[SAtalk] interesting "From" mail pattern

Thu, 09 Jan 2003 16:53:56 -0800 

We are getting flooded with emails that have a From address consisting of a
single word name all in caps, e.g.:
        From: "ARLINDA" <[EMAIL PROTECTED]>

They are already way over the limit and are flagged. Anyone know what
spamware generates this kind of signature?

Received: from ilpalxr-dnsmx1.net56.com ([207.177.192.149]) by
ilpostoffice.main.net56.net with SMTP (Microsoft Exchange Internet Mail
Service Version 5.5.2653.13)
        id ZA7PCTC2; Thu, 9 Jan 2003 18:27:22 -0600
Received: from mail01.NET56.NET (mail01.net56.net [207.177.192.10])
        by ILPALXR-dnsmx1.net56.com (8.12.5/8.12.5) with ESMTP id
h09Nt8bU001549
        for <[EMAIL PROTECTED]>; Thu, 9 Jan 2003 17:55:08 -0600
Received: from SMTP32-FWD by mail01.NET56.NET
  (SMTP32) id A0000019E; Thu,  9 Jan 2003 18:30:10 -0600
Received: from mx1.mail.yahoo.com [200.82.32.226] by mail01.NET56.NET with
ESMTP
  (SMTPD32-7.00) id A40CE40204; Thu, 09 Jan 2003 18:30:04 -0600
Message-ID: <0000270e7e21$00006680$[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
From: "ARLINDA" <[EMAIL PROTECTED]>
Subject: {SPAM?} fw:debt, people that can get you out of debtRKT
Date: Thu, 09 Jan 2003 18:35:39 -1700
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Reply-To: [EMAIL PROTECTED]
X-Spam-Status: Yes, hits=15.3 required=5.0
tests=INVALID_DATE_TZ_ABSURD,SMTPD_IN_RCVD,FROM_ENDS_IN_NUMS,EXCUSE_16,EXCUS
E_14,REALLY_UNSAFE_JAVASCRIPT,CTYPE_JUST_HTML,FORGED_YAHOO_RCVD version=2.20
X-Spam-Flag: YES
X-Spam-Prev-Content-Type: text/html;
        charset="iso-8859-1"
X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id: SpamAssassin.pm,v 1.77
2002/04/06 19:28:30 hughescr Exp $)

SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam.  The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM: 
SPAM: Content analysis details:   (15.3 hits, 5 required)
SPAM: Hit! (2.1 points)  Invalid Date: header (timezone does not exist)
SPAM: Hit! (1.3 points)  Received via SMTPD32 server (SMTPD32-n.n)
SPAM: Hit! (1.0 point)   From: ends in numbers
SPAM: Hit! (1.3 points)  BODY: I wonder how many emails they sent in
error...
SPAM: Hit! (1.1 points)  BODY: Tells you how to stop further SPAM
SPAM: Hit! (3.3 points)  BODY: Auto-executing JavaScript code
SPAM: Hit! (3.2 points)  HTML-only mail, with no text version
SPAM: Hit! (2.0 points)  Forged yahoo.com 'Received:' header found
SPAM: 
SPAM: -------------------- End of SpamAssassin results ---------------------


<HTML>
<HEAD>
<TITLE>Reduce Your Debt In 3 Minutes!</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD> <body
onload="window.open('http://www.123getdebtfree.com/debtfree/affiliate11/anal
ysisform.htm','detail','width=775,height=475,resizable=no,scrollbars=yes,lef
t=10,top=10')">
<BODY BGCOLOR="#FFFFFF">
<CENTER>
  <TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0">
        <TR>
                
      <TD COLSPAN="2"> <a
href="http://www.123getdebtfree.com/debtfree/affiliate11/analysisform.htm";><
IMG SRC="http://www.123getdebtfree.com/brandonad/ads/images/ad5a.gif";
WIDTH="560" HEIGHT="55" border="0"></a></TD>
        </TR>
        <TR>
                
      <TD> <a
href="http://www.123getdebtfree.com/debtfree/affiliate11/analysisform.htm";><
IMG SRC="http://www.123getdebtfree.com/brandonad/ads/images/ad5b.jpg";
WIDTH="241" HEIGHT="218" border="0"></a></TD>
      <TD> <A
HREF="www.123getdebtfree.com/debtfree/affiliate11/analysisform.htm"><IMG
SRC="http://www.123getdebtfree.com/brandonad/ads/images/ad5c.gif";
WIDTH="319" HEIGHT="218" BORDER="0"></A></TD>
        </TR>
        <TR>
                
      <TD COLSPAN="2"> <A
HREF="http://www.123getdebtfree.com/debtfree/affiliate11/analysisform.htm";><
IMG SRC="http://www.123getdebtfree.com/brandonad/ads/images/ad5d.gif";
WIDTH="560" HEIGHT="24" BORDER="0"></A></TD>
        </TR>
</TABLE>
<BR><TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0" WIDTH="625"> <TR><TD
ALIGN="CENTER"><HR COLOR="#6666FF">
        <font color="#000000" size="1">if you feel you have received this
email 
        in error or you no longer wish to receive this email from us please
follow 
        this <a
href="http://www.123getdebtfree.com/debtfree/remolistdebt/debtremo.htm";>link
.</a></font></TD>
    </TR></TABLE>
</CENTER>
</BODY>
</HTML>


AILEEN




HEIDI 



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to