I had a user report this spam as getting through, so I ran it through spamassassin -t to see what it scored... it only picked up the CASHCASHCASH rule ($$$ in the subject).
Looking at it, I saw there was a URL to an IP address, so I looked in the spamassassin .cf files and saw this in 50_scores.cf: score A_HREF_TO_IP 2.5 However, there did not appear to be a corresponding rule in any of the other files. Has this been taken out for some reason? Any ideas on how this spam could be caught? thank! johnS -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Monday, July 22, 2002 4:56 PM To: [EMAIL PROTECTED] Subject: >From [EMAIL PROTECTED] Mon Jul 22 09:18:00 2002 Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from frankfurterINT.heurikon.com (frankfurterINT.heurikon.com [10.64.49.2]) by spaminator.heurikon.com (Postfix) with SMTP id BF5BD182F9 for <[EMAIL PROTECTED]>; Mon, 22 Jul 2002 09:17:32 -0500 (CDT) Received: from bratwurst-dmz.heurikon.com by frankfurterINT.heurikon.com via smtpd (for spaminator.heurikon.com [10.64.16.58]) with SMTP; 22 Jul 2002 14:20:36 UT Received: by bratwurst.heurikon.com (Postfix) id 3AABBCCA1D; Mon, 22 Jul 2002 03:27:47 -0500 (CDT) Delivered-To: [EMAIL PROTECTED] Received: from frankfurterDMZ.heurikon.com (mailhost2.artesyn.com [208.15.239.136]) by bratwurst.heurikon.com (Postfix) with SMTP id BE34BCCA0A for <[EMAIL PROTECTED]>; Mon, 22 Jul 2002 03:27:46 -0500 (CDT) Received: from mailhost2.artesyn.com ([208.15.239.136]) by frankfurterDMZ.heurikon.com via smtpd (for bratwurst-dmz.heurikon.com [10.64.48.10]) with SMTP; 22 Jul 2002 08:27:46 UT Received: from ntmrbos.artesyn.com ([192.168.45.8]) by mailhost2.artesyn.com (8.9.3/8.9.3) with SMTP id MAA06710 for <[EMAIL PROTECTED]>; Mon, 22 Jul 2002 12:18:56 -0400 Received: by ntmrbos.artesyn.com(Lotus SMTP MTA v4.6.6 (890.1 7-16-1999)) id 85256BFE.002E8218 ; Mon, 22 Jul 2002 04:27:59 -0400 X-Lotus-FromDomain: ARTESYN From: "Tamera Ibarra" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Message-ID: <[EMAIL PROTECTED]> Date: Mon, 22 Jul 2002 09:31:23 +0000 Subject: Refinance and Save $$$ Mime-Version: 1.0 Content-type: multipart/mixed; Boundary="0__=FUOIWvcRAnDl24zWsvRaD4qV0h9FGJ2IwyQeXCvGwAJoljBGm3S5TA3X" Content-Disposition: inline X-Virus-Scanned: by amavisd-new amavisd-new-20020630 X-Razor-id: 