Received-SPF: neutral (google.com: 2001:470:8:42:2c0:f0ff:fe3b:b5b5 is neither permitted nor denied by best guess record for domain of phma@phma.optus.nu) client-ip=2001:470:8:42:2c0:f0ff:fe3b:b5b5;
From: Pierre Abbat <phma@phma.optus.nu>
To: lojban@googlegroups.com
Subject: Re: [lojban] Fwd: Notice of Internet Intellectual Property
Date: Thu, 13 Sep 2012 01:09:42 -0400
Message-ID: <1755657.6Hmz6PSCst@caracal>
User-Agent: KMail/4.8.4 (Linux/3.2.0-29-generic; KDE/4.8.4; x86_64; ; )
In-Reply-To: <CAMKwHj0H7-4GT9FV=i1VBUQbsBM6e9BkOTAKC=OcXbR4Uzc24Q@mail.gmail.com>
References: <05FD87D35FB36120D4611E3D62C0E92C@msltzem> <122504182.f7HHfncF0k@caracal> <CAMKwHj0H7-4GT9FV=i1VBUQbsBM6e9BkOTAKC=OcXbR4Uzc24Q@mail.gmail.com>
MIME-Version: 1.0
Reply-To: lojban@googlegroups.com
Precedence: list
Mailing-list: list lojban@googlegroups.com; contact lojban+owners@googlegroups.com
Sender: lojban@googlegroups.com
Content-Type: text/plain; charset=ISO-8859-1
X-Spam_score: 1.9
X-Spam_score_int: 19
X-Spam_bar: +
X-Spam-Report: Spam detection software, running on the system "stodi.digitalkingdom.org", has
 identified this incoming email as possible spam.  The original message
 has been attached to this so you can view it (if it isn't spam) or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 
 Content preview:  On Wednesday, September 12, 2012 22:12:27 Jonathan Jones wrote:
    > On Wed, Sep 12, 2012 at 10:03 PM, Pierre Abbat <phma@phma.optus.nu> wrote:
    > > On Wednesday, September 12, 2012 21:06:12 Jonathan Jones wrote: > > >
    This might be spam, but it seems legit. I don't why it was sent to /me/.
   > > > Did anyone else get this? > > > > I didn't. Could you post the headers?
    > > It used to be, once upon a time, that you could click somewhere in Gmail
    > and get the detailed header. It seems that's no longer true- or at least
    I > can't find it. > > There was a "Show original", and the headers are in
    that, so here they are: > > > > > Delivered-To: > eyeonus@gmail.com > Received:
    by 10.152.40.71 with SMTP id v7csp220708lak; > Wed, 12 Sep 2012 19:28:35
   -0700 (PDT) > Received: by 10.66.81.66 with SMTP id y2mr952267pax.62.1347503314882;
    > Wed, 12 Sep 2012 19:28:34 -0700 (PDT) > Return-Path: <info@gytrademark.com>
    > Received: from fukye.com (mail.fukye.com. [219.234.80.171]) > by mx.google.com
    with ESMTP id > rr1si16310941pbc.68.2012.09.12.19.28.31; Wed, 12 Sep 2012
    19:28:33 -0700 > (PDT) > Received-SPF: neutral (google.com: 219.234.80.171
    is neither permitted > nor denied by best guess record for domain of info@gytrademark.com)
    > client-ip=219.234.80.171; > Authentication-Results: mx.google.com; spf=neutral
    (google.com: > 219.234.80.171 is neither permitted nor denied by best guess
    record > for domain of info@gytrademark.com) smtp.mail=info@gytrademark.com
    > Received: by fukye.com (CSmail for UNIX, from userid 505) > id 375BE33D93F;
    Thu, 13 Sep 2012 10:28:33 +0800 (CST) > X-Spam-Checker-Version: SpamAssassin
    3.3.1 (2010-03-16) on fukye > X-Spam-Flag: YES > X-Spam-Level: > X-Spam-Status:
    Yes, score=10.3 required=5.5 tests=AWL,BAYES_99,HTML_MESSAGE, > ImageCerberusPLG0,MY_TEST_PLUGIN,T_SURBL_MULTI1,T_SURBL_MULTI2,
    > T_URIBL_BLACK_OVERLAP,URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_RHS_D
    > OB, URIBL_SC_SURBL autolearn=no version=3.3.1 > X-Spam-ImageCerberus-OUT:
    0.0 (No images found) > X-Spam-Report: > * 2.0 URIBL_BLACK [...] 
 
