esmtps&nbsp;(TLSv1:RC4-MD5=
:128)=20
<BR>(Exim&nbsp;4.63) =
<BR>(envelope-from&nbsp;&lt;[email-masked]&gt;)=20
<BR>id&nbsp;1NPrwW-0000bT-9r=20
<BR>for&nbsp;[email-masked];&nbsp;Wed,&nbsp;30&nbsp;Dec&nbsp;2009&nb=
sp;01:22:00&nbsp;-0500=20
<BR>From:&nbsp;VIAGRA&nbsp;(c)&nbsp;Best&nbsp;Supplier&nbsp;&lt;victim@sm=
tp.example&gt;=20
<BR>To:&nbsp;[email-masked]=20
<BR>Subject:&nbsp;Visitor&nbsp;grady's&nbsp;personal&nbsp;80%&nbsp;OFF=20
<BR>MIME-Version:&nbsp;1.0=20
<BR><BR>&lt;!DOCTYPE&nbsp;HTML&nbsp;PUBLIC&nbsp;"-//W3C//DTD&nbsp;HTML&nb=
sp;4.01&nbsp;Transitional//EN"&gt;=20
<BR>&lt;html&gt; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;title&gt;Newslett=
er&lt;/title&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta&nbsp;content=
=3D"text/html;&nbsp;charset=3DUTF-8"&nbsp;http-equiv=3D"Content-Type"&gt;=
=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/head&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;body&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellsp=
acing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;align=3D"cente=
r"&nbsp;bgcolor=3D"#ffffff"&nbsp;border=3D"0"&nbsp;style=3D"border-right:=
&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;border-top:&nbsp;#e5e5e5&nbsp;1px=
&nbsp;solid;&nbsp;border-left:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid;&nbsp;bor=
der-bottom:&nbsp;#e5e5e5&nbsp;1px&nbsp;solid"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"l=
eft"&nbsp;style=3D"padding-right:&nbsp;9px;&nbsp;padding-left:&nbsp;9px;&=
nbsp;padding-bottom:&nbsp;14px;&nbsp;padding-top:&nbsp;8px"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;p&nbsp;style=3D"ma=
rgin-top:&nbsp;0px;&nbsp;font-size:&nbsp;10px;&nbsp;margin-bottom:&nbsp;0=
px;&nbsp;color:&nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;font-fami=
ly:&nbsp;Verdana"&gt;=20
<BR>If&nbsp;you&nbsp;have&nbsp;any&nbsp;difficulty&nbsp;seeing&nbsp;the&n=
bsp;contents&nbsp;of&nbsp;this=20
<BR>e-mail,&nbsp;please&nbsp;click&nbsp;&lt;a&nbsp;target=3D"_blank"&nbsp=
;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-heigh=
t:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;=
underline"&nbsp;href=3D"http://shlapka.by.ru&gt;=20
<BR>here&lt;/a&gt;.&lt;/p&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;table&nbsp;cellspa=
cing=3D"0"&nbsp;cellpadding=3D"0"&nbsp;width=3D"750"&nbsp;border=3D"0"&gt=
;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;style=3D"te=
xt-align:&nbsp;center"&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;br&gt;=20
<BR>&lt;a&nbsp;href=3D"http://shlapka.by.ru&gt;&lt;img&nbsp;alt=3D"This&n=
bsp;picture&nbsp;is&nbsp;blocked.&nbsp;Click&nbsp;to&nbsp;unblock&nbsp;no=
w"&nbsp;height=3D"441"&nbsp;src=3D"http://img199.imageshack.us&nbsp;width=
=3D"684"&nbsp;style=3D"border-width:&nbsp;0px"&gt;=20
<BR>&lt;/a&gt; <BR>&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;td&nbsp;align=3D"c=
enter"&nbsp;style=3D"padding-right:&nbsp;0px;&nbsp;padding-left:&nbsp;0px=
;&nbsp;font-size:&nbsp;10px;&nbsp;padding-bottom:&nbsp;10px;&nbsp;color:&=
nbsp;#999999;&nbsp;line-height:&nbsp;12px;&nbsp;padding-top:&nbsp;10px;&n=
bsp;font-family:&nbsp;Verdana"&gt;=20
<BR>Copyright&nbsp;=A9&nbsp;2009&nbsp;Icudiygoud&nbsp;Inc.&lt;br&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;a&nbsp;style=3D"fo=
nt-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px=
;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&n=
bsp;href=3D"http://shlapka.by.ru&gt;=20
<BR>Privacy&nbsp;Policy&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font-si=
ze:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&nbs=
p;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbsp;h=
ref=3D"http://shlapka.by.ru&gt;=20
<BR>Terms&nbsp;of&nbsp;Use&lt;/a&gt;&nbsp;|&nbsp;&lt;a&nbsp;style=3D"font=
-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&nbsp;line-height:&nbsp;12px;&=
nbsp;font-family:&nbsp;Verdana;&nbsp;text-decoration:&nbsp;underline"&nbs=
p;href=3D"http://shlapka.by.ru&gt;=20
<BR>Contact&nbsp;Us&lt;/a&gt;&nbsp;|=20
<BR>&lt;a&nbsp;style=3D"font-size:&nbsp;10px;&nbsp;color:&nbsp;#00bdac;&n=
bsp;line-height:&nbsp;12px;&nbsp;font-family:&nbsp;Verdana;&nbsp;text-dec=
oration:&nbsp;underline"&nbsp;href=3D"http://shlapka.by.ru&gt;=20
<BR>Unsubscribe&lt;/a&gt;&lt;/td&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/tr&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&lt;/tbody&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/table&gt;=20
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/body&gt; <BR>&lt;/html&gt;=20
</FONT></P></DIV></BODY></HTML>

------=_NextPart_000_0035_01CA892A.71FF02D0--

From: "Murray S. Kucherawy" <[email-masked]>
To: Dave CROCKER <[email-masked]>
Date: Tue, 29 Dec 2009 23:42:40 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> -----Original Message-----
> From: Dave CROCKER [mailto:[email-masked]]
> Sent: Tuesday, December 29, 2009 11:40 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [feedback-report] Let's get started
> 
> To emphasize this: Your scenario sounds reasonable.  But each feature
> in a
> global standard is expensive.  So, I'm not trying to challenge the
> /idea/ of
> what you want to do, but rather am looking for a cost/benefit
> consensus.

I'm simply shaping Yakov's idea a little.  I'd also like some feedback from others, especially those that currently redact data (or anyone that would benefit from them labeling their ARFs as such).

Date: Tue, 29 Dec 2009 23:39:53 -0800
From: Dave CROCKER <[email-masked]>
Organization: Brandenburg InternetWorking
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

On 12/29/2009 11:34 PM, Murray S. Kucherawy wrote:
>> But some sort of "I played with the text" high-level indicator does not
>> seem all that procedurally useful.
>>
>> Enlighten me?
>
> I think my vision is two possible streams within the ADMD receiving the ARF
> message: one that handles unredacted content (maximum automation) and one
> that takes messages that admit to redacted content and routes them elsewhere
> for manual processing.

wow.  that's pretty scenario-specific, to build into a standard.  We could 
probably think of lots of other, reasonable specific scenarios that would 
require special support.

I think that such choices for a standard should require vigorous community 
agreement about its importance to include.

To emphasize this: Your scenario sounds reasonable.  But each feature in a 
global standard is expensive.  So, I'm not trying to challenge the /idea/ of 
what you want to do, but rather am looking for a cost/benefit consensus.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

From: "Murray S. Kucherawy" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Tue, 29 Dec 2009 23:34:39 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> -----Original Message-----
> From: Dave CROCKER [mailto:[email-masked]]
> Sent: Tuesday, December 29, 2009 11:25 PM
> To: Murray S. Kucherawy
> Cc: Yakov Shafranovich; SM; [email-masked]
> Subject: Re: [feedback-report] Let's get started
> 
> None of this sounds dangerous, but I'm not quite understanding what a
> single
> flag or even a list of header fields is useful for, in practical terms.
> 
> I could understand having an inline convention for flagging a sequence
> of bytes
> as having been redacted.  That tells the receiving processor exactly
> where text
> is "missing".
> 
> But some sort of "I played with the text" high-level indicator does not
> seem all
> that procedurally useful.
> 
> Enlighten me?

I think my vision is two possible streams within the ADMD receiving the ARF message: one that handles unredacted content (maximum automation) and one that takes messages that admit to redacted content and routes them elsewhere for manual processing.

