[SAtalk] An interesting way to get around filters

[Bob Amen]

Slightly off topic but... I got the attached piece of spam today with two blank header lines. The first one gets tagged by SA but the second one doesn't and apparently Mozilla doesn't check all Subject: headers, only the last one, to filter the message.

I've seen this a couple of times before.

Bob

-------- Original Message --------
From: - Mon Nov 18 13:41:09 2002
X-UIDL: X=I!!I[D"!T^##!j~&"!
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from relay.west.ora.com (geode.west.ora.com [172.24.146.35])
by smtp.oreilly.com (8.11.2/8.11.2) with ESMTP id gAILbBg09667; Mon, 18
Nov 2002 13:37:11 -0800 (PST)
Received: from smtp2.oreilly.com (sol.east.ora.com [172.30.1.2]) by
relay.west.ora.com (8.12.6/8.12.6) with ESMTP id gAILb8xa028357; Mon, 18
Nov 2002 13:37:09 -0800
Received: from cima01.hospitalcima.com.mx (cima1.hospitalcima.com.mx
[148.235.12.114] (may be forged)) by smtp2.oreilly.com (8.11.2/8.11.2)
with ESMTP id gAILZgG26631 for <[EMAIL PROTECTED]>; Mon, 18 Nov 2002
16:36:13 -0500 (EST)
Received: from 62.188.49.8 ([62.188.49.8]) by cima01.hospitalcima.com.mx
with Microsoft SMTPSVC(5.0.2195.2966); Mon, 18 Nov 2002 13:19:58 -0700
From: "Rachel" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Date: Mon, 18 Nov 2002 14:19:51 -0500
Subject: *****SPAM*****
Subject:
MIME-Version: 1.0
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 18 Nov 2002 20:20:00.0250 (UTC)
FILETIME=[DEBDFDA0:01C28F3F]
X-Spam-Status: Yes, hits=7.3 required=6.0
tests=CTYPE_JUST_HTML,FORGED_YAHOO_RCVD,FROM_ENDS_IN_NUMS,
MAY_BE_FORGED,RCVD_IN_DSBL,SPAM_PHRASE_02_03,SUBJ_MISSING, USER_AGENT_OE
version=2.42
X-Spam-Flag: YES
X-Spam-Level: *******
X-Spam-Checker-Version: SpamAssassin 2.42 (1.115.2.14-2002-10-04-exp)
X-UIDL: X=I!!I[D"!T^##!j~&"!



<http://www.dhghost.net/psherbals/?WM_ID=7360>



Yes Men, Size Does Matter. Fortunately, You Now Have A Choice!

Thanks to recent breakthroughs in modern medicine, you no longer have to
be a victim of your genetics. In fact, with our help, you can start
taking immediate control of your sexual prowess TODAY! Do yourself a
favor and learn what some are calling "The discovery of a lifetime" for
men. What have you got to lose? It's Perfectly Safe and Guaranteed To
Work!!!

Unleash My Full Potential! <http://www.dhghost.net/psherbals/?WM_ID=7360>

Enter Here To Get The Blue Pill!
<http://www.dhghost.net/optin02/?WM_ID=7360>













come here <http://www.dhghost.net/cgi-bin/r3.cgi> to be taken off

[)_8J7BJK9^":}H&*TG0BK5NKIYs5]

--
Bob Amen
O'Reilly & Associates, Inc.
http://www.ora.com/
http://www.oreilly.com/



-------------------------------------------------------
This sf.net email is sponsored by: To learn the basics of securing your web site with SSL, click here to get a FREE TRIAL of a Thawte Server Certificate: http://www.gothawte.com/rd524.html
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk