Check out the header from a spam we just got. Kind of funny in a sad way:
([EMAIL PROTECTED] is all I changed.)
Received: from dazzlingstuarts.net ([218.5.5.35])
by moglobal.com (8.12.5/8.12.5) with SMTP id h8HK6Sin019272
for <[EMAIL PROTECTED]>; Wed, 17 Sep 2003 16:06:30 -0400
x-transfer-number: 0
Received: from 934fSiai6.dazzlingstuarts.net by dazzlingstuarts.net for
[EMAIL PROTECTED]; Thu, 18 Sep 2003 03:44:38 -0600
X-TRANSFER-NUMBER: 57
X-transfer-number: 4QSf
X-TRANSFER-NUMBER: 485
X-MSMail-Priority: Normal
x-transfer-number: 75
X-TRANSFER-NUMBER: 3k19
x-transfer-stamp: QBQOMRW
X-Mailer: Microsoft Outlook Express 5.00.2615.200
x-transfer-stamp: 36JxLJQ
To: munged" <[EMAIL PROTECTED]>"@moglobal.com
X-transfer-stamp: cvmhkue
X-transfer-number: 33
x-transfer-stamp: qj
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=iso-8859-1
X-transfer-stamp: aya
From: [EMAIL PROTECTED] (Lola Guidera)
X-transfer-number: 6i9o9f
X-transfer-stamp: KEIBW
X-transfer-number:
X-Sender: [EMAIL PROTECTED] (Lola Guidera)
X-TRANSFER-NUMBER:
x-transfer-number: 2
X-transfer-number: 2$_37
X-TRANSFER-STAMP: I
X-TRANSFER-STAMP: SDP
x-transfer-stamp: CFRN+V_NIOO+$+RLJTE
X-transfer-number: 0
X-TRANSFER-STAMP: 2eRyMw
X-transfer-stamp: PI
X-transfer-number: DGq1
Message-Id: <[EMAIL PROTECTED]>
X-transfer-stamp: Dkb65wG
X-TRANSFER-STAMP: JLVSUT
x-transfer-stamp: yik
X-TRANSFER-NUMBER: 6
Subject: *****SPAM***** RE:
X-transfer-number:
x-transfer-stamp: upmmurs
X-transfer-stamp: K_HN_HYN_CXDWJ.M_EWGWPR$WQSP
x-transfer-stamp: 2r070P6
x-transfer-number: 6
X-TRANSFER-STAMP: B
X-Priority: 3
X-transfer-stamp:
Date: Thu, 18 Sep 2003 03:44:38 -0600
X-Spam-Status: Yes, hits=8.5 required=5.0
tests=AF_MEDICAMENTOS,DATE_IN_FUTURE_12_24,FORGED_YAHOO_RCVD,
HTTP_USERNAME_USED,MISSING_MIMEOLE,MY_AT_IN_URI,MY_DOT_BIZ,
MY_FNY_WWW,SPAM_PHRASE_00_01
version=2.43
X-Spam-Flag: YES
X-Spam-Level: ********
X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp)
X-Spam-Report: 8.50 hits, 5 required;
* 2.5 -- BODY: Medicamento encontrado
* 0.8 -- BODY: Spam phrases score is 00 to 01 (low)
* 0.7 -- BODY: Found an @ in a link.
* 1.5 -- URI: Uses a username in a URL
* 0.3 -- URI: Funny WWW address.
* 0.3 -- URI: A .biz found in url.
* 1.4 -- 'From' yahoo.com does not match 'Received' headers
* 0.5 -- Date: is 12 to 24 hours after Received: date
* 0.5 -- Message has X-MSMail-Priority, but no X-MimeOLE
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
"A little nonsense now and then, is relished by the wisest men." - Willy
Wonka
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