Date: Tue, 29 Dec 2009 23:30:07 -0800
To: "Murray S. Kucherawy" <[email-masked]>
From: SM <[email-masked]>
Cc: [email-masked]
Subject: Re: [feedback-report] Let's get started

Hi Murray,
At 22:52 29-12-2009, Murray S. Kucherawy wrote:
>I think it is.  And we don't need to register it because it exists 
>in a format we're defining ourselves, not in the message header proper.
>
>Anyone object, or shall I add this and adjust various wording accordingly?

Steve Atkins posted a FAQ about some ARF related questions 
yesterday.  If whether redaction is allowed is out of scope, there is 
no need to define a "header" for it. It's not worth the bother 
telling senders what they can or cannot do as ARF is about defining a 
reporting format.  The question could be discussed in the 
informational document.

Regards,
-sm 

Date: Tue, 29 Dec 2009 23:24:54 -0800
From: Dave CROCKER <[email-masked]>
Organization: Brandenburg InternetWorking
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started
Reply-To: [email-masked]

On 12/29/2009 11:10 PM, Murray S. Kucherawy wrote:
>> -----Original Message----- From: Yakov Shafranovich
>> [mailto:[email-masked]] Sent: Tuesday, December 29, 2009 8:16 PM To: SM
>> Cc: Murray S. Kucherawy; [email-masked] Subject: Re:
>> [feedback-report] Let's get started
>>
>> Content-Redacted: Yes
>
> Perhaps rather than a Boolean value, the proposed header field could list the
> names of message header fields that contain redacted data.

None of this sounds dangerous, but I'm not quite understanding what a single 
flag or even a list of header fields is useful for, in practical terms.

I could understand having an inline convention for flagging a sequence of bytes 
as having been redacted.  That tells the receiving processor exactly where text 
is "missing".

But some sort of "I played with the text" high-level indicator does not seem all 
that procedurally useful.

Enlighten me?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

From: "Murray S. Kucherawy" <[email-masked]>
To: Yakov Shafranovich <[email-masked]>, SM <[email-masked]>
Date: Tue, 29 Dec 2009 23:10:40 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> -----Original Message-----
> From: Yakov Shafranovich [mailto:[email-masked]]
> Sent: Tuesday, December 29, 2009 8:16 PM
> To: SM
> Cc: Murray S. Kucherawy; [email-masked]
> Subject: Re: [feedback-report] Let's get started
> 
> Content-Redacted: Yes

Perhaps rather than a Boolean value, the proposed header field could list the names of message header fields that contain redacted data.

From: "Murray S. Kucherawy" <[email-masked]>
To: "John R. Levine" <[email-masked]>
Date: Tue, 29 Dec 2009 23:05:08 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> -----Original Message-----
> From: John R. Levine [mailto:[email-masked]]
> Sent: Tuesday, December 29, 2009 11:02 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [feedback-report] Let's get started
> 
> >> Content-Redacted: Yes
> >
> > I think it is.  And we don't need to register it because it exists in
> a format we're defining ourselves, not in the message header proper.
> >
> > Anyone object, or shall I add this and adjust various wording
> accordingly?
> 
> I don't have any theological objections, but it might be interesting to
> ask RR, AOL, and other ARF senders who redact whether they'd be likely
> to
> add it.

Well, they're on the list and (at least occasionally) participating.  Fellas?

Date: 30 Dec 2009 02:02:06 -0500
From: "John R. Levine" <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cleverness: None detected
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

>> Content-Redacted: Yes
>
> I think it is.  And we don't need to register it because it exists in a format we're defining ourselves, not in the message header proper.
>
> Anyone object, or shall I add this and adjust various wording accordingly?

I don't have any theological objections, but it might be interesting to 
ask RR, AOL, and other ARF senders who redact whether they'd be likely to 
add it.

R's,
John

From: "Murray S. Kucherawy" <[email-masked]>
To: Yakov Shafranovich <[email-masked]>, SM <[email-masked]>
Date: Tue, 29 Dec 2009 22:52:06 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> -----Original Message-----
> From: Yakov Shafranovich [mailto:[email-masked]]
> Sent: Tuesday, December 29, 2009 8:16 PM
> To: SM
> Cc: Murray S. Kucherawy; [email-masked]
> Subject: Re: [feedback-report] Let's get started
> 
> [...]
> I did not mean to imply that the X.400 header should be used, rather
> it is an example. The question is whether it is worthwhile to defined
> a header for part 2 of the ARF reports like this:
> 
> Content-Redacted: Yes

I think it is.  And we don't need to register it because it exists in a format we're defining ourselves, not in the message header proper.

Anyone object, or shall I add this and adjust various wording accordingly?

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 29 Dec 2009 23:15:36 -0500
To: SM <[email-masked]>
Cc: [email-masked]
Subject: Re: [feedback-report] Let's get started

On Tue, Dec 29, 2009 at 7:56 PM, SM <[email-masked]> wrote:
> Hi Murray,
>
>>The specific header field you give is defined in RFC2156 but
>>unfortunately there's no description of what specifically it
>>covers.  RFC4021 says it has to do with an incomplete body though,
>>which is generally not the case here.
>
> It's not a good idea to bring back X.400.
>

I did not mean to imply that the X.400 header should be used, rather
it is an example. The question is whether it is worthwhile to defined
a header for part 2 of the ARF reports like this:

Content-Redacted: Yes

Yakov

Date: Tue, 29 Dec 2009 16:56:47 -0800
To: "Murray S. Kucherawy" <[email-masked]>
From: SM <[email-masked]>
Cc: [email-masked]
Subject: Re: [feedback-report] Let's get started

Hi Murray,
At 15:46 29-12-2009, Murray S. Kucherawy wrote:
>I don't know of one, which is in fact why I changed the word 
>"standard" to "typical".

There are the "Resent-" mail headers.  There isn't a standardized 
forwarding prefix.

>The specific header field you give is defined in RFC2156 but 
>unfortunately there's no description of what specifically it 
>covers.  RFC4021 says it has to do with an incomplete body though, 
>which is generally not the case here.

It's not a good idea to bring back X.400.

Regards,
-sm 

From: "Murray S. Kucherawy" <[email-masked]>
To: Yakov Shafranovich <[email-masked]>
Date: Tue, 29 Dec 2009 15:46:41 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> -----Original Message-----
> From: Yakov Shafranovich [mailto:[email-masked]]
> Sent: Monday, December 28, 2009 6:12 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [feedback-report] Let's get started
> 
> [...]
> 1. Were we planning on putting the Domain Keys stuff into a companion
> draft instead of the main document? Then the following from section
> 1.1 should be removed:
> 
> "To advise providers that certify or otherwise make assertions about
> mail of recipient disagreement with the assertions."

Yep, it was a reference to the now-removed DKIM support.  Removed this text.

> 2. Section 1.1:
> "To inform email service providers or other primarily outbound
> 	senders that there may be issues regarding their mail; these
> 	issues include (but are not limited to) reports that the mail may
> 	be considered to be "spam" by a recipient of the message;
> "
> This may be too generic, perhaps we should narrow this specifically to
> abuse and related issues?

Fair enough.  I've inserted the word "abuse" before the first "issues", and that seems to cover it.

> 3. Section 2.f.:
> "which the report is being generated and MAY include only a typical
> forwarding prefix"
> 
> Is there an existing standard we need to reference that covers
> forwarding?

I don't know of one, which is in fact why I changed the word "standard" to "typical".  Anyone else know of one?

> 4. Section 4 - spelling error in "report types":
> 
> "Implementations using new rpeort types"

Fixed.

> 5. Section 6.6 - redaction:
> 
> Do we need a new header that indicates to the report recipient that
> the message was redacted? There is a header "Incomplete-Copy" in RFC
> 4021 which has a similar purpose for X400/email mappings.

I'd be fine with including such in the second MIME part that contains ARF-specific header fields.  Anyone else have a thought on this?

The specific header field you give is defined in RFC2156 but unfortunately there's no description of what specifically it covers.  RFC4021 says it has to do with an incomplete body though, which is generally not the case here.

> 6. A general question that was once raised on the mailing list - do we
> need to take into account RFC 3864 and the message header field
> registries?

I don't think so because we're not registering header fields that are used in header blocks of messages.  The header fields we're defining are part of the message body (a MIME part, in particular).  DSN (RFC3464), for example, did no header field registrations; all of the header fields it created are defined there, and it even created its own registries for values of a few of them.  I think that's a pretty good analogy for what we're doing with ARF.

Thanks for the review!

