Yes, this is a known issue and has been fixed for 2.61. There is a patch on Bugzilla now to correct it. P.S. Your message contains this week's new tracking header, thanks for posting it, this person has been rotating the tracking header about once a week. Hel-Tracking: <bGV4aWNvbm5AbGV4aWNvbm4uY29t>
Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ Rob Mangiafico wrote: > Before I submit a bug, I wanted to see if this was a known issue in > 2.60. > > It seems some spams can somehow interject false AWL points to get > their spam through. This morning, I cleared out the AWL entry for the > email address [EMAIL PROTECTED] Only an hour later, I got the > spam below, and here is the check_whitelist entry for it: > > [EMAIL PROTECTED]|ip=208.238 -> -7.0 (-77.098/11) > > This is a spam using the same from and to addresses. I checked our > mail log and we have only received ONE email from the IP number > starting with 208.238, and this morning I had cleared out the AWL of > any [EMAIL PROTECTED] entry. > > Here is the spam email below. Any thoughts? Should I submit a bug? > > --- > Received: from lexiconn.com (s1a-80.olypen.com [208.238.207.80]) > by lexiconn.serverhost.net (8.11.6/8.11.6) with ESMTP id > hAFGgSo23692 > for <[EMAIL PROTECTED]>; Sat, 15 Nov 2003 11:42:29 -0500 > Received: from Cal Larsen [208.238.207.80] by lexiconn.com with eSMTP; > Sat, 15 Nov 2003 08:45:18 -0800 > Message-ID: <[EMAIL PROTECTED] Larsen> > From: "michael" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Subject: Isn.t it time you refinanc.ed your mor.tgage > Date: Sat, 15 Nov 2003 08:45:18 -0800 > MIME-Version: 1.0 > Content-Type: text/html; charset="ISO-8859-1" > X-Priority: 3 > X-Mailer: PHP > Hel-Tracking: <bGV4aWNvbm5AbGV4aWNvbm4uY29t> > X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on > lexiconn.serverhost.net > X-Spam-Status: No, hits=1.4 required=5.0 tests=AWL,BAYES_99, > > HTML_FONTCOLOR_RED,HTML_FONT_BIG,HTML_FONT_INVISIBLE,HTML_MESSAGE, > > HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,INVALID_MSGID,MIME_HTML_ONLY > autolearn=no version=2.60 > X-Spam-Level: * > > <html><title>She was a very crafty little dorky head. > The Rock's biggest devotee has got to be > Laura.9286FE5o00146I59T6W12CA10cJ23H97o41476z21960</title> > <center><font color="#ffffff">She was a very crafty little dorky > head.</font><br><font color="#990000" face="arial" > size="6"><b>ln.terest rate.s are climbing! </b></font> > <br><br>We do the work for you. By subrnitti.ng your information > across to hundreds of L.enders, we can ge.t you the bes.t > intere.st r.ates around.<br><font color="#ffffff">The Rock's biggest > devotee has got to be Laura.</font><br>I.nterest rate.s > are lower than the.y have been in over 40 years, but it won't sta.y > that way for long. Our simple f.orm only takes a few > m.oments, there is ab.solutly <b>NO OBL.lGATlON</b>, and it's <b>100% > F.REE</b>. You have n.othing to lose, and every.thing > to gai.n.<br><br><br><a > href="http://20%33.1%397.2%30%34.%315%35/m/";><b><font face="arial" > size="6">Get a f.ree mor.tgage > q.uote > today!</font></b></a><br><br><br><br>T4I8043nUU5J9117RX0260485Kv2p364 > 49Yz5VKpU3981382W83k0117A97kn286<br><font > size="1">FE5o00146I59T6W12CA10cJ23H97o41476z21960T4I8043nUU5J9117RX026048<br ><br> > to st.op all future m.ailings, <a > href="http://20%33.1%397.2%30%34.%315%35/mout/";>un s > ubscr.11be</a>.<BR><BR>She was a very > crafty little dorky head.She was a very crafty little dorky head.The > Rock's biggest devotee has got to be Laura.She was a > very crafty little dorky head.</font> > --- > > > > ------------------------------------------------------- > This SF. Net email is sponsored by: GoToMyPC > GoToMyPC is the fast, easy and secure way to access your computer from > any Web browser or wireless device. Click here to Try it Free! > https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF. Net email is sponsored by: GoToMyPC GoToMyPC is the fast, easy and secure way to access your computer from any Web browser or wireless device. Click here to Try it Free! https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