1713a19361a43df6519625037fbb8c06420f629f X-Spam-Status: No, hits=2.4 required=5.0 tests=CASHCASHCASH version=2.31 X-Spam-Level: ** --0__=FUOIWvcRAnDl24zWsvRaD4qV0h9FGJ2IwyQeXCvGwAJoljBGm3S5TA3X Content-type: text/plain; charset=us-ascii Content-Disposition: inline We will help you get the mortgage loan you want! Only takes 2 minutes to fill out our form. http://202.105.49.100/index.php Whether a new home loan is what you seek or to refinance your current home loan at a lower interest rate and payment, we can help! Mortgage rates haven't been this low in the last 12 months, take action now! Refinance your home with us and include all of those pesky credit card bills or use the extra cash for that pool you've always wanted... Where others says NO, we say YES!!! Even if you have been turned down elsewhere, we can help! Easy terms! Our mortgage referral service combines the highest quality loans with most economical rates and the easiest qualification! Click Here to fill out our form. http://202.105.49.100/index.php --0__=FUOIWvcRAnDl24zWsvRaD4qV0h9FGJ2IwyQeXCvGwAJoljBGm3S5TA3X Content-type: text/html; name="att1.htm" Content-Disposition: attachment; filename="att1.htm" Content-transfer-encoding: base64 Content-Description: Internet HTML PEhUTUw+DQo8SEVBRD48VElUTEU+TW9ydGdhZ2UgY29tcGFuaWVzIG1ha2UgeW91IHdhaXQ8L1RJ VExFPg0KPE1FVEEgY29udGVudD0iTVNIVE1MIDUuNTAuNDUyMi4xODAwIiBuYW1lPUdFTkVSQVRP Uj4NCjxzY3JpcHQ+DQp3aW49d2luZG93Lm9wZW4oImh0dHA6Ly8yMDIuMTA1LjQ5LjEwMC9pbmRl eC5waHAiKQ0Kd2luLmJsdXIoKQ0Kd2luZG93LmZvY3VzKCkNCjwvc2NyaXB0Pg0KPC9oZWFkPg0K PEJPRFkgYmdQcm9wZXJ0aWVzPWZpeGVkIGxlZnRNYXJnaW49MTAgdG9wTWFyZ2luPTEwIG1hcmdp bndpZHRoPSIwIiBtYXJnaW5oZWlnaHQ9IjAiIE5PU0VORD0iMSI+DQo8QkxPQ0tRVU9URSBkaXI9 bHRyIHN0eWxlPSJQQURESU5HLUxFRlQ6IDBweDsgTUFSR0lOLUxFRlQ6IDVweDsgQk9SREVSLUxF RlQ6ICMwMDAwYWYgNXB4IHNvbGlkOyBNQVJHSU4tUklHSFQ6IDBweCI+DQogIDxESVYgYWxpZ249 Y2VudGVyPg0KICA8Q0VOVEVSPg0KICA8VEFCTEUgd2lkdGg9NTQwIGhlaWdodD0xIGNlbGxTcGFj aW5nPTEgYm9yZGVyPTA+DQogICAgPFRCT0RZPg0KICAgIDxUUj48VEQgY29sc3Bhbj0yPg0KICAg ICAgPFAgYWxpZ249Y2VudGVyPjwvRk9OVD48QklHPjxTVFJPTkc+PEZPTlQgZmFjZT1UYWhvbWEg Y29sb3I9IzAwODAwMD5Nb3J0Z2FnZSBjb21wYW5pZXMgbWFrZSB5b3Ugd2FpdC4uLlRoZXkgRGVt YW5kIHRvIEludGVydmlldyB5b3UuLi5UaGV5IDxVPkludGltaWRhdGU8L1U+IHlvdS4uLlRoZXkg PFU+SHVtaWxpYXRlPC9VPiB5b3UuLi5BbmQgQWxsIG9mIFRoYXQgaXMgV2hpbGUgVGhleSBEZWNp