-MSK

Date: 29 Dec 2009 12:38:48 -0500
From: "John R. Levine" <[email-masked]>
To: "ARF mailing list" <[email-masked]>
Cleverness: None detected
Subject: Re: [feedback-report] Software for auto-sending ARF reports

>> I was wondering if there was some software that would directly send an
>> ARF report to the network administrator from whom the spam hit my
>> servers
>> It would be ideal if such a software has a MUA plugin, for thundebird
>> outlook express etc. So that we dont have to educate the clients on
>> properly forwarding the spam as attachment etc

There are plenty of MUA plugins to report spam.  But they don't work, 
because the MUA does not have enough information to reliably identify the 
source of the spam.  Mail managers I know generally discard such reports 
unread, because they're almost always wrong.

I have some perl scripts on my mail server that do automated ARF 
reporting, but they depend on the exact format of my MTA's Received: 
headers to figure out the actual source IP address, and to know which of 
the domain names in the headers are real.  They also use a large manually 
maintained set of IP ranges to deal with the large fraction of spam that 
comes from hosts without usable names.

It would make much more sense for the MUA to return the spam report to the 
MTA from which it picked up the mail, and for the spam reports to be 
aggregated and sent out from the MTA, since the report software can be 
tuned for the MTA's own header formats.  We've been discussing this over 
on the ASRG list.

See http://wiki.asrg.sp.am

R's,
John

Date: Tue, 29 Dec 2009 12:18:33 +0100
From: Tobias Knecht <[email-masked]>
Organization: abusix UG =?ISO-8859-15?Q?=28haftungsbeschr=E4nkt=29?=
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Software for auto-sending ARF reports

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig73809A4E0ED9610B4683AA32
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: quoted-printable

Hi Ram,

http://abusix.mycodebasehq.com/slingshot-public

This could be the thing you are looking for.

We do not provide any outlook or thunderbird plugin.

But I know about this one.
http://spamcomplaint.net/

Tobias

ram schrieb:
> Hi,
>=20
> As an anti spam solutions provider we quiet some FN reports.  Currently=

> I do not make much use of these reports.=20
> I have written some ( badly maintained :-( ) perl scripts to parse thes=
e
> mails and extract data for feeding bayes , or domain extraction etc
> We also manually go thru these reports sometimes.=20
> I was wondering if there was some software that would directly send an
> ARF report to the network administrator from whom the spam hit my
> servers
> It would be ideal if such a software has a MUA plugin, for thundebird
> outlook express etc. So that we dont have to educate the clients on
> properly forwarding the spam as attachment etc
>=20
> Strangely enough, I cant seem to find any software to do this , while
> according to me this would be *very* useful for everyone.=20
>=20
>=20
>=20
> Thanks
> Ram
>=20
>=20
>=20
>=20
>=20
>=20
> -----------------------------------------------------------------------=
-
>=20
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report

--------------enig73809A4E0ED9610B4683AA32
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

--------------enig73809A4E0ED9610B4683AA32--

From: ram <[email-masked]>
To: ARF mailing list <[email-masked]>
Date: Tue, 29 Dec 2009 10:55:46 +0530
Subject: [feedback-report] Software for auto-sending ARF reports

--=-JELDecGebcYGyyBQSByF
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Hi,

As an anti spam solutions provider we quiet some FN reports.  Currently
I do not make much use of these reports. 
I have written some ( badly maintained :-( ) perl scripts to parse these
mails and extract data for feeding bayes , or domain extraction etc
We also manually go thru these reports sometimes. 
I was wondering if there was some software that would directly send an
ARF report to the network administrator from whom the spam hit my
servers
It would be ideal if such a software has a MUA plugin, for thundebird
outlook express etc. So that we dont have to educate the clients on
properly forwarding the spam as attachment etc

Strangely enough, I cant seem to find any software to do this , while
according to me this would be *very* useful for everyone. 

Thanks
Ram

--=-JELDecGebcYGyyBQSByF
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
  <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
  <META NAME="GENERATOR" CONTENT="GtkHTML/3.16.3">
</HEAD>
<BODY>
Hi,<BR>
<BR>
As an anti spam solutions provider we quiet some FN reports.&nbsp; Currently I do not make much use of these reports. <BR>
I have written some ( badly maintained :-( ) perl scripts to parse these mails and extract data for feeding bayes , or domain extraction etc<BR>
We also manually go thru these reports sometimes. <BR>
I was wondering if there was some software that would directly send an ARF report to the network administrator from whom the spam hit my servers<BR>
It would be ideal if such a software has a MUA plugin, for thundebird outlook express etc. So that we dont have to educate the clients on properly forwarding the spam as attachment etc<BR>
<BR>
Strangely enough, I cant seem to find any software to do this , while according to me this would be *very* useful for everyone. <BR>
<BR>
<BR>
<BR>
Thanks<BR>
Ram<BR>
<BR>
<BR>
<BR>
</BODY>
</HTML>

--=-JELDecGebcYGyyBQSByF--

From: Steve Atkins <[email-masked]>
Date: Mon, 28 Dec 2009 15:23:37 -0500
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] On redacting data from ARF messages

On Dec 28, 2009, at 1:51 PM, J.D. Falk wrote:

> On Dec 28, 2009, at 6:41 AM, Steve Atkins wrote:
> 
>> My view is that ARF is a container format. As long as the message/rfc822 part makes some pretense to be an email, leaving the details of that as part of the agreement between the creator and the consumer of the feedback loop fits into that, and conveniently leaves the question of whether the creator has falsified any of the data out of scope of the ARF format itself.
> 
> I like this angle; it points the blame squarely to the redactor (rather than the RFC authors) and may move the conversation from "redaction should be outlawed!" to "if you don't like that an ARF stream is redacted, you can stop receiving it."

Exactly.

> 
>> Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless.
> 
> But if we don't discuss it in the draft initially, we'll have to discuss it within the WG every freakin' time someone new gets annoyed by redacted ARF messages.

That's a flaw with new people not skimming the archives (or non-new people forgetting history). Though I don't think I've seen it pop up that often.

Maybe we need a WG FAQ?

Q: Are ARF creators allowed to modify the email in the message/rfc822 section of the report?

A: We don't care. Out of scope.

Q: Should ARF creators do anything special when they modify the message/rfc822 section of the report from the original?

A: We don't care. Out of scope.

Q: But I can't identify what the email was!!!?

A1: We don't care. Out of scope.
A2: OK, OK. Read up on VERP and cookies and don't you have an unsubscribe link in the message somewhere too?

Q: But I'm an ISP, getting feedback reports about all my customers, and they claim the mail shouldn't have been sent as part of a FBL, and they'd prove that if they just had the recipient address!!!!!

A1: We don't care. Out of scope.
A2: OK, OK. Ask the creator of the FBL what they'd like you to do.

Q: But that means that AOL are meanies, who are sending reports about email that THEY NEVER ACTUALLY RECEIVED!!!!

A1: We don't care. Out of scope.
A2: So don't sign up for scomp then. Oh, and we still don't care. It's still out of scope.

Cheers,
  Steve

From: "J.D. Falk" <[email-masked]>
Date: Mon, 28 Dec 2009 11:51:01 -0700
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] On redacting data from ARF messages

On Dec 28, 2009, at 6:41 AM, Steve Atkins wrote:

> My view is that ARF is a container format. As long as the message/rfc822 part makes some pretense to be an email, leaving the details of that as part of the agreement between the creator and the consumer of the feedback loop fits into that, and conveniently leaves the question of whether the creator has falsified any of the data out of scope of the ARF format itself.

I like this angle; it points the blame squarely to the redactor (rather than the RFC authors) and may move the conversation from "redaction should be outlawed!" to "if you don't like that an ARF stream is redacted, you can stop receiving it."

> Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless.

But if we don't discuss it in the draft initially, we'll have to discuss it within the WG every freakin' time someone new gets annoyed by redacted ARF messages.

--
J.D. Falk <[email-masked]>
Return Path Inc

From: "J.D. Falk" <[email-masked]>
Date: Mon, 28 Dec 2009 11:50:18 -0700
To: [email-masked]
Subject: Re: [feedback-report] Let's get started

On Dec 28, 2009, at 1:44 AM, Murray S. Kucherawy wrote:

> An initial run at removing all of the stuff in ARF that's not actually in use today can be found, along with diffs to the currently published version, at http://www.blackops.org/~msk/arf.

I believe this draft accurately reflects current reality.  Ship it!

