[SAtalk] How to catch Multi-multi-Part Messages ???

Spamassassin-Talk Tue, 02 Sep 2003 07:33:54 -0700

I've bet these sort of msgs. came across your system, but usual body/rawbody rules do 
not work!
(Lucky enough, BAYES does the trick...)


Any ideas??????? Here is such a thing:











Return-path: <[EMAIL PROTECTED]>
Received: from mx.expurgate.net (mx.expurgate.net [195.190.135.10])
        by epost.ath.cx (glenlossie)
        (MDaemon.PRO.v6.9.0a.R)
        with ESMTP id 8-md50000000003.tmp
        for <[EMAIL PROTECTED]>; Sun, 31 Aug 2003 14:55:27 +0200
Received: from [213.165.64.100] (helo=mx0.gmx.net)
        by mx.expurgate.net with smtp (Exim 3.36 #1)
        id 19tRjl-0004Ix-00
        for [EMAIL PROTECTED]; Sun, 31 Aug 2003 14:55:21 +0200
Received: (qmail 5188 invoked by alias); 31 Aug 2003 12:55:20 -0000
Delivered-To: GMX delivery to [EMAIL PROTECTED]
Received: (qmail 4432 invoked by uid 65534); 31 Aug 2003 12:55:13 -0000
Received: from cp63920-a.landg1.lb.home.nl (HELO cp63920-a.landg1.lb.home.nl) 
(217.121.49.42)
  by mx0.gmx.net (mx002) with SMTP; 31 Aug 2003 14:55:13 +0200
From: [EMAIL PROTECTED]
To: Chrissi0001 <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0012_01C27DD2.75377C90"
Date: Sun, 31 Aug 2003 14:55:20 +0200
Message-ID: <[EMAIL PROTECTED]>
X-GMX-Antispam: 0 (Mail was not recognized as spam)
X-Resent-By: Forwarder <[EMAIL PROTECTED]>
X-Resent-For: [EMAIL PROTECTED]
X-Resent-To: [EMAIL PROTECTED]
X-purgate-ID: expurgator11/19tRjl-0004Ix-00 0:0:0:1
X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eXpurgate.net
X-purgate: This mail is identified as spam    (see 
http://www.eXpurgate.net/support/expurgate_headers for details)
X-purgate: spam
X-Lookup-Warning: MAIL lookup on [EMAIL PROTECTED] does not match 195.190.135.10
X-MDRcpt-To: [EMAIL PROTECTED]
X-Return-Path: [EMAIL PROTECTED]
X-MDaemon-Deliver-To: [EMAIL PROTECTED]
X-Spam-Status: Yes, hits=7.9 required=5.0
        tests=BAYES_95,NO_REAL_NAME,X_PURGATE_SPAM
        version=2.55-8.08_31.08.2003_00_03
X-Spam-Level: *******
X-Spam-Checker-Version: SpamAssassin 2.55-8.08_31.08.2003_00_03 
(1.174.2.19-2003-05-19-exp)
X-Spam-Report:   ---- Start SpamAssassin results
  7.90 points, 5 required;
  Message preview:
  [skipped multipart/related attachment] [...] 
  Content analysis details:
  NO_REAL_NAME       (0.5 points)  Absenderzeile enthält keinen echten Namen
  X_PURGATE_SPAM     (2.7 points)  X-purgate defines this mail as SPAM
  BAYES_95           (4.7 points)  BODY: Bayesian classifier says spam probability is 
95 to 99%
  [score: 0.9853]
  ---- End SpamAssassin results
X-Spam-Flag: YES
Subject: ***SPAM*** (07.90/05.00) fw:
X-Spam-Processed: glenlossie, Sun, 31 Aug 2003 14:55:30 +0200
X-MDAV-Processed: glenlossie, Sun, 31 Aug 2003 14:56:01 +0200
X-Queue: e:\mdaemon\Localq\md50000014688.msg
X-HELO: from mx.expurgate.net (mx.expurgate.net [195.190.135.10]) by epost.ath.cx 
(glenlossie) 
(MDaemon.PRO.v6.9.0a.R) with ESMTP id 8-md50000000003.tmp for <[EMAIL PROTECTED]>; 
Sun, 31 Aug 2003 14:55:27 +
0200
X-CF-Rule: SA Score above threshold

This is a multi-part message in MIME format.

------=_NextPart_000_0012_01C27DD2.75377C90
Content-Type: multipart/related; type="multipart/alternative"; 
boundary="----=_NextPart_002_0012_01C27DD2.75377C90"

------=_NextPart_002_0012_01C27DD2.75377C90
Content-Type: multipart/alternative; 
boundary="----=_NextPart_001_0012_01C27DD2.75377C90"

------=_NextPart_001_0012_01C27DD2.75377C90
Content-Type: text/plain
Content-Transfer-Encoding: 8bit

Have a good time Chrissi0001 toGx TVO
Yes, it's great. Cheer up!