ZGUgSWYgVGhleSBFdmVuIFdhbnQgdG8gRG8gQnVzaW5lc3MgV2l0aCBZb3UuLi48L1NUUk9ORz48 L0JJRz48L1A+DQogICAgICA8UCBhbGlnbj1jZW50ZXI+PEZPTlQgY29sb3I9IzAwMDAwMCBzaXpl PTU+PFNUUk9ORz5XZSBUdXJuIHRoZSBUYWJsZXMgb24gVGhlbS4uLjxCUj5Ob3csIFlvdSdyZSBJ biBDaGFyZ2U8L1NUUk9ORz48L0ZPTlQ+PC9QPg0KICAgICAgPFAgYWxpZ249Y2VudGVyPjxGT05U IGNvbG9yPSMwMDAwMDA+PFNNQUxMPjxCPkp1c3QgRmlsbCBPdXQgT3VyIFNpbXBsZSBGb3JtIGFu ZCBUaGV5IFdpbGwgSGF2ZSB0byBDb21wZXRlIEZvciBZb3VyIEJ1c2luZXNzLi4uPC9CPjwvU01B TEw+PEJSPjxCUj48QSBocmVmPSJodHRwOi8vMjAyLjEwNS40OS4xMDAvaW5kZXgucGhwIiBUYXJn ZXQ9Il9ORVciPjxCSUc+PEJJRz48U1RST05HPkNMSUNLIEhFUkUgRk9SIFRIRSBGT1JNPC9TVFJP Tkc+PC9CSUc+PC9CSUc+PC9BPjwvRk9OVD48L0ZPTlQ+PC9QPjxCUj4NCiAgICA8L1REPjwvVFI+ DQogICAgPFRSPg0KICAgICAgPFREIHZBbGlnbj1jZW50ZXIgd2lkdGg9NTAlPjxTVFJPTkc+PEZP TlQgc2l6ZT0yIGZhY2U9VGFob21hIGNvbG9yPSMwMDAwMDA+V2UgaGF2ZSBodW5kcmVkcyBvZiBs b2FuIHByb2dyYW1zLCBpbmNsdWRpbmc6PC9GT05UPjwvU1RST05HPg0KICAgICAgICAgIDxCPjxG T05UIHNpemU9MiBmYWNlPVRhaG9tYSBjb2xvcj0jMDA4MDAwPg0KICAgICAgICAgICAgPFVMPg0K ICAgICAgICAgICAgICA8TEk+UHVyY2hhc2UgTG9hbnMNCiAgICAgICAgICAgICAgPExJPlJlZmlu YW5jZQ0KICAgICAgICAgICAgICA8TEk+RGVidCBDb25zb2xpZGF0aW9uDQogICAgICAgICAgICAg IDxMST5Ib21lIEltcHJvdmVtZW50DQogICAgICAgICAgICAgIDxMST5TZWNvbmQgTW9ydGdhZ2Vz DQogICAgICAgICAgICAgIDxMST5ObyBJbmNvbWUgVmVyaWZpY2F0aW9uDQogICAgICAgICAgICA8 L1VMPjwvRk9OVD48L0I+DQogICAgICAgPC9URD4NCiAgICAgICA8VEQgd2lkdGg9NTAlIHZhbGln bj10b3A+DQoJCSA8QkxPQ0tRVU9URSBkaXI9bHRyIHN0eWxlPSJQQURESU5HLUxFRlQ6IDI1cHg7 IE1BUkdJTi1MRUZUOiAwcHg7IEJPUkRFUi1MRUZUOiAjMDAwMDAwIDJweCBzb2xpZDsgTUFSR0lO LVJJR0hUOiAwcHgiPg0KCQkgPERJViBhbGlnbj1jZW50ZXI+PENFTlRFUj48UCBhbGlnbj1qdXN0 aWZ5PllvdSBjYW4gc2F2ZSA8ST48Qj48VT5UaG91c2FuZHMgT2YgRG9sbGFyczwvVT48L0I+PC9J PiBvdmVyIHRoZSBjb3Vyc2Ugb2YgeW91ciBsb2FuIHdpdGgganVzdCBhIDEvNCBvZiAxJSBEcm9w IGluIHlvdXIgcmF0ZSE8QlI+PEJSPjxCUj48QlI+PEJSPjxCUj48QlI+PC9GT05UPjwvUD48L0NF TlRFUj48L0RJVj4NCiAgICAgICA8L1REPg0KICAgIDwvVFI+DQogICAgPFRSPg0KCSAgPFREIGNv bHNwYW49Mj4NCgkgICAgPEJSPjxQIGFsaWduPWNlbnRlcj48QSBocmVmPSJodHRwOi8vMjAyLjEw NS40OS4xMDAvaW5kZXgucGhwIiBUYXJnZXQ9Il9ORVciPjxGT05UIGZhY2U9VGFob21hIGNvbG9y PSMwMDAwZmY+PEJJRz48QklHPjxTVFJPTkc+Q0xJQ0sgSEVSRSBGT1IgVEhFIEZPUk08L1NUUk9O Rz48L0JJRz48L0JJRz48L0ZPTlQ+PC9BPjwvUD4NCiAgICAgICAgPFAgYWxpZ249Y2VudGVyPjxG T05UIGZhY2U9VGFob21hIHNpemU9MyBjb2xvcj0jMDAwMDAwPjxTVFJPTkc+WW91IHdpbGwgb2Z0 