--
J.D. Falk <[email-masked]>
Return Path Inc

Date: 28 Dec 2009 10:34:57 -0500
From: "John R. Levine" <[email-masked]>
To: "Steve Atkins" <[email-masked]>
Cleverness: None detected
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] On redacting data from ARF messages

> Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless.

Agreed.  The current language is fine, people who redact are not going to 
add an extra header saying so.

R's,
John

Date: Mon, 28 Dec 2009 09:02:19 -0500
From: Todd Herr <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] On redacting data from ARF messages

On Sun, Dec 27, 2009 at 10:03:11PM -0800, Murray S. Kucherawy wrote:
> In starting to edit the ARF draft per the proposed charter, I think 
> the ARF spec should say something about the practice of redacting 
> portions of a message about which an ARF message is being generated.  
> I know there are strong feelings on each side of the debate.  However, 
> I don't want to get into a debate about MUSTs or MUST NOTs, although 
> maybe that is indeed appropriate (we can debate that as well).
> 
> My thoughts for now are that the spec should say that an ARF 
> generator SHOULD NOT redact any data as that impedes the usefulness 
> of the report, but then the Security Considerations section should 
> discuss why some ADMDs might decide to do so anyway, and how receivers 
> might react to them doing so, and what measures they can take to 
> archive the redacted information so that they can chase down complaints.
> 
> Comments?

We redact, and here's the stock answer we give to those who complain
about our practice of doing so:

-------------------------------------------------------------
Road Runner is the High Speed Data service provided to 
its customers by Time Warner Cable.  Our lawyers are of 
the opinion that we are required, by the provisions of 
the 1984 US Cable Privacy Act that speak to our customers'
personally identifiable information, to remove our customers'
email addresses from any and all feedback loop reports we
send.

While we appreciate your frustration regarding this, we
cannot do any more about it at this time.  We encourage
senders to use the Message-ID, X- headers, VERPs, or the
body of the message itself to identify the customer who
complained about your mail.  We will pass along in the 
feedback loop reports everything about your mail exactly
as we receive it from our customers, save for our redacting
every occurrence of our customers' email addresses.

The Cable Privacy Act can be found online at this URL:

http://epic.org/privacy/cable_tv/ctpa.html

If your mailing is not using Variable Envelope Return Paths
(VERPs), you might want to read more about them here:

http://en.wikipedia.org/wiki/VERP

Thank you.
-------------------------------------------------------------

You may find some of the above text useful in building the more
general sections of the Security Considerations section.

-- 
Todd Herr
Principal Engineer and Postmaster              V: 703.345.2447
Road Runner Email Operations                   M: 571.287.0366
[email-masked]                      AIM: RRMailToddHerr

From: Steve Atkins <[email-masked]>
Date: Mon, 28 Dec 2009 08:41:07 -0500
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] On redacting data from ARF messages

On Dec 28, 2009, at 1:03 AM, Murray S. Kucherawy wrote:

> In starting to edit the ARF draft per the proposed charter, I think the ARF spec should say something about the practice of redacting portions of a message about which an ARF message is being generated.  I know there are strong feelings on each side of the debate.  However, I don’t want to get into a debate about MUSTs or MUST NOTs, although maybe that is indeed appropriate (we can debate that as well).
>  
> My thoughts for now are that the spec should say that an ARF generator SHOULD NOT redact any data as that impedes the usefulness of the report, but then the Security Considerations section should discuss why some ADMDs might decide to do so anyway, and how receivers might react to them doing so, and what measures they can take to archive the redacted information so that they can chase down complaints.
>  
> Comments?

You might want to reread the last time this came up.

My view is that ARF is a container format. As long as the message/rfc822 part makes some pretense to be an email, leaving the details of that as part of the agreement between the creator and the consumer of the feedback loop fits into that, and conveniently leaves the question of whether the creator has falsified any of the data out of scope of the ARF format itself.

Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless.

Cheers,
  Steve

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 28 Dec 2009 09:13:08 -0500
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] On redacting data from ARF messages

I am not sure if SHOULD NOT is too strong, I think that section 6.6 as
defined now is pretty clear. I do wonder if we need a header
indicating redaction.

2009/12/28 Murray S. Kucherawy <[email-masked]>:
> In starting to edit the ARF draft per the proposed charter, I think the ARF
> spec should say something about the practice of redacting portions of a
> message about which an ARF message is being generated.  I know there are
> strong feelings on each side of the debate.  However, I don’t want to get
> into a debate about MUSTs or MUST NOTs, although maybe that is indeed
> appropriate (we can debate that as well).
>
>
>
> My thoughts for now are that the spec should say that an ARF generator
> SHOULD NOT redact any data as that impedes the usefulness of the report, but
> then the Security Considerations section should discuss why some ADMDs might
> decide to do so anyway, and how receivers might react to them doing so, and
> what measures they can take to archive the redacted information so that they
> can chase down complaints.
>
>
>
> Comments?
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>
>

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 28 Dec 2009 09:11:33 -0500
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

Murray,

Thanks for your hard work. Some comments:
1. Were we planning on putting the Domain Keys stuff into a companion
draft instead of the main document? Then the following from section
1.1 should be removed:

"To advise providers that certify or otherwise make assertions about
mail of recipient disagreement with the assertions."

2. Section 1.1:
"To inform email service providers or other primarily outbound
	senders that there may be issues regarding their mail; these
	issues include (but are not limited to) reports that the mail may
	be considered to be "spam" by a recipient of the message;
"
This may be too generic, perhaps we should narrow this specifically to
abuse and related issues?

3. Section 2.f.:
"which the report is being generated and MAY include only a typical
forwarding prefix"

Is there an existing standard we need to reference that covers forwarding?

4. Section 4 - spelling error in "report types":

"Implementations using new rpeort types"

5. Section 6.6 - redaction:

Do we need a new header that indicates to the report recipient that
the message was redacted? There is a header "Incomplete-Copy" in RFC
4021 which has a similar purpose for X400/email mappings.

6. A general question that was once raised on the mailing list - do we
need to take into account RFC 3864 and the message header field
registries?

Yakov

On Mon, Dec 28, 2009 at 3:44 AM, Murray S. Kucherawy <[email-masked]> wrote:
> An initial run at removing all of the stuff in ARF that's not actually in use today can be found, along with diffs to the currently published version, at http://www.blackops.org/~msk/arf.
>
> I've also copied some text that went into RFC5451 after one of the SecDir reviews to discuss extensibility, and added a bit more text in Security Considerations about the idea of omitting data from ARFs for privacy reasons.
>
> There was some other minor copy editing as well.
>
> Soliciting your comments.
>
> -MSK
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>

From: "Murray S. Kucherawy" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Mon, 28 Dec 2009 00:44:14 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: Re: [feedback-report] Let's get started

An initial run at removing all of the stuff in ARF that's not actually in use today can be found, along with diffs to the currently published version, at http://www.blackops.org/~msk/arf.

I've also copied some text that went into RFC5451 after one of the SecDir reviews to discuss extensibility, and added a bit more text in Security Considerations about the idea of omitting data from ARFs for privacy reasons.

There was some other minor copy editing as well.

Soliciting your comments.

-MSK

From: "Murray S. Kucherawy" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Sun, 27 Dec 2009 22:03:11 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: [feedback-report] On redacting data from ARF messages

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

In starting to edit the ARF draft per the proposed charter, I think the ARF=
 spec should say something about the practice of redacting portions of a me=
ssage about which an ARF message is being generated.  I know there are stro=
ng feelings on each side of the debate.  However, I don't want to get into =
a debate about MUSTs or MUST NOTs, although maybe that is indeed appropriat=
e (we can debate that as well).

My thoughts for now are that the spec should say that an ARF generator SHOU=
LD NOT redact any data as that impedes the usefulness of the report, but th=
en the Security Considerations section should discuss why some ADMDs might =
decide to do so anyway, and how receivers might react to them doing so, and=
 what measures they can take to archive the redacted information so that th=
ey can chase down complaints.

Comments?

