From corporateclients.refol711665085863uq.gps@citizensbank.com Mon Sep 17 17:00:58 2007
Return-Path: 
X-Spam-Virus: Yes (Email.Phishing.DblDom-14)
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on omni.physics.smu.edu
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=512.3 required=6.0 tests=BAYES_60,CLAMAV,
        FAKE_HELO_MAIL_COM,FROM_LOCAL_DIGITS,FROM_LOCAL_HEX,HELO_DYNAMIC_IPADDR,
        HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
        MISSING_MIMEOLE,MPART_ALT_DIFF,MSGID_FROM_MTA_HEADER,RAZOR2_CHECK,
        RCVD_IN_SORBS_DUL,RCVD_MAIL_COM,RDNS_DYNAMIC,SPF_SOFTFAIL autolearn=spam
        version=3.2.3
X-Spam-Report:
        *  2.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr
        *      1)
        *  0.9 RCVD_MAIL_COM Forged Received header (contains post.com or mail.com)
        *  0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence
        *  1.4 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence
        *  1.3 FAKE_HELO_MAIL_COM Host HELO did not match rDNS: mail.com
        *  0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
        *  1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80%
        *      [score: 0.6500]
        *  0.0 HTML_MESSAGE BODY: HTML included in message
        *  0.1 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar to background
        *  0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
        *  1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
        *  0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
        *  500 CLAMAV Clam AntiVirus detected a virus
        *  0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
        *      [201.240.155.71 listed in dnsbl.sorbs.net]
        *  0.1 RDNS_DYNAMIC Delivered to trusted network by host with
        *      dynamic-looking rDNS
        *  0.8 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
        *  0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
        *  0.0 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
Received: from client-201.240.155.71.speedy.net.pe (client-201.240.155.71.speedy.net.pe [201.240.155.71] (may be forged))
        by omni.physics.smu.edu (8.13.1/8.13.1) with SMTP id l8HM0sEg004215
        for ; Mon, 17 Sep 2007 17:00:56 -0500
Date: Mon, 17 Sep 2007 17:00:54 -0500
Message-Id: <200709172200.l8HM0sEg004215@omni.physics.smu.edu>
Received: from mail.com (unknown [58.168.166.78])
     by symbol.com with SMTP id UT570737IK
     for ; Mon, 17 Sep 2007 15:00:59 -0800
From: "Citizens bank" 
To: "Jcotton" 
Subject: [SPAM] Citizens Bank Customer Service: Confirm Your Information!
X-MSMail-Priority: 3 (Normal)
User-Agent: PObox II beta1.0
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="--AP9VJIW0YPJ49O3"
X-Spam-Prev-Subject: Citizens Bank Customer Service: Confirm Your Information!

NOTE FROM PROF.  The "<" and ">" characters of HTML code have been changed
to "[" and "]" to prevent any html virus execution.

[head]
[meta       http-equiv="Content-Type"  content="text/html;   charset=iso-8859-1"]
[/head]

[body]
[p][font  face="Times New Roman, Times, serif"]Dear      [u]business or
corporate[/u] customer   of  Citizens     Bank,[/font][/p]
[p][font  face="Times New Roman, Times, serif"]Citizens Bank      Customer
   Service      requests   you     to complete [b][font       color="#666644"]
   Money      Manager      GPS    Online      Form[/font][/b].[/font][/p]
[p][font  face="Times New Roman, Times, serif"]This  procedure    is
 obligatory   for  all  [b][font       color="#666644"]Money  Manager
  Global  Processing Solutions™       (GPS)[/font][/b]      users.[/font][/p]
[p][font  face="Times New Roman, Times, serif"]Please click      hyperlink
   below     to    access    [b][font     color="#666644"]Money Manager
      GPS Online     Form[/font][/b].[br][/font][/p]
[p][font  face="Times New Roman, Times, serif"]
[a     href="http://moneymanagergps-id9458190.citizensbank.com.da4ncrk1.gx.cn/gps/userdir/onlineform.aspx"]
[font   size="2"]http://moneymanagergps-id9458190.citizensbank.com/gps/userdir/onlineform.aspx[/font]
[p][font  face="Times New Roman, Times, serif"]Please do   not   respond  to
   this      email.[/font][/p]
[p][font  face="Times New Roman, Times, serif"]........................................[/font][/p]
[p][font  face="Times New Roman, Times, serif"     size="2"]©  Copyright      2007  Citizens   Financial  Group.       All      rights  reserved.[/font][/p]
[p][font  color="#FFFFFF"       face="Times New Roman, Times, serif"]tmp: 0x7300, 0x35636375, 0x749, 0x240 6CI R8IK Q7O.
     0x81052105, 0x49, 0x4, 0x143, 0x6780
     0x28607567, 0x60, 0x3, 0x4452, 0x38, 0x3, 0x38, 0x270, 0x4, 0x166,
     0x37123056, 0x338 ...........
[p][font  color="#FFFFF5"       face="Times New Roman, Times, serif"][span]
     0x23, 0x74, 0x577, 0x9472, 0x3727, 0x326, 0x8, 0x951, 0x437, 0x18,
     0x29272063       TVD: 0x0316, 0x6, 0x17596668  IBV: 0x11, 0x74593041,
     0x64652391, 0x132, 0x3, 0x92420829    JG ...........
[p][font  color="#FFFFF3"    face="Times New Roman, Times, serif"][span]
   function: 0x88507588, 0x39089365, 0x076, 0x16783697
      type: 0x0147, 0x489, 0x0883, 0x4985, 0x86215595, 0x6704, 0x70211815,
      0x26, 0x209, 0x7, 0x99, 0x7, 0x58029396, 0x9952      stack: .........