ZW4gYmUgY29udGFjdGVkIHdpdGggYW4gb2ZmZXIgdGhlPGJyPnZlcnkgc2FtZSBkYXkgeW91IGZp bGwgb3V0IHRoZSBmb3JtITwvU1RST05HPjwvRk9OVD48L1A+DQogICAgICA8L1REPg0KICAgIDwv VFI+DQogIDwvVEFCTEU+DQogPHA+DQo8aHIgV0lEVEg9IjYwMCI+PC9jZW50ZXI+DQoNCjxjZW50 ZXI+PHRhYmxlIEJPUkRFUj0wIENFTExTUEFDSU5HPTAgQ0VMTFBBRERJTkc9MTAgV0lEVEg9IjYw MCIgQkdDT0xPUj0iI0ZGRkZDQyIgPg0KPHRyPg0KPHRkPg0KPGNlbnRlcj48Zm9udCBmYWNlPSJB cmlhbCxIZWx2ZXRpY2EiPjxmb250IHNpemU9LTI+PGZvbnQgY29sb3I9IiMwMDAwMDAiPlRoaXMN CmVtYWlsIHdhcyBzZW50IHRvIHlvdSB1c2luZyBTYWYtRSBNYWlsIFN5c3RlbXMuJm5ic3A7IFlv dXIgZW1haWwgYWRkcmVzcw0Kd2FzIGF1dG9tYXRpY2FsbHkgaW5zZXJ0ZWQgaW50byB0aGUgVG8g YW5kIEZyb20gYWRkcmVzc2VzIHRvIGVsaW1pbmF0ZQ0KdW5kZWxpdmVyYWJsZXMgd2hpY2ggd2Fz dGUgYmFuZHdpZHRoIGFuZCBjYXVzZSBpbnRlcm5ldCBjb25nZXN0aW9uLiBZb3VyDQplbWFpbCBv ciB3ZWJzZXJ2ZXIgPGI+SVMgTk9UIDwvYj5iZWluZyB1c2VkIGZvciB0aGUgc2VuZGluZyBvZiB0 aGlzIG1haWwuDQpOby1vbmUgZWxzZSBpcyByZWNlaXZpbmcgZW1haWxzIGZyb20geW91ciBhZGRy ZXNzLiBZb3UgbWF5IHV0aWxpemUgdGhlDQpyZW1vdmFsIGxpbmsgYmVsb3cgaWYgeW91IGRvIG5v dCB3aXNoIHRvIHJlY2VpdmUgdGhpcyBtYWlsaW5nLiA8L2ZvbnQ+DQo8YnI+PGZvbnQgZmFjZT0i QXJpYWwsSGVsdmV0aWNhIj48Zm9udCBzaXplPS0yPiZuYnNwOzwvZm9udD48L2ZvbnQ+DQo8YnI+ PGI+UGxlYXNlIDxhIGhyZWY9Imh0dHA6Ly8yMDIuMTA1LjQ5LjEwMC9yZW1vdmUuaHRtbCI+UmVt b3ZlIE1lPC9hPjwvYj4NCjxicj48Yj48Zm9udCBmYWNlPSJBcmlhbCxIZWx2ZXRpY2EiPjxmb250 IHNpemU9LTI+Jm5ic3A7PC9mb250PjwvZm9udD48L2I+DQo8YnI+PGZvbnQgZmFjZT0iQXJpYWws SGVsdmV0aWNhIj48Zm9udCBjb2xvcj0iIzAwMDAwMCI+PGZvbnQgc2l6ZT0tMj5TYWYtRSBNYWls IFN5c3RlbXMsIFBPIEJveCAxMTYtMzAxNSBTYW4gUmFmYWVsIGRlIEhlcmVkaWEsIENSJm5ic3A7 IDAxMS01MDYtMjY3LTcxMzk8L2ZvbnQ+PC9mb250PjwvZm9udD48L2NlbnRlcj4NCjwvdGQ+DQo8 L3RyPg0KPC90YWJsZT48L2NlbnRlcj4NCjxjZW50ZXI+PGhyIFdJRFRIPSI2MDAiPjwvY2VudGVy Pg0KPC9IVE1MPg0KDQoNCg== --0__=FUOIWvcRAnDl24zWsvRaD4qV0h9FGJ2IwyQeXCvGwAJoljBGm3S5TA3X-- SPAM: -------------------- Start SpamAssassin results ---------------------- SPAM: This mail is probably spam. The original message has been altered SPAM: so you can recognise or block similar unwanted mail in future. SPAM: See http://spamassassin.org/tag/ for more details. SPAM: SPAM: Content analysis details: (2.4 hits, 5 required) SPAM: CASHCASHCASH (2.4 points) BODY: Contains at least 3 dollar signs in a row SPAM: SPAM: -------------------- End of SpamAssassin results --------------------- ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