------=_NextPart_001_0012_01C27DD2.75377C90
Content-Type: text/html
Content-Transfer-Encoding: 8bit

<html>
<head>
<title>fcBdT DwJ</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><b>Hello, Chrissi0001!</b></p>
<p><a href="http://[EMAIL PROTECTED]/%72%65%6D%65%64%79/%
61%64%76%32%32%32/"><img src="cid:pic.gif"; width="337" height="143" border="0"></a>
</p>
<p><font color="#FFFFFF">yMz but... Chrissi0001 Mau I ask QNLr hc</font></p>
<p><font color="#FFFFFF">ZFVU I'm trying uaX VdPzA</font></p>
<p><font color="#FFFFFF">Shall we... it's for you.</font></p>
</body>
</html>

------=_NextPart_001_0012_01C27DD2.75377C90--

------=_NextPart_002_0012_01C27DD2.75377C90
Content-Type: image/gif; name="pic.gif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="pic.gif"
Content-ID: <pic.gif>

R0lGODlhUQGPAPAAAAAAAP///yH5BAQAAAAALAAAAABRAY8AAAL/DIKpy+0Po2Sg2omz3rz7
D4aiaJXHcxmlY6Zre1UqDMGpYuLtZI9y3qDpgKOi8Ygc9iiyGdEGdb4O0FsiGnQihLUq1duV
srjSZvKMTvO8p+tvWc7tvrFttG2nrdyzvBVV5RfI9Ga2ABeHp7bImMRmVainkpg4V7knKIc5
GUPEwin0qGgXF8SF1ZiqGrKjRXV1+ZqHk1lK13Ta0+pK9jkLm4nqdms43Cq8mqwssTvFt3lC
bMpm0NdWF2wMPVgjNn2zG7ypvYe8fI5eSx5NDC4N+HV4q+5N6zn1N1Zv7z6u6Y/FXLqBq8I5
K6NlXTFy8tjBCUdP0CQMyEQp+vcnkC6C/xyVGZwHqhMTUN+K4cs1DqGSeBreTBQH8RhAagc7
2lwEsdrESCkZNszYiUyvnCI9NDuZT+a2oLw83XyKBOQsF4WYDXX66CeQXq6MhmLZU+WLlQl5
LoSKltW9qtWcAvM57KVErl/dqqSo1WE+QnPo1NIlNa1gEEfZviMEN6ItrBZLjupybavdvKH+
1mM7OHMHUTv14KK28mJfxkEn54Q36HRoz3p/XParOXbLrJHHUuWmje/tpGDGhHVceO9qMK5b
15YlO3mExuum9v7ZtnkpysIVo0akOjGvzhKN6VQOHnhY1ni45jaDsmd27Vbdrr+K8TMkzOHr
27+PP7/+/fz7+/83Ul1+8W3Qj3T/HdhRgPdllUGB4iAI4UAK1udgHxShh2FtEW7IYUEZxuWV
hr90SGKJUX04IgcVTmhiiy5CBqKFm6Eo44s23gjjiCz6FuOOOP44RFwsVthdjx9OuKJJMxkp
Ym5Bpgjkhv1M9mSNQtGIyDRMrlZlkuV91GSUUmJ5VpdkNulljjKmqeOZW7b5mJj/sQnPm2u6
CWVDdtI55RN41igngnTyCOeef2pZaKJ3HreUoXEGyt+giC7qaIxroFkmpYrySSOkB0qK2KZ/
+qgpoGZiiqqlnXrqH6h6ippqnmoSOV2pnH5JJasCHjrprXZe+utDox5qnq76uXpqpYr/Agur
srZ2uqqxx/Ia6rOxmjrrsNf6uqy0015LqLXOMitus+aW6+1+yDrL7YXbassutenat+657ZLb
br7wzvvtr76tRZqfj/YKLUpMBjxfmPzSKy9iQO3FlKx1dhuxteotKfHCQJKqcccbZ+pxyDfS
KnLJI0drcsomljOwyi5HWOzLMkOY68w234xzzjrvzHPPPv8MdNBCD33iVpqd1fIapBB4TstJ
+xJNWk8LdlFmj06Nwls8EIQ1Bd1850MRXQ9WNdlZE6Y1M1x/MHDUAIod6SFyISmXhde8BU5b
rm3Bd4NHyvekC31/NyR6de99NlhY9v0l4YYonnTegIMdnmiM/6c9EuGw3H0545x/3iDewIDe
uU6kU+6154Ozs9zSbmtu+uqu4+125KPXjrlyZcc+uC+wx/4K57yX/rrashPf+/HRKW+88MJD
