How do I decode this mail?

Factual Questions
1

I recieved an email that seems legit but I’m not sure why I recieved it. It’s from iinet.net.au and says that they recently merged with google and and they are now able to provide a turbo version of the google search. If I go to www.inet.au it does have an entry about a partnership buit that only mentions the gogole tool on the home page. I’ve pased the headers below.

The body of the mail is encoded so I don’t know what it does. If anyone can shed some ligt on it I’d appreciate it. I don’t feel I have to mention (but I’m doing it anyway) I’m not going to use the search box in their mail until I know it’s safe.

This ISP sending this is not my ISP.

X-Gmail-Received: fed9232ba19ffe5a9a588053681376f8e227f37f
Delivered-To: (my munged mail)@gmail.com
Received: by 10.49.80.8 with SMTP id h8cs860866nfl;
Sat, 21 Oct 2006 22:23:04 -0700 (PDT)
Received: by 10.78.139.1 with SMTP id m1mr4979159hud;
Sat, 21 Oct 2006 22:23:04 -0700 (PDT)
Return-Path: <jbannister@iinet.net.au>
Received: from customer-domains.icp-qv1-irony8.iinet.net.au (customer-domains.icp-qv1-irony8.iinet.net.au [203.59.1.133])
by mx.google.com with ESMTP id 8si1544258hug.2006.10.21.22.23.02;
Sat, 21 Oct 2006 22:23:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of jbannister@iinet.net.au designates 203.59.1.133 as permitted sender)
Received: from 203-214-95-186.dyn.iinet.net.au (HELO IBM) ([203.214.95.186])
by customer-domains.icp-qv1-irony8.iinet.net.au with ESMTP; 22 Oct 2006 13:22:50 +0800
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AoQrAE+dOkXL1l+6W2dsb2JhbACCZwsciQ1J
X-IronPort-AV: i=“4.09,338,1157299200”;
d=“scan’208,217”; a=“538229007:sNHT77483852”
Reply-To: megaslt101@gmail.com
Message-ID: <2be02992e0c279fbb2558ea6ad66cbf0@ibm>
From: “Janice B” <jbannister@iinet.net.au>
To: <(my munged mail)@gmail.com>
Subject: News Regarding Google Turbo Search
Date: Sun, 22 Oct 2006 15:17:52 -0700
X-Priority: 3
X-Mailer: Brezosoft KMailer 2.1.1
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=“----=NextMime00A_000_164862734D”

This is a multi-part message in MIME format.

------=NextMime00A_000_164862734D
Content-Type: text/plain;
charset=“ISO-8859-1”
Content-Transfer-Encoding: base64

VGhpcyBpcyBhbiBIVE1MIGVtYWlsLCBwbGVhc2UgdXNlIEhUTUwgZm9ybWF0IHRvIG9wZW4gaXQh

------=NextMime00A_000_164862734D
Content-Type: text/html;
charset=“ISO-8859-1”
Content-Transfer-Encoding: base64

PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv
L0VOIj4NCjwhLS0gU2VhcmNoIEdvb2dsZSAtLT48SFRNTD48SEVBRD4NCjxNRVRBIGh0dHAtZXF1
aXY9Q29udGVudC1UeXBlIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11bmljb2RlIj4NCjxG
T1JNIGFjdGlvbj1odHRwOi8vd3d3Lmdvb2dsZS5jb20vY3VzdG9tIG1ldGhvZD1nZXQgdGFyZ2V0
PWdvb2dsZV93aW5kb3c+DQo8TUVUQSBjb250ZW50PSJNU0hUTUwgNi4wMC4yNjAwLjAiIG5hbWU9
R0VORVJBVE9SPjwvSEVBRD4NCjxCT0RZPg0KPENFTlRFUj4mbmJzcDs8L0NFTlRFUj4NCjxDRU5U
RVI+Jm5ic3A7PC9DRU5URVI+DQo8Q0VOVEVSPiZuYnNwOzwvQ0VOVEVSPg0KPENFTlRFUj4mbmJz
cDs8L0NFTlRFUj4NCjxDRU5URVI+DQo8VEFCTEUgYmdDb2xvcj0jZmZmZmZmPg0KICA8VEJPRFk+
DQogIDxUUj4NCiAgICA8VEQgdkFsaWduPXRvcCBub1dyYXAgYWxpZ249bGVmdCBoZWlnaHQ9MzI+
PEEgDQogICAgICBocmVmPSJodHRwOi8vd3d3Lmdvb2dsZS5jb20vIj48SU1HIGFsdD1Hb29nbGUg
DQogICAgICBzcmM9Imh0dHA6Ly93d3cuZ29vZ2xlLmNvbS9sb2dvcy9Mb2dvXzI1d2h0LmdpZiIg
YWxpZ249bWlkZGxlIA0KICAgICAgYm9yZGVyPTA+PC9JTUc+PC9BPiA8QlI+PElOUFVUIG1heExl
bmd0aD0yNTUgc2l6ZT0zMSBuYW1lPXE+PC9JTlBVVD4gDQo8L1REPjwvVFI+DQogIDxUUj4NCiAg
ICA8VEQgdkFsaWduPXRvcCBhbGlnbj1sZWZ0PjxJTlBVVCB0eXBlPXN1Ym1pdCB2YWx1ZT1TZWFy
Y2ggbmFtZT1zYT48L0lOUFVUPiANCiAgICAgIDxJTlBVVCB0eXBlPWhpZGRlbiB2YWx1ZT1wdWIt
NzA3MjIxMDI3MzQ1OTA5OSBuYW1lPWNsaWVudD48L0lOUFVUPiA8SU5QVVQgDQogICAgICB0eXBl
PWhpZGRlbiB2YWx1ZT0xIG5hbWU9Zm9yaWQ+PC9JTlBVVD4gPElOUFVUIHR5cGU9aGlkZGVuIA0K
ICAgICAgdmFsdWU9SVNPLTg4NTktMSBuYW1lPWllPjwvSU5QVVQ+IDxJTlBVVCB0eXBlPWhpZGRl
biB2YWx1ZT1JU08tODg1OS0xIA0KICAgICAgbmFtZT1vZT48L0lOUFVUPiA8SU5QVVQgdHlwZT1o
aWRkZW4gDQogICAgICB2YWx1ZT1HQUxUOiMwMDgwMDA7R0w6MTtESVY6IzMzNjY5OTtWTEM6NjYz
Mzk5O0FIOmNlbnRlcjtCR0M6RkZGRkZGO0xCR0M6MzM2Njk5O0FMQzowMDAwRkY7TEM6MDAwMEZG
O1Q6MDAwMDAwO0dGTlQ6MDAwMEZGO0dJTVA6MDAwMEZGO0ZPUklEOjEgDQogICAgICBuYW1lPWNv
Zj48L0lOUFVUPiA8SU5QVVQgdHlwZT1oaWRkZW4gdmFsdWU9ZW4gbmFtZT1obD48L0lOUFVUPiAN
CiAgPC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48L0NFTlRFUj4NCjxDRU5URVI+U28gd2UgaGF2
ZSBhbGwgaGVhcmQgYWJvdXQgdGhlIG5ldyBtZXJnZXIgd2l0aCBHb29nbGUsIHJlY2VudGx5IGdv
b2dsZSANCmhhdmUgYmVlbiBhYmxlIHRvIHByb3ZpZGUgdXNlcnMgd2l0aCBhIHR1cmJvIHZlcnNp
b24uJm5ic3A7IEZhc3RlciBhbmQgbW9yZSANCmFjY3VyYXRlIHNlYXJjaCByZXN1bHRzLiZuYnNw
OyBEb250IHRha2Ugb3VyIHdvcmQgZm9yIGl0LCB0cnkgaXQgeW91cnNlbGYsIGJ1dCANCm1ha2Ug
c3VyZSB5b3UgdXNlIGl0IGRpcmVjdGx5IGhlcmUgYXMgZ29vZ2xlLmNvbSBoYXMgbm90IHlldCBi
ZWVuIA0KdHVyYm9jaGFyZ2VkLjwvQ0VOVEVSPg0KPENFTlRFUj4mbmJzcDs8L0NFTlRFUj4NCjxD
RU5URVI+RnJvbSBUaGUgVGVhbTwvQ0VOVEVSPjwvRk9STT48IS0tIFNlYXJjaCBHb29nbGUgLS0+
PC9CT0RZPjwvSFRNTD4NCg==

------=NextMime00A_000_164862734D–

2

It looks like spam to me. I’m not exactly sure how it works, but it looks like they’re vectoring you through a Google search that uses their adwords account or something of that nature. If you look at the html source, it sends you to Google with a hidden form input that would identify the search as (presumably) theirs.

The base 64 chunks there are just the html page you saw about google. Your email client should have decoded them. Some other decompression programs can also decode it, but I’d be very suprised if your mail client didn’t do it by itself.

3

Well phooey - that’s pretty much my determination too. You can decode the text at this webpage here, which results in a webpage with a ‘Google’ search box on it.

I can’t find anything majorly un-legit about it (everything comes from and goes to Google), but as buckgully says, it seems to use some AdWords thing that’s supposed to be used on a website, where the webmaster gets a cut from any ads you click on.

There’s nothing ‘Turbocharged’ about it; it’s just regular Google only you’d just be filling the spammer’s pockets if you used the page they provide.

4

The IP address the mail originally comes from (203.214.95.186) is listed by SORBS and Spamcop as a known spammer. Multi-RBL lookup. So, yeah, it’s probably spam.

The fact it comes from a dynamic IP address may indicate it’s from a worm running on a compromised PC somewhere in the iinet.net.au universe.

Note that iinet.net.au and inet.au are not the same thing. For one thing, inet.au doesn’t appear to exist.

5

Forward it back to iinet - they are a legitimate australian ISP, and if one of their members is sending spam like that out (even inadvertantly) they will take action to notify the member and restrict their account if necessary - support@iinet.net.au

6

Thank you everyone. I knew there had to be a catch with that mail