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page Section1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
	{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
  <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal>In starting to edit the ARF draft per the proposed cha=
rter, I
think the ARF spec should say something about the practice of redacting
portions of a message about which an ARF message is being generated.&nbsp; =
I
know there are strong feelings on each side of the debate.&nbsp; However, I=
 don&#8217;t
want to get into a debate about MUSTs or MUST NOTs, although maybe that is
indeed appropriate (we can debate that as well).<o:p></o:p></p>

<p class=3DMsoNormal><o:p>&nbsp;</o:p></p>

<p class=3DMsoNormal>My thoughts for now are that the spec should say that =
an ARF
generator SHOULD NOT redact any data as that impedes the usefulness of the
report, but then the Security Considerations section should discuss why som=
e
ADMDs might decide to do so anyway, and how receivers might react to them d=
oing
so, and what measures they can take to archive the redacted information so =
that
they can chase down complaints.<o:p></o:p></p>

<p class=3DMsoNormal><o:p>&nbsp;</o:p></p>

<p class=3DMsoNormal>Comments?<o:p></o:p></p>

</div>

</body>

</html>

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_--

Date: Sun, 27 Dec 2009 20:06:14 -0800 (PST)
From: loretta lotito <[email-masked]>
To: [email-masked]
Subject: [feedback-report] list

--0-1829281109-1261973175=:55795
Content-Type: text/plain; charset=us-ascii

Hello!

      
--0-1829281109-1261973175=:55795
Content-Type: multipart/related; boundary="0-87600532-1261973175=:55795"

--0-87600532-1261973175=:55795
Content-Type: text/html; charset=us-ascii

<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:tahoma, new york, times, serif;font-size:12pt;color:#ffffff;"><table width="100%" cellspacing="0" cellpadding="0" align="center"><tbody><tr><td height="68" bgcolor="#000000"><table cellpadding="0" cellspacing="0" align="left"><tr><td width="386" height="68"><img src="cid:[email-masked]" width="386" /></td><td align="right" width="*"> </td></tr></table></td></tr><tr><td width="100%"  height="100%" bgcolor="#000000" valign="top"><table  width="100%" height="100%" style="table-layout:fixed;" cellspacing="0" cellpadding="0" align="center"><tbody><tr><td width="50"> </td><td valign="top" style="overflow: hidden; text-overflow: ellipsis; white-space: nowrap;"><table width="100%" style="white-space:normal;" cellspacing="0" cellpadding="0"><tbody><tr><td height="20"> </td></tr><tr><td><font face="tahoma, new york, times, serif" size="3"
 color="#ffffff" style="font-family:tahoma, new york, times, serif;font-size:10pt;color:#ffffff;"><div style="text-align:undefined;"><DIV>Hello!</DIV><!-- cg22.c4.mail.gq1.yahoo.com compressed/chunked Fri Dec  4 18:26:40 PST 2009 --></div></font></td></tr><tr><td height="40"> </td></tr></tbody></table></td><td width="136" align="right" valign="bottom"><img src="cid:[email-masked]" width="126" height="121" alt="" border="0"></td></tr></tbody></table></td></tr></tbody></table></div><br>

      </body></html>
--0-87600532-1261973175=:55795
Content-Type: image/gif; name="--static--piratelife_rb.gif"
Content-Transfer-Encoding: base64
Content-Id: <[email-masked]>
Content-Disposition: inline

--0-87600532-1261973175=:55795
Content-Type: image/gif; name="--static--piratelife_tl.gif"
Content-Transfer-Encoding: base64
Content-Id: <[email-masked]>
Content-Disposition: inline

--0-87600532-1261973175=:55795--
--0-1829281109-1261973175=:55795--

Date: Thu, 17 Dec 2009 11:59:13 -0800
From: Douglas Otis <[email-masked]>
To: [email-masked], ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] [Asrg] Adding a spam button to MUAs

On 12/17/09 10:34 AM, Nathaniel Borenstein wrote:
> There's a difference between having an "A or B" bit, and having
> separate "A" and "B" bits that may be muddled.  If you don't know the
> right way to interpret the two bits, then the single bit is
> potentially much less misleading.
>
> But as I said, this is something that could really be resolved by
> empirical study, and I'd prefer not to trust my intuition or anyone
> else's if we can figure out the facts about how people would actually
> use two buttons.  If the error rate is low enough, then two buttons
> will make sense, but I've rarely managed to underestimate the
> competence of the average user.   Two buttons is way more than twice
> as confusing as one, in this case.  -- Nathaniel
>
> On Dec 17, 2009, at 1:25 PM, Seth wrote:
>
>> Nathaniel Borenstein<[email-masked]>  wrote:
>>> On Dec 17, 2009, at 11:27 AM, Ian Eiloart wrote:
>>
>>>> Twitter seems to think that users are smart enough to
>>>> distinguish between "unwanted" and "spam". They give you a
>>>> button for each. It's an important distinction that most people
>>>> can make.
>>>
>>> Twitter isn't always right, and my intuition differs from yours
>>> on this one.  Fortunately it's something that could be resolved
>>> empirically.  I'd like to see such a study, because it wouldn't
>>> take very many users who *can't* properly make that distinction
>>> to render the two-button solution counterproductive.  I'd rather
>>> have one bit of meaningful data than two bits of muddled data.
>>> -- Nathaniel
>>
>> One button is the "OR" of the two buttons, so there's no less
>> information available.  Given enough data, it should be easy to
>> get pretty accurate statistics on how reliable _each_ user is, and
>> the unreliable ones can be mapped into the one-button treatment.

Agreed. After all, can users recognize an auto-response in Chinese, or
know the difference between real or spoofed DSNs?  Of course not.

All that can be determined from user feedback metrics is that 'X' number
of messages from some source were "unwanted".  Filters can be trained at
removing "unwanted" for specific users based upon their feedback,
however this information's usefulness is limited without knowing overall
source volumes, and whether messages might have been either foreign
language auto-responses, or valid DSNs.

Having "unwanted" considered equivalent of "spam-trap" feedback will
create a number of complaints, especially when dealing with a diverse
range of users.  Spam-trap email-addresses do not solicit email and are
good at excluding auto-responses and valid DSN.  This allows spam-trap
feedback be applied over a larger range of users with less regard to
overall source volume.  Unfortunately, since no provider is able to
ensure all customers are not 0wned, even "spam-trap" feedback can
benefit when overall volume is shared.

Our process consolidates metrics for all activity seen from each
specific source and evaluates related metrics in a non-linear fashion.
Offering this information within ARF feedback would not entail a sizable
increase in report size to include a field of "source activity rate" as
a method to share the number of message events (good or bad) seen over
some number of seconds.

Volume metrics added to an ARF report might look something like:

IP-Activity: [source-IP], [#messages], [#seconds];
DKIM-Activity: [d=], [#messages], [#seconds];

Such as
IP-Activity: 192.0.2.128,34566,86400;
DKIM-Activity: example.com,4013,86400;

When metrics are passed through a feedback conduit, each source should
be qualified as representing spam-trap feedback, or user feedback, where
feedback metrics from multiple sources would be consolidated into at
least two separate categories.

-Doug

From: "Murray S. Kucherawy" <[email-masked]>
To: Steve Atkins <[email-masked]>, ARF mailing list <[email-masked]>
Date: Mon, 14 Dec 2009 15:03:46 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: Re: [feedback-report] Let's get started

In the context of an ARF WG, I'd be fine with doing the ARF-specific part within the WG and advancing the DKIM extensions via an individual submission or via the DKIM WG (if it will take up the work).
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Steve Atkins [[email-masked]]
Sent: Monday, December 14, 2009 12:02 PM
To: ARF mailing list
Subject: Re: [feedback-report] Let's get started

On Dec 14, 2009, at 11:11 AM, John R. Levine wrote:

>> I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so.
>
> Both are fine with me.  The stuff in (2) really needs something other than
> ARF (INCH-lite, apparently)

+1

> but (3) is a report about a single message.

Kinda. (3) is two almost entirely separate things. One part is a new ARF subtype that allows sending feedback about a single message. But the other part is an extension to RFC 4871 that has almost nothing to do with ARF (but which could be part of point (4)).

The first part is something it seems perfectly reasonable to move ahead with right away. The second part (hacking on DKIM key records) is out of scope for ARF - though certainly something to be discussed if we go ahead with the can-o-worms in point (4).

Treating the two parts of point 3 entirely separately might help the ARF-related half avoid being bogged down by the likely prolonged discussions that'll likely provoke.