PbrovDuv/Olbw/585XJ7riD1lwfvZHnHY/3E7YJvrzmj7b3ufeLRd4f7+JhYj9r4m4MsNfrF
t1493+AnDzb2AfBs+gPgKKiXva8Nr33QQ972BFg6WkTQdxBMoO4K+Dt9/I6B1qtg6PqHvfcF
UIKoeyAEM5iFENpvgbMDoe12IsKxPWV3CsuCksSXvLzRDhe5e1X1Hoeh3onmaXt73m8cuLjh
cUJVt7MKC2EoJxmiQYomo6LOrBgVn/9ZkGg95GIjOObFMIpxjGQsGf7QVsY0NtARamzjA6fo
RlZJDlf3W1q17CYH6a3JcVuM48ia+MTPGDCGnfPe5wzpx0AdEHMnXCQGBfi/N0oPi4mck+FW
dz4U6uh9d4tkWchSwkr+yIMODCUSZRfJDqZOlKMEZO0auUpS4nCEUGQeKz/WycbB8o46vCTl
iuhDSt7yU8MsJtuMiUymJXOZzGymM595TLN90IrCTOMZEzTAD75tM9m8Xhy7Vk1V7E+Z21RR
N433zZZcUDg61BuauBM4Hqaol7bskaoMB8Sr4ZOO/mOdDf05z3xWiRRhqk47YVMtMKJjnCt8
oun8ichTFrL/nio8HUQpekgkXjRz8rRoQzOqwhJ6NJQMPNo5JRpSC5KygZ30HSElqcQUktCR
JXWhCLu4wYZSUKczxSlUGOqHj740gJlkaDlQ6VLuZaiRmTqod3IaS/MVDFeGnF+ZRhqnmkoz
qy+NKFQDGVUWchWmk2Qk/7Cqx55OEH1DpR9by7pWEMoGqBt16C4fKlS8KvFqnOTkSh8D0lfK
Va1glegl5elQtbp1sCat2zOemsQMFpF9QJweCXt1T7s2dZ86sKtMnSfQzOrynvqkqh19aEov
hjMNq01Ha6Ep0/zRy6ewZdtrz3BbD+W2trztrW9/C1wzUpScTlSX1RQYxj5qk39A/3NkaptL
W3Qy92fO3e1cd1jWqgnSnunjpyZZkihIPBSw2MXoeAdKT0xm9XG/PC96kfML8O5xuwLqKiA7
C0XSRaaU8OWDZzd4Qrgm1r9onWgp9bgQxEY0wQSWXwvr61WjptXAKd3cZ20qV/JG+MJr9WhN
tQriem74q/hBToExyMf4VbiHh0wvgCEGVZWGTzdILRKCP7uUALvwqMMFj4ntG9bCjnh5j0xh
+5wW49wl0LmiU26IBzhSwo5TqxRS7E1vrNddIpDDQ6byLHWM4cIK0azm3bGIBXzX+r4XsVJ+
7AITNuGEzJOJlnprwshL2i5dFltWii1QUszR8ia5xCqzbv9wkxoyQx8av2ZU9KIfDelIS3rS
lK60pS+N6UxretOc7rSnPw3qECENZeFqj01q5qQSX/OLRMmSEkqilXjBp85qMjVHYsYej2BR
oSpqW5Zwk2pQpppNwCbZxMjl2iAuZ9WM4HXGALTZpQ6HN9Sem2RiJbAa+o18zMaJso8toW7f
cYogexitzY1uXb7LIQldFWloLaSUvLtPzDIomBJsmNvEOhv/uqGchZ3nYnUP30MEVFHukqYj
wgpgz+YGdqriasdAhmVX8ovD6zIeYVUcTEES+G+qDaJ0PwNehRMRxTU0cBTB+S+hnTgRpR1U
lstnct1aM2R381QrkTrXD+OnyK3/8W1rP9u/8W05fUpNlWC6A7W6mRqtppTn0+JxbETSdzwL
zmfKUGflOocoQIVO4DM6KEC47jpMZq4Qe6+n5jiH0m7qcimK6wnkXPdRcGYdUNZVjNhiV3m5
177y3tzZ4yY/Nt1bXvSA/H0J6T4gzUvlLkYhjOEkuROjXwJyTZG9YpOaeq1JNXjDEzzvr9p8
acEFdMez218DrfnWQ3ttooP933V//NgXf/XPdzv04TI36W9eWt0X9PGeB36tXT/t2+98fYUZ
l9U7X/vVJ+tfOR831A3e9vDiPuZl8ZL0reprxJseUde/FyWCZTB4m10h5y47aJiOCmrfG/wQ
U3w7pp12R8n3W2DLBizN9aV6o+d2GCMxXBds7KRw6nBVo+Z70CF/Q7SAEZN9ADcX+RRtBNh5
uWcvy3dLzhZq/GKAH4gzwCaCI4hqy1QAADs=

------=_NextPart_002_0012_01C27DD2.75377C90--

------=_NextPart_000_0012_01C27DD2.75377C90--








-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] How to catch Multi-multi-Part Messages ???

Reply via email to