This mail is probably spam. The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future. See http://spamassassin.org/tag/ for more details.
Content preview: Dear all - I seem to have this odd issue with SA. It seems that whenever a message is identified as spam, it gets passed through SA again in some mangled way. Right at the bottom of this mail I have included an example. As can be seen, there are 2 attachments 'original message before SpamAssassin'. I use the prescribed lines in my .procmailrc: [...] Content analysis details: (5.10 points, 5 required) THE_BEST_RATE (4.0 points) BODY: The best Rates HTML_WEB_BUGS (0.1 points) BODY: Image tag with an ID code to identify you HTML_00_10 (1.2 points) BODY: Message is 0% to 10% HTML HTML_MESSAGE (0.1 points) BODY: HTML included in message HTTP_USERNAME_USED (0.7 points) URI: Uses a username in a URL USERPASS (1.5 points) URI: URL contains username and (optional) password USER_AGENT_MUTT (-2.5 points) User-Agent header indicates a non-spam MUA (Mutt)
--- Begin Message ---Dear all - I seem to have this odd issue with SA. It seems that whenever a message is identified as spam, it gets passed through SA again in some mangled way. Right at the bottom of this mail I have included an example. As can be seen, there are 2 attachments 'original message before SpamAssassin'. I use the prescribed lines in my .procmailrc: :0fw: spamassassin.lock | /usr/local/bin/spamassassin :0: * ^X-Spam-Status: Yes $MAILDIR/spam.incoming Further, messages that do not get the required SA points, look just fine. I did try to think about this, but completely fail to understand what's wrong here. So any suggestions are much appreciated! Regards. -- Erik van der Meulen <[EMAIL PROTECTED]> ----- Begin Quoted Spam ----- From [EMAIL PROTECTED] Mon Jul 28 22:26:03 2003 Received: from localhost [127.0.0.1] by souterrain with SpamAssassin (2.54 1.174.2.17-2003-05-11-exp); Mon, 28 Jul 2003 22:26:10 +0200 From: "hott knowly" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: *** SPAM (06.20/05.00) *** We can find you the best rates on any number of loans Date: Tue, 29 Jul 2003 04:22:53 +0800 Message-Id: <[EMAIL PROTECTED]> X-Spam-Flag: YES X-Spam-Status: Yes, hits=6.2 required=5.0 tests=HTML_10_20,HTML_WEB_BUGS,HTTP_USERNAME_USED,THE_BEST_RATE, USERPASS version=2.54 X-Spam-Level: ****** X-Spam-Checker-Version: SpamAssassin 2.54 (1.174.2.17-2003-05-11-exp) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_3F2586E2.26F0AC87" Status: RO X-Status: F Content-Length: 6857 Lines: 161 This is a multi-part message in MIME format. ------------=_3F2586E2.26F0AC87 Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: 8bit This mail is probably spam. The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future. See http://spamassassin.org/tag/ for more details. Content preview: This mail is probably spam. The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future. See http://spamassassin.org/tag/ for more details. [...] Content analysis details: (6.20 points, 5 required) THE_BEST_RATE (2.9 points) BODY: The best Rates HTML_WEB_BUGS (0.1 points) BODY: Image tag with an ID code to identify you HTML_10_20 (1.2 points) BODY: Message is 10% to 20% HTML HTTP_USERNAME_USED (0.7 points) URI: Uses a username in a URL USERPASS (1.3 points) URI: URL contains username and (optional) password The original message did not contain plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with an editor. ------------=_3F2586E2.26F0AC87 Content-Type: message/rfc822; x-spam-type=original Content-Description: original message before SpamAssassin Content-Disposition: attachment Content-Transfer-Encoding: 8bit Received: (from [EMAIL PROTECTED]) by souterrain.avondel.nl (8.9.3/8.9.3/Debian 8.9.3-21) with UUCP id WAA04770 for [EMAIL PROTECTED]; Mon, 28 Jul 2003 22:26:03 +0200 Received: (qmail 23974 invoked from network); 28 Jul 2003 20:23:38 -0000 Received: from localhost [127.0.0.1] by auriga.netsystem.nl with SpamAssassin (2.55 1.174.2.19-2003-05-19-exp); Mon, 28 Jul 