Cheers,
  Steve

>>>
>>>
>>>      3) The group will specify the integration of ARF into DKIM DNS key records, with
>>>         draft-kucherawy-dkim-reporting as its input.  It contains extensions
>>>         to DKIM that are related to ARF as a means of reporting DKIM-related failures
>>>         which include phishing ("fraud") and as such are relevant to the ARF effort.
>>>         The group will produce Proposed Standard track specification for these
>>>         ARF and DKIM extensions.
>>>
>>>
>> I would be much happier if the item 2 (and possibly 3) is done once the
>> WG completes 1 and 4 and recharters.
>> Any objections?
>>
>>>      4) The group will finally consider a means for publishing the address
>>>         to which ARF reports should be sent.  Not all ARF participants wish to use
>>>         abuse@(domain), which is the current standard (RFC2142) , as the place to send
>>>         automated ARF-formatted reports.  The group will either conclude that the industry
>>>         should continue to use this de facto standard (and thus no specification is appropriate),
>>>         or will produce a Proposed Standard track document identifying the means by which
>>>         that address should be advertised.
>>>
>>>      The group may consider re-chartering to cover related work, such as further extensions,
>>>      once these deliverables have been achieved.
>>>

_______________________________________________
abuse-feedback-report mailing list
[email-masked]
http://mipassoc.org/mailman/listinfo/abuse-feedback-report

Date: 14 Dec 2009 16:48:57 -0500
From: "John R. Levine" <[email-masked]>
To: "Steve Atkins" <[email-masked]>
Cleverness: None detected
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

>
> The first part is something it seems perfectly reasonable to move ahead with right away. The second part (hacking on DKIM key records) is out of scope for ARF - though certainly something to be discussed if we go ahead with the can-o-worms in point (4).
>
> Treating the two parts of point 3 entirely separately might help the ARF-related half avoid being bogged down by the likely prolonged discussions that'll likely provoke.

+1

From: Steve Atkins <[email-masked]>
Date: Mon, 14 Dec 2009 12:02:21 -0800
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

On Dec 14, 2009, at 11:11 AM, John R. Levine wrote:

>> I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so.
> 
> Both are fine with me.  The stuff in (2) really needs something other than 
> ARF (INCH-lite, apparently)

+1

> but (3) is a report about a single message.

Kinda. (3) is two almost entirely separate things. One part is a new ARF subtype that allows sending feedback about a single message. But the other part is an extension to RFC 4871 that has almost nothing to do with ARF (but which could be part of point (4)).

The first part is something it seems perfectly reasonable to move ahead with right away. The second part (hacking on DKIM key records) is out of scope for ARF - though certainly something to be discussed if we go ahead with the can-o-worms in point (4).

Treating the two parts of point 3 entirely separately might help the ARF-related half avoid being bogged down by the likely prolonged discussions that'll likely provoke.

Cheers,
  Steve

>>> 
>>> 
>>>      3) The group will specify the integration of ARF into DKIM DNS key records, with
>>>         draft-kucherawy-dkim-reporting as its input.  It contains extensions
>>>         to DKIM that are related to ARF as a means of reporting DKIM-related failures
>>>         which include phishing ("fraud") and as such are relevant to the ARF effort.
>>>         The group will produce Proposed Standard track specification for these
>>>         ARF and DKIM extensions.
>>> 
>>> 
>> I would be much happier if the item 2 (and possibly 3) is done once the
>> WG completes 1 and 4 and recharters.
>> Any objections?
>> 
>>>      4) The group will finally consider a means for publishing the address
>>>         to which ARF reports should be sent.  Not all ARF participants wish to use
>>>         abuse@(domain), which is the current standard (RFC2142) , as the place to send
>>>         automated ARF-formatted reports.  The group will either conclude that the industry
>>>         should continue to use this de facto standard (and thus no specification is appropriate),
>>>         or will produce a Proposed Standard track document identifying the means by which
>>>         that address should be advertised.
>>> 
>>>      The group may consider re-chartering to cover related work, such as further extensions,
>>>      once these deliverables have been achieved.
>>> 

Date: 14 Dec 2009 14:11:52 -0500
From: "John R. Levine" <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cleverness: None detected
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so.

Both are fine with me.  The stuff in (2) really needs something other than 
ARF (INCH-lite, apparently) but (3) is a report about a single message.

R's,
John

> ________________________________________
> From: Alexey Melnikov [[email-masked]]
> Sent: Friday, December 11, 2009 4:02 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [feedback-report] Let's get started
>
> The charter text seems reasonable in general (I might send some minor
> editorial comments separately). One meta-comment below:
>
> Murray S. Kucherawy wrote:
>
>>        Thus, the working group's specific tasks are as follows:
>>
>>       1) The group will first produce a Proposed Standard track specification of ARF.
>>          This will document current use, removing any portions that are not implemented and/or
>>          not required for a minimum implementation (to be published later as extensions).
>>          This will include not only the format of an ARF message, but must also include
>>          appropriate documentation of security considerations and creation of IANA registries
>>          for elements of ARF to support future extensions, as well as informational sections
>>          conveying current best practises.
>>
>>       2) The following possilble reporting extensions have been proposed and will be considered
>>          possible for publication as extensions to the base specification:
>>
>>          a) drop boxes (detection of a mailbox used to receive things like stolen
>>             credit cards)
>>          b) botnet detection (i.e. reporting of traffic that appears to have come
>>             from a bot, regardless of content)
>>          c) SSH attacks
>>          d) FTP attacks
>>          e) Web server attacks
>>          f) mail sent to a honeypot or spam trap
>>          g) malware connections to sinkholes
>>          h) DDoS reports
>>          i) portions of the pre-IETF verison of the specification that were removed in (1)
>>             above to produce a minimal base document
>>          j) others that may be proposed within the allotted timeframe
>>
>>       3) The group will specify the integration of ARF into DKIM DNS key records, with
>>          draft-kucherawy-dkim-reporting as its input.  It contains extensions
>>          to DKIM that are related to ARF as a means of reporting DKIM-related failures
>>          which include phishing ("fraud") and as such are relevant to the ARF effort.
>>          The group will produce Proposed Standard track specification for these
>>          ARF and DKIM extensions.
>>
>>
> I would be much happier if the item 2 (and possibly 3) is done once the
> WG completes 1 and 4 and recharters.
> Any objections?
>
>>       4) The group will finally consider a means for publishing the address
>>          to which ARF reports should be sent.  Not all ARF participants wish to use
>>          abuse@(domain), which is the current standard (RFC2142) , as the place to send
>>          automated ARF-formatted reports.  The group will either conclude that the industry
>>          should continue to use this de facto standard (and thus no specification is appropriate),
>>          or will produce a Proposed Standard track document identifying the means by which
>>          that address should be advertised.
>>
>>       The group may consider re-chartering to cover related work, such as further extensions,
>>       once these deliverables have been achieved.
>>
>>
>
>>
>>
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

From: "Murray S. Kucherawy" <[email-masked]>
To: Alexey Melnikov <[email-masked]>
Date: Mon, 14 Dec 2009 09:52:21 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so.
________________________________________
From: Alexey Melnikov [[email-masked]]
Sent: Friday, December 11, 2009 4:02 PM
To: Murray S. Kucherawy
Cc: [email-masked]
Subject: Re: [feedback-report] Let's get started

The charter text seems reasonable in general (I might send some minor
editorial comments separately). One meta-comment below:

Murray S. Kucherawy wrote:

>        Thus, the working group's specific tasks are as follows:
>
>       1) The group will first produce a Proposed Standard track specification of ARF.
>          This will document current use, removing any portions that are not implemented and/or
>          not required for a minimum implementation (to be published later as extensions).
>          This will include not only the format of an ARF message, but must also include
>          appropriate documentation of security considerations and creation of IANA registries
>          for elements of ARF to support future extensions, as well as informational sections
>          conveying current best practises.
>
>       2) The following possilble reporting extensions have been proposed and will be considered
>          possible for publication as extensions to the base specification:
>
>          a) drop boxes (detection of a mailbox used to receive things like stolen
>             credit cards)
>          b) botnet detection (i.e. reporting of traffic that appears to have come
>             from a bot, regardless of content)
>          c) SSH attacks
>          d) FTP attacks
>          e) Web server attacks
>          f) mail sent to a honeypot or spam trap
>          g) malware connections to sinkholes
>          h) DDoS reports
>          i) portions of the pre-IETF verison of the specification that were removed in (1)
>             above to produce a minimal base document
>          j) others that may be proposed within the allotted timeframe
>
>       3) The group will specify the integration of ARF into DKIM DNS key records, with
>          draft-kucherawy-dkim-reporting as its input.  It contains extensions
>          to DKIM that are related to ARF as a means of reporting DKIM-related failures
>          which include phishing ("fraud") and as such are relevant to the ARF effort.
>          The group will produce Proposed Standard track specification for these
>          ARF and DKIM extensions.
>
>
I would be much happier if the item 2 (and possibly 3) is done once the
WG completes 1 and 4 and recharters.
Any objections?