 Content analysis details:   (1.9 points, 5.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  1.9 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                             [URIs: yg-network.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature

On Wednesday, September 12, 2012 22:12:27 Jonathan Jones wrote:
> On Wed, Sep 12, 2012 at 10:03 PM, Pierre Abbat <phma@phma.optus.nu> wrote:
> > On Wednesday, September 12, 2012 21:06:12 Jonathan Jones wrote:
> > > This might be spam, but it seems legit. I don't why it was sent to /me/.
> > > Did anyone else get this?
> > 
> > I didn't. Could you post the headers?
> 
> It used to be, once upon a time, that you could click somewhere in Gmail
> and get the detailed header. It seems that's no longer true- or at least I
> can't find it.
> 
> There was a "Show original", and the headers are in that, so here they are:
> 
> 
> 
> 
>                                         Delivered-To:
> eyeonus@gmail.com
> Received: by 10.152.40.71 with SMTP id v7csp220708lak;
>         Wed, 12 Sep 2012 19:28:35 -0700 (PDT)
> Received: by 10.66.81.66 with SMTP id y2mr952267pax.62.1347503314882;
>         Wed, 12 Sep 2012 19:28:34 -0700 (PDT)
> Return-Path: <info@gytrademark.com>
> Received: from fukye.com (mail.fukye.com. [219.234.80.171])
>         by mx.google.com with ESMTP id
> rr1si16310941pbc.68.2012.09.12.19.28.31; Wed, 12 Sep 2012 19:28:33 -0700
> (PDT)
> Received-SPF: neutral (google.com: 219.234.80.171 is neither permitted
> nor denied by best guess record for domain of info@gytrademark.com)
> client-ip=219.234.80.171;
> Authentication-Results: mx.google.com; spf=neutral (google.com:
> 219.234.80.171 is neither permitted nor denied by best guess record
> for domain of info@gytrademark.com) smtp.mail=info@gytrademark.com
> Received: by fukye.com (CSmail for UNIX, from userid 505)
> 	id 375BE33D93F; Thu, 13 Sep 2012 10:28:33 +0800 (CST)
> X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on fukye
> X-Spam-Flag: YES
> X-Spam-Level: **********
> X-Spam-Status: Yes, score=10.3 required=5.5 tests=AWL,BAYES_99,HTML_MESSAGE,
> ImageCerberusPLG0,MY_TEST_PLUGIN,T_SURBL_MULTI1,T_SURBL_MULTI2,
> 	T_URIBL_BLACK_OVERLAP,URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_RHS_D
> OB, URIBL_SC_SURBL autolearn=no version=3.3.1
> X-Spam-ImageCerberus-OUT: 0.0 (No images found)
> X-Spam-Report:
> 	*  2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
> 	*      [URIs: lojban.asia]
> 	*  1.1 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
> 	*      [URIs: yg-network.org]
> 	*  1.9 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
> 	*      [URIs: lojban.asia]
> 	*  1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
> 	*      [URIs: lojban.asia]
> 	*  0.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
> 	*      [URIs: lojban.asia]
> 	*  3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
> 	*      [score: 1.0000]
> 	*  1.5 MY_TEST_PLUGIN MY_TEST_PLUGIN
> 	*  0.0 HTML_MESSAGE BODY: HTML included in message
> 	*  0.0 T_SURBL_MULTI2 T_SURBL_MULTI2
> 	*  0.0 T_URIBL_BLACK_OVERLAP T_URIBL_BLACK_OVERLAP
> 	*  0.0 T_SURBL_MULTI1 T_SURBL_MULTI1
> 	* -2.1 AWL AWL: From: address is in the auto white-list
> 	*  0.5 ImageCerberusPLG0 BODY: ImageCerberusPLG0
> Received: from msltzem (unknown [183.161.188.52])
> 	by fukye.com (CSmail for UNIX) with ESMTPA id 0CFBE33D94F
> 	for <eyeonus@gmail.com>; Thu, 13 Sep 2012 10:28:18 +0800 (CST)
> Message-ID: <05FD87D35FB36120D4611E3D62C0E92C@msltzem>
> From: "Abby Wang" <info@gytrademark.com>
> To: <eyeonus@gmail.com>
> Subject: Notice of Internet Intellectual Property
> Date: Thu, 13 Sep 2012 10:26:46 +0800
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> 	boundary="----=_NextPart_000_018B_01FBDC14.1397C7E0"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2900.5512
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512

The IP address is in Anhui, which matches the sig of the email. The domain 
registration of gytrademark.com, however, claims that the same phone number is 
in Shanghai.

> Well, the thing that made me think it may be legit is that: 1. I am a
> member of the Lojban community, 2. They aren't asking for money (yet), and
> 3. They're informing us that someone else is asking to register (a)
> lojban.xx domain(s), and asking us if we want to contend on copyright
> grounds.

A bit of googling shows that it's a scam:

http://www.hoax-slayer.com/domain-name-application-scam.shtml
http://www.google.com/search?q=%22auditing+we+found+the+brand+name+been+used%22&ie=UTF-8&oe=UTF-8

Pierre
-- 
.i toljundi do .ibabo mi'afra tu'a do
.ibabo damba do .ibabo do jinga
.icu'u la ma'atman.

-- 
You received this message because you are subscribed to the Google Groups "lojban" group.
To post to this group, send email to lojban@googlegroups.com.
To unsubscribe from this group, send email to lojban+unsubscribe@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/lojban?hl=en.