2003 22:23:39 +0200 From: "hott knowly" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: We can find you the best rates on any number of loans Date: Tue, 29 Jul 2003 04:22:53 +0800 Message-Id: <[EMAIL PROTECTED]> X-Spam-Flag: YES X-Spam-Status: Yes, hits=8.0 required=5.0 tests=HTML_50_60,HTML_IMAGE_ONLY_06,HTML_MESSAGE,HTML_WEB_BUGS, HTTP_USERNAME_USED,THE_BEST_RATE,USERPASS version=2.55 X-Spam-Level: ******** X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_3F25864B.3EBF1EBA" This is a multi-part message in MIME format. ------------=_3F25864B.3EBF1EBA Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: 8bit This mail is probably spam. The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future. See http://spamassassin.org/tag/ for more details. Content preview: This message is in HTML format. 7367.h2n 8v3b886wq1813y17983m54 URI:http://[EMAIL PROTECTED]/c.php?i=!cjsAbns7cXJ/O3pyAHlye01uAHx7cXJ5O3t5&n65x9256a4 URI:http://[EMAIL PROTECTED]/4/index.asp?RefID96552&415i16hg03iu73re5j2 z44a2d4589m74w501srkko URI:http://[EMAIL PROTECTED]/pic_morta/1.gif?5p7u9068r=8v3b886wq 1813y17983m54xx777hn9f [...] Content analysis details: (8.00 points, 5 required) THE_BEST_RATE (4.0 points) BODY: The best Rates HTML_WEB_BUGS (0.1 points) BODY: Image tag with an ID code to identify you HTML_50_60 (0.5 points) BODY: Message is 50% to 60% HTML HTML_MESSAGE (0.1 points) BODY: HTML included in message HTML_IMAGE_ONLY_06 (1.1 points) BODY: HTML has images with 400-600 bytes of words HTTP_USERNAME_USED (0.7 points) URI: Uses a username in a URL USERPASS (1.5 points) URI: URL contains username and (optional) password The original message did not contain plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with an editor. ------------=_3F25864B.3EBF1EBA Content-Type: message/rfc822; x-spam-type=original Content-Description: original message before SpamAssassin Content-Disposition: attachment Content-Transfer-Encoding: 8bit Received: from 218-163-105-148.hinet-ip.hinet.net (HELO avondel.nl) (218.163.105.148) by auriga.netsystem.nl with SMTP; 28 Jul 2003 20:23:38 -0000 Received: from win [218.163.105.148] by avondel.nl with MailMXPro(2195.5516); Tue, 29 Jul 2003 04:22:53 +0800 Message-ID: <[EMAIL PROTECTED]> From: "hott knowly" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: We can find you the best rates on any number of loans Date: Tue, 29 Jul 2003 04:22:53 +0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_429_F1850BF0.7A21DB00" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Return-Path: [EMAIL PROTECTED] Abuse-Tracking: <WlM1MllXNHVaR1Z5TG0xbGRXeGxia0JoZG05dVpHVnNMbTVz> This is a multi-part message in MIME format. ------=_NextPart_429_F1850BF0.7A21DB00 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable This message is in HTML format. 7367.h2n ------=_NextPart_429_F1850BF0.7A21DB00 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2712.300" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D2> <center>8v3b886wq1813y17983m54<br><img src=3D"http://[EMAIL PROTECTED] l.com/c.php?i=3D!cjsAbns7cXJ/O3pyAHlye01uAHx7cXJ5O3t5&n65x92=3D0856a4"><b= r><A HREF=3D"http://[EMAIL PROTECTED]/4/index.asp?RefID=3D39= 6552&415i16hg0=3D903iu73re5j2">z44a2d4589m74w501srkko<br><Img Src=3D"http= ://[EMAIL PROTECTED]/pic_morta/1.gif?5p7u9068r=3D8v3b886wq" = border=3D"0"><br>1813y17983m54xx777hn9f<br><br></A><br><br><br>328on65x92= 0856a44k87ng 1993d25y0415i16hg0903i<br>u73re5j2z44a2d4589m74w<br>501srkko= pt6a64q9uc0tsl 5p7u9068r8v3b886wq1813<br>y17983m54xx777hn9f328o n65x92085= 6a44k87ng1993<br>d25y0415i16hg0903iu73r e5j2z44a2d4589m74w501s<br><br><br= >To remove yourself from our opt in list <A HREF=3D"http://rkkopt6a64q9uc= @free7x24ew.com/auto/index.htm?0tsl5p7u90=3D68r8v3b8">Press Here</A><br><= BR><BR><BR><BR>!cjsAbns7cXJ/O3pyAHlye01uAHx7cXJ5O3t5 86wq1813y17983m54xx7= 77= </FONT></DIV></BODY></HTML> ------=_NextPart_429_F1850BF0.7A21DB00-- ------------=_3F25864B.3EBF1EBA-- ------------=_3F2586E2.26F0AC87-- ----- End Quoted Spam -----
--- End Message ---