>       4) The group will finally consider a means for publishing the address
>          to which ARF reports should be sent.  Not all ARF participants wish to use
>          abuse@(domain), which is the current standard (RFC2142) , as the place to send
>          automated ARF-formatted reports.  The group will either conclude that the industry
>          should continue to use this de facto standard (and thus no specification is appropriate),
>          or will produce a Proposed Standard track document identifying the means by which
>          that address should be advertised.
>
>       The group may consider re-chartering to cover related work, such as further extensions,
>       once these deliverables have been achieved.
>
>

>
>

Date: Sat, 12 Dec 2009 11:12:10 +0100
From: Alessandro Vesely <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

John R. Levine wrote:
> Also, from a purely technical point of view, ARF is multitype/report which 
> means that it always has one (1) email message attached.  Trying to use it 
> for something other than mail reports really would be driving nails with a 
> screwdriver.

It may be worth noting that ARF is by maibox providers for mailbox 
providers, which explains why it has been crafted that way.

Mailbox providers reporting, say, port scans to their connection 
providers, much like mailbox users reporting mail abuse, should 
follow whatever rules and tools the relevant provider provides.

Date: Sat, 12 Dec 2009 00:02:21 +0000
From: Alexey Melnikov <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

The charter text seems reasonable in general (I might send some minor 
editorial comments separately). One meta-comment below:

Murray S. Kucherawy wrote:

>        Thus, the working group's specific tasks are as follows:
>
>	1) The group will first produce a Proposed Standard track specification of ARF.
>	   This will document current use, removing any portions that are not implemented and/or
>	   not required for a minimum implementation (to be published later as extensions).
>	   This will include not only the format of an ARF message, but must also include
>	   appropriate documentation of security considerations and creation of IANA registries
>	   for elements of ARF to support future extensions, as well as informational sections
>	   conveying current best practises.
>
>	2) The following possilble reporting extensions have been proposed and will be considered
>	   possible for publication as extensions to the base specification:
>
>	   a) drop boxes (detection of a mailbox used to receive things like stolen
>	      credit cards)
>	   b) botnet detection (i.e. reporting of traffic that appears to have come
>	      from a bot, regardless of content)
>	   c) SSH attacks
>	   d) FTP attacks
>	   e) Web server attacks
>	   f) mail sent to a honeypot or spam trap
>	   g) malware connections to sinkholes
>	   h) DDoS reports
>	   i) portions of the pre-IETF verison of the specification that were removed in (1)
>	      above to produce a minimal base document
>	   j) others that may be proposed within the allotted timeframe
>
>	3) The group will specify the integration of ARF into DKIM DNS key records, with
>	   draft-kucherawy-dkim-reporting as its input.  It contains extensions
>	   to DKIM that are related to ARF as a means of reporting DKIM-related failures
>	   which include phishing ("fraud") and as such are relevant to the ARF effort.
>	   The group will produce Proposed Standard track specification for these
>	   ARF and DKIM extensions.
>  
>
I would be much happier if the item 2 (and possibly 3) is done once the 
WG completes 1 and 4 and recharters.
Any objections?

>	4) The group will finally consider a means for publishing the address
>	   to which ARF reports should be sent.  Not all ARF participants wish to use
>	   abuse@(domain), which is the current standard (RFC2142) , as the place to send
>	   automated ARF-formatted reports.  The group will either conclude that the industry
>	   should continue to use this de facto standard (and thus no specification is appropriate),
>	   or will produce a Proposed Standard track document identifying the means by which
>	   that address should be advertised.
>
>	The group may consider re-chartering to cover related work, such as further extensions,
>	once these deliverables have been achieved.
>  
>

>  
>

Date: Fri, 11 Dec 2009 23:01:21 +0000
From: Alexey Melnikov <[email-masked]>
To: "John R. Levine" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

John R. Levine wrote:

>>Sad enough that some of them can not remember that conversation 1 and
>>half month later. :-(
>>    
>>
>Hmmn.  Would that be a conversation in which someone pointed out that the 
>IESG would never accept an overgrown ARF that tried to reinvent INCH so it 
>would be a waste of time to do?
>  
>
It is not clear to me that IESG has any preferences one way or another.

>Reporting other kinds of abuse is a reasonable thing to do.  Trying to do 
>it in ARF, which is specifically a format for reporting a single mail 
>message is not.  You're trying to hammer nails with a screwdriver.
>
>We're aware of the perception that INCH is "too complicated", but you 
>can't solve that by breaking ARF.  We're aware that there is a misguided 
>effort in Germany to cram every other kind of abuse report into ARF.  But 
>that still doesn't make it a good idea.
>  
>
-- 
IETF Application Area Director, <http://www.ietf.org/IESGmems.html>
Internet Messaging Team Lead, <http://www.isode.com>
JID: same as my email address

Date: 11 Dec 2009 18:08:28 -0500
From: "John R. Levine" <[email-masked]>
To: "Alexey Melnikov" <[email-masked]>
Cleverness: None detected
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

>> Hmmn.  Would that be a conversation in which someone pointed out that the 
>> IESG would never accept an overgrown ARF that tried to reinvent INCH so it 
>> would be a waste of time to do?
>> 
> It is not clear to me that IESG has any preferences one way or another.

I was under the impression that INCH was a political football, so 
something that looks like quasi-INCH could be an issue.

Also, from a purely technical point of view, ARF is multitype/report which 
means that it always has one (1) email message attached.  Trying to use it 
for something other than mail reports really would be driving nails with a 
screwdriver.

Given how complex INCH is, it might well be worthwhile to make subset
profiles and tools to help people use it but that's not part of an ARF 
effort.

R's,
John

From: "J.D. Falk" <[email-masked]>
Date: Fri, 11 Dec 2009 15:17:43 -0700
To: [email-masked]
Subject: Re: [feedback-report] Let's get started

On Dec 10, 2009, at 11:09 AM, Murray S. Kucherawy wrote:

> The first thing on our to-do list is to trim the fat from the current draft, meaning remove all the report types and other things that aren’t currently in use.  I believe I heard someone say that only “abuse” is currently in use, and I suspect other than OpenDKIM and its antecedent, nobody’s implemented the DKIM reporting stuff yet.  If everyone concurs, I’ll push out a proposed update to the list that removes all but “abuse” while still leaving room for the rest to be re-added in later drafts as extensions.

I concur.

One of the reasons ARF has been successful is that it is simple -- and it's even simpler in practice than in the draft.  Standardizing that simplicity (and not adding any unnecessary complexities) will be of great benefit to the community.

--
J.D. Falk <[email-masked]>
Return Path Inc

Date: 11 Dec 2009 09:12:51 -0500
From: "John R. Levine" <[email-masked]>
To: "Tobias Knecht" <[email-masked]>
Cleverness: None detected
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> Sad enough that some of them can not remember that conversation 1 and
> half month later. :-(

Hmmn.  Would that be a conversation in which someone pointed out that the 
IESG would never accept an overgrown ARF that tried to reinvent INCH so it 
would be a waste of time to do?

Reporting other kinds of abuse is a reasonable thing to do.  Trying to do 
it in ARF, which is specifically a format for reporting a single mail 
message is not.  You're trying to hammer nails with a screwdriver.

We're aware of the perception that INCH is "too complicated", but you 
can't solve that by breaking ARF.  We're aware that there is a misguided 
effort in Germany to cram every other kind of abuse report into ARF.  But 
that still doesn't make it a good idea.

R's,
John

Date: Fri, 11 Dec 2009 09:53:40 +0100
From: Tobias Knecht <[email-masked]>
Organization: abusix UG =?ISO-8859-1?Q?=28haftungsbeschr=E4nkt=29?=
CC: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig5C430D40B9585E5856D05E10
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Markus,

> So I guess paragraph 2) of "arf-charter v06.txt" is dead and buried.

It is not. ;-)
Not for me, probably you and many others.

I talked to severall people at maawg in Philladelphia and all of them
agreed about an ARF Version 2, that is giving space for all other kinds
of abusive behavior.

Sad enough that some of them can not remember that conversation 1 and
half month later. :-(

And you are absolutley right, that we should discuss the possibilities
and the basics of this integration now, so extensions or ARF Version 2
will be more easy to implement.

I fully agree Murrays arf-charter v06!

