Before I submit a bug, I wanted to see if this was a known issue in 2.60.
It seems some spams can somehow interject false AWL points to get their
spam through. This morning, I cleared out the AWL entry for the email
address [EMAIL PROTECTED] Only an hour later, I got the spam below,
and here is the check_whitelist entry for it:
[EMAIL PROTECTED]|ip=208.238 -> -7.0 (-77.098/11)
This is a spam using the same from and to addresses. I checked our mail
log and we have only received ONE email from the IP number starting with
208.238, and this morning I had cleared out the AWL of any
[EMAIL PROTECTED] entry.
Here is the spam email below. Any thoughts? Should I submit a bug?
---
Received: from lexiconn.com (s1a-80.olypen.com [208.238.207.80])
by lexiconn.serverhost.net (8.11.6/8.11.6) with ESMTP id
hAFGgSo23692
for <[EMAIL PROTECTED]>; Sat, 15 Nov 2003 11:42:29 -0500
Received: from Cal Larsen [208.238.207.80] by lexiconn.com with eSMTP;
Sat, 15 Nov 2003 08:45:18 -0800
Message-ID: <[EMAIL PROTECTED] Larsen>
From: "michael" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Isn.t it time you refinanc.ed your mor.tgage
Date: Sat, 15 Nov 2003 08:45:18 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
X-Priority: 3
X-Mailer: PHP
Hel-Tracking: <bGV4aWNvbm5AbGV4aWNvbm4uY29t>
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
lexiconn.serverhost.net
X-Spam-Status: No, hits=1.4 required=5.0 tests=AWL,BAYES_99,
HTML_FONTCOLOR_RED,HTML_FONT_BIG,HTML_FONT_INVISIBLE,HTML_MESSAGE,
HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,INVALID_MSGID,MIME_HTML_ONLY
autolearn=no version=2.60
X-Spam-Level: *
<html><title>She was a very crafty little dorky head.
The Rock's biggest devotee has got to be
Laura.9286FE5o00146I59T6W12CA10cJ23H97o41476z21960</title>
<center><font color="#ffffff">She was a very crafty little dorky
head.</font><br><font color="#990000" face="arial"
size="6"><b>ln.terest rate.s are climbing! </b></font>
<br><br>We do the work for you. By subrnitti.ng your information across to
hundreds of L.enders, we can ge.t you the bes.t
intere.st r.ates around.<br><font color="#ffffff">The Rock's biggest
devotee has got to be Laura.</font><br>I.nterest rate.s
are lower than the.y have been in over 40 years, but it won't sta.y that
way for long. Our simple f.orm only takes a few
m.oments, there is ab.solutly <b>NO OBL.lGATlON</b>, and it's <b>100%
F.REE</b>. You have n.othing to lose, and every.thing
to gai.n.<br><br><br><a
href="http://20%33.1%397.2%30%34.%315%35/m/";><b><font face="arial"
size="6">Get a f.ree mor.tgage
q.uote
today!</font></b></a><br><br><br><br>T4I8043nUU5J9117RX0260485Kv2p364
49Yz5VKpU3981382W83k0117A97kn286<br><font
size="1">FE5o00146I59T6W12CA10cJ23H97o41476z21960T4I8043nUU5J9117RX026048<br><br>
to st.op all future m.ailings, <a
href="http://20%33.1%397.2%30%34.%315%35/mout/";>un s
ubscr.11be</a>.<BR><BR>She was a very
crafty little dorky head.She was a very crafty little dorky head.The
Rock's biggest devotee has got to be Laura.She was a
very crafty little dorky head.</font>
---
-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
