[SAtalk] Here's a good one SpamAssassin cought (Was: OPEN ME)

[Evan Platt]

Usually glancing through the preview is a good indication of a spam or
false positive. I love this one in the HTML code, telling me my order will
be shipped, although... well it's somewhat backordered... To say the least!

Evan

This mail is probably spam.  The original message has been attached
along with this report, so you can recognize or block similar unwanted
mail in future.  See http://spamassassin.org/tag/ for more details.

Content preview:  URI:http://217.21.118.4/whtbg.gif order confirmation.
  your order should be shipped by January, via fedex. your federal
  express tracking number is spinoff. thank you for registering. your
  userid is: gavotte [...] 

Content analysis details:   (9.90 points, 5 required)
CLICK_BELOW_CAPS   (0.6 points)  BODY: Asks you to click below (in capital
letters) OFFER              (0.1 points)  BODY: Free Offer
EXCUSE_14          (0.2 points)  BODY: Tells you how to stop further spam
HTML_40_50         (1.1 points)  BODY: Message is 40% to 50% HTML
HTML_MESSAGE       (0.1 points)  BODY: HTML included in message
HTML_FONT_BIG      (0.2 points)  BODY: FONT Size +2 and up or 3 and up
HTML_FONT_COLOR_UNSAFE (0.1 points)  BODY: HTML font color not within safe
6x6x6 palette HTML_FONT_COLOR_BLUE (0.1 points)  BODY: HTML font color is
blue HTML_TABLE_THICK_BORDER (1.1 points)  BODY: HTML table has thick border
MIME_HTML_NO_CHARSET (0.6 points)  RAW: Message text in HTML without
specified charset NORMAL_HTTP_TO_IP  (0.9 points)  URI: Uses a
dotted-decimal IP address in URL DATE_IN_PAST_03_06 (0.3 points)  Date: is
3 to 6 hours before Received: date MISSING_MIMEOLE    (0.5 points)  Message
has X-MSMail-Priority, but no X-MimeOLE PGP_SIGNATURE      (-2.9 points)
Contains a PGP-signed message
MIME_HTML_ONLY     (0.1 points)  Message only has text/html MIME parts
FORGED_MUA_OUTLOOK (3.7 points)  Forged mail pretending to be from MS
Outlook OBFUSCATING_COMMENT (3.1 points)  HTML comments which obfuscate text

The original message did not contain plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

--- Begin Message ---

This mail is probably spam.  The original message has been attached
along with this report, so you can recognize or block similar unwanted
mail in future.  See http://spamassassin.org/tag/ for more details.

Content preview:  URI:http://217.21.118.4/whtbg.gif order confirmation.
  your order should be shipped by January, via fedex. your federal
  express tracking number is spinoff. thank you for registering. your
  userid is: gavotte [...] 

Content analysis details:   (9.90 points, 5 required)
CLICK_BELOW_CAPS   (0.6 points)  BODY: Asks you to click below (in capital letters)
OFFER              (0.1 points)  BODY: Free Offer
EXCUSE_14          (0.2 points)  BODY: Tells you how to stop further spam
HTML_40_50         (1.1 points)  BODY: Message is 40% to 50% HTML
HTML_MESSAGE       (0.1 points)  BODY: HTML included in message
HTML_FONT_BIG      (0.2 points)  BODY: FONT Size +2 and up or 3 and up
HTML_FONT_COLOR_UNSAFE (0.1 points)  BODY: HTML font color not within safe 6x6x6 
palette
HTML_FONT_COLOR_BLUE (0.1 points)  BODY: HTML font color is blue
HTML_TABLE_THICK_BORDER (1.1 points)  BODY: HTML table has thick border
MIME_HTML_NO_CHARSET (0.6 points)  RAW: Message text in HTML without specified charset
NORMAL_HTTP_TO_IP  (0.9 points)  URI: Uses a dotted-decimal IP address in URL
DATE_IN_PAST_03_06 (0.3 points)  Date: is 3 to 6 hours before Received: date
MISSING_MIMEOLE    (0.5 points)  Message has X-MSMail-Priority, but no X-MimeOLE
PGP_SIGNATURE      (-2.9 points) Contains a PGP-signed message
MIME_HTML_ONLY     (0.1 points)  Message only has text/html MIME parts
FORGED_MUA_OUTLOOK (3.7 points)  Forged mail pretending to be from MS Outlook
OBFUSCATING_COMMENT (3.1 points)  HTML comments which obfuscate text

The original message did not contain plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

--- Begin Message ---

order confirmation. your order should be shipped by January, via fedex. your federal express tracking number is spinoff. thank you for registering. your userid is: gavotte Survey Finds Refinanced Mortgages Average 1 1/8 % Points Lower Than Original Mortgage Added Homeowner Savings On Housing Continues To Prop Up Lack Luster Economy Our analysis for 2002, indicates that the average refinanced mortgage has an interest rate about 1 1/8 percentage points lower than the original mortgage, freeing up even more consumer funds than had initially been thought. Had this extra source of cash not been available, it would be safe to say that the national economy would have been in much worse condition. If it didn't work, you would know. Truth is, home refinancing has been the number one economical mainstay through our recently troubled economy. A few moments of your time could save you thousands over the life of your loan! What are you wating for? CLICK HERE Please know that we do not want to send you information regarding our special offers if you do not wish to receive it. If you would no longer like us to contact you or feel that you have received this email in error, please click here to unsubscribe. -----BEGIN PGP SIGNATURE----- version: pgpfreeware 6.5.2 for non-commercial use ksie8fg4j8r7m3s9od5h2ixrqheaqqa3ysepsq0xzdhzuvskfdktfpe9xs4fhqs wacj49dk6u883sxo4kb9u6/jnjdx6cjqnzxpetxk9b2dogll/c/60hwrpn+vujdu xav65sop+px4knaqcciecamqj7ugcsw+cqmpnbxwyatymjafkbkh1eulc2vrwdmd cjdi57fh43ks9cm78h4t -----END PGP SIGNATURE-----

--- End Message ---

--- End Message ---