Thanks,

Tobias

--=20
| Tobias Knecht | abusix UG (haftungsbeschraenkt)
| [email-masked] | http://abusix.org
| Postfach 210127 | 76151 Karlsruhe | Germany
| ---
| Register of Companies(Handelsregister): HRB 707959
| District of Court(Amtsgericht) Mannheim/Germany
| Registered Office: Karlsruhe/Germany
| CEO: Tobias Knecht

--------------enig5C430D40B9585E5856D05E10
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

--------------enig5C430D40B9585E5856D05E10--

Date: Thu, 10 Dec 2009 22:21:37 -0800
To: "Murray S. Kucherawy" <[email-masked]>
From: SM <[email-masked]>
Cc: [email-masked]
Subject: Re: [feedback-report] Let's get started

Hi Murray,
At 10:09 10-12-2009, Murray S. Kucherawy wrote:
>Does everyone agree with that?  Are there any other changes that the 
>group should consider for the next draft?

   "conveying current best practises"

should be

   conveying current best practices

   "following possilble reporting extensions"

should be

   following possible reporting extensions

   "portions of the pre-IETF verison"

should be

   portions of the pre-IETF version

  "The working group should consider such factors as:
         * implementer experience

There is also "ability to achieve broad implementation" in that 
list.  What is the "implementer experience" for?

Under the specific tasks, you listed:

            c) SSH attacks
            d) FTP attacks
            e) Web server attacks

as possible reporting extensions.  These do not look like reporting 
extensions unless you plan to write a standard specifically for SSH 
attacks, etc.  Maybe you plan to have a reporting extension for brute 
force attacks.  Or better, to consider reporting extensions for the 
following types of abuse.

Regards,
-sm 

Date: Fri, 11 Dec 2009 07:35:49 +0100
From: Markus Stumpf <[email-masked]>
To: "[email-masked]" <[email-masked]>
Organization: maexotic.de, Muenchen, Germany
Subject: Re: [feedback-report] Let's get started

On Thu, Dec 10, 2009 at 08:13:47PM -0500, John R. Levine wrote:
> Can we please not have this utterly unproductive argument again?

This is fine for me.
I didn't follow the result of the discussion about the extensions too closely
(my fault) and as the topics appeared on "arf-charter v06.txt" again I tought
I might also throw that in.
So I guess paragraph 2) of "arf-charter v06.txt" is dead and buried.

The remaining topics would then be
a) make the exsiting ARF format a standard
b) define a way to integrate ARF with DKIM to
   o  signal acceptance of ARF format reports
   o  publish an email address where the reports are to be sent to

	\Maex

Date: 10 Dec 2009 20:13:47 -0500
From: "John R. Levine" <[email-masked]>
To: "Markus Stumpf" <[email-masked]>
Cleverness: None detected
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

Can we please not have this utterly unproductive argument again?

ARF is a way to send in a report about one (1) e-mail message.  It is not 
for anything else.  It cannot be for anything else.  In particular, it is 
not a generic abuse reporting system.  If you want INCH, you know where to 
find it.

If you don't believe me, please review the endless debate on this topic so 
we don't have to have it again.

On Fri, 11 Dec 2009, Markus Stumpf wrote:

> On Thu, Dec 10, 2009 at 10:09:08AM -0800, Murray S. Kucherawy wrote:
>> 	   c) SSH attacks
>> 	   d) FTP attacks
>> 	   e) Web server attacks
>
> I guess <protocol> attack types are to unspecific in general.
> A lot of attacks are eg. password breaking attacks which apply to
> a lot of protocols like ssh, ftp, http, pop3, imap, smtp (auth), ldap, ...
> So I guess it would be more useful to have something like
> "password breakin" as type for the template and a "protocol" field for
> more specific information.
>
> Same for port scans. I'd use this as the type and the protocols probed
> as an additional information.
>
> This probably also helps in merging incidents. One could use
> "port scan" and group it by source IP address with additional
> information about protocols/services and the IP address range
> probed. Grouping by protocol would cause more indicent reports
> to be generated.
>
> 	\Maex

Date: Fri, 11 Dec 2009 00:39:14 +0100
From: Markus Stumpf <[email-masked]>
To: "[email-masked]" <[email-masked]>
Organization: maexotic.de, Muenchen, Germany
Subject: Re: [feedback-report] Let's get started

On Thu, Dec 10, 2009 at 10:09:08AM -0800, Murray S. Kucherawy wrote:
> 	   c) SSH attacks
> 	   d) FTP attacks
> 	   e) Web server attacks

I guess <protocol> attack types are to unspecific in general.
A lot of attacks are eg. password breaking attacks which apply to
a lot of protocols like ssh, ftp, http, pop3, imap, smtp (auth), ldap, ...
So I guess it would be more useful to have something like
"password breakin" as type for the template and a "protocol" field for
more specific information.

Same for port scans. I'd use this as the type and the protocols probed
as an additional information.

This probably also helps in merging incidents. One could use
"port scan" and group it by source IP address with additional
information about protocols/services and the IP address range
probed. Grouping by protocol would cause more indicent reports
 to be generated.

	\Maex

Date: 10 Dec 2009 14:03:49 -0500
From: "John R. Levine" <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cleverness: None detected
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

> The first thing on our to-do list is to trim the fat from the current 
> draft, meaning remove all the report types and other things that aren't 
> currently in use.  I believe I heard someone say that only "abuse" is 
> currently in use, and I suspect other than OpenDKIM and its antecedent, 
> nobody's implemented the DKIM reporting stuff yet.

My reports occasionally say "virus" when they see the base64 encoding of 
an EXE or ZIP header in the spam.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

From: "Murray S. Kucherawy" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Thu, 10 Dec 2009 10:09:08 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: [feedback-report] Let's get started

--_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_
Content-Type: multipart/alternative;
	boundary="_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_"

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hey everyone,

As the IESG is discussing the logistics around formation of the ARF working=
 group based on the current charter, there doesn't seem to be any reason wh=
y we can't forge ahead with the proposed work.  So given the current propos=
ed charter (attached) and the current ARF draft (draft-shafranovich-feedbac=
k-report-08), I propose we get rolling.  We can shift into the context of d=
oing the work as an IETF working group if and when that becomes official.

The first thing on our to-do list is to trim the fat from the current draft=
, meaning remove all the report types and other things that aren't currentl=
y in use.  I believe I heard someone say that only "abuse" is currently in =
use, and I suspect other than OpenDKIM and its antecedent, nobody's impleme=
nted the DKIM reporting stuff yet.  If everyone concurs, I'll push out a pr=
oposed update to the list that removes all but "abuse" while still leaving =
room for the rest to be re-added in later drafts as extensions.

Does everyone agree with that?  Are there any other changes that the group =
should consider for the next draft?

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page Section1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
	{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
  <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal>Hey everyone,<o:p></o:p></p>

<p class=3DMsoNormal><o:p>&nbsp;</o:p></p>

<p class=3DMsoNormal>As the IESG is discussing the logistics around formati=
on of
the ARF working group based on the current charter, there doesn&#8217;t see=
m to
be any reason why we can&#8217;t forge ahead with the proposed work.&nbsp; =
So
given the current proposed charter (attached) and the current ARF draft
(draft-shafranovich-feedback-report-08), I propose we get rolling.&nbsp; We=
 can
shift into the context of doing the work as an IETF working group if and wh=
en
that becomes official.<o:p></o:p></p>

<p class=3DMsoNormal><o:p>&nbsp;</o:p></p>

<p class=3DMsoNormal>The first thing on our to-do list is to trim the fat f=
rom
the current draft, meaning remove all the report types and other things tha=
t
aren&#8217;t currently in use.&nbsp; I believe I heard someone say that onl=
y &#8220;abuse&#8221;
is currently in use, and I suspect other than OpenDKIM and its antecedent,
nobody&#8217;s implemented the DKIM reporting stuff yet.&nbsp; If everyone
concurs, I&#8217;ll push out a proposed update to the list that removes all=
 but
&#8220;abuse&#8221; while still leaving room for the rest to be re-added in
later drafts as extensions.<o:p></o:p></p>

<p class=3DMsoNormal><o:p>&nbsp;</o:p></p>

<p class=3DMsoNormal>Does everyone agree with that?&nbsp; Are there any oth=
er
changes that the group should consider for the next draft?<o:p></o:p></p>

</div>

</body>

</html>

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_--

--_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_
Content-Type: text/plain; name="arf-charter v06.txt"
Content-Description: arf-charter v06.txt
Content-Disposition: attachment; filename="arf-charter v06.txt"; size=6089;
	creation-date="Thu, 24 Sep 2009 10:46:47 GMT";
	modification-date="Thu, 24 Sep 2009 10:48:11 GMT"
Content-Transfer-Encoding: base64

--_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_--