All: I just saw the strangest thing in my Yahoo! Mail bulk e-mail folder. It was the usual collection of pornographic spams. But, there was one message that really caught my eye. The subject line was:
*****SPAM***** The Beautiful Art of Female [snip]. xdvldmgzyohhmcn. ========================================== The text of the message was: This mail is probably spam. The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future. See http://spamassassin.org/tag/ for more details. To automatically delete these kind of messages, create a filter rule in your mail client that match the subject "*****SPAM*****". Also look at the full headers of this email for more filtering options. Content preview: The Wettest P*ssies.. URI:http://[EMAIL PROTECTED]/drippy.php?link=gzictqoab URI:http://banners.drippyslits.com/pic/2316000/odd003.gif One Dollar for 30 Days! unble arcbv riwguyhzz ynujc gknpgruyy [...] Content analysis details: (8.4 points, 5.0 required) 0.3 NO_REAL_NAME From: does not include a real name 0.9 FROM_ENDS_IN_NUMS From: ends in numbers 1.7 HTML_IMAGE_ONLY_06 BODY: HTML: images with 400-600 bytes of words 0.1 HTML_60_70 BODY: Message is 60% to 70% HTML 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 HTML_FONT_BIG BODY: HTML has a big font 0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe 6x6x6 palette 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.1 HTML_FONTCOLOR_RED BODY: HTML font color is red 3.1 USERPASS URI: URL contains username and (optional) password 2.0 MSGID_FROM_MTA_SHORT Message-Id was added by a relay The original message was not completely plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with an editor. ================================================ The headers showed: X-Apparently-To: [EMAIL PROTECTED] via 216.136.175.205; Thu, 11 Dec 2003 22:14:46 -0800 X-YahooFilteredBulk: 212.214.136.47 Return-Path: <[EMAIL PROTECTED]> Received: from 212.214.136.47 (EHLO smtp-fe2.ballou.se) (212.214.136.47) by mta128.mail.sc5.yahoo.com with SMTP; Thu, 11 Dec 2003 22:14:46 -0800 Received: by smtp-fe2.ballou.se (Postfix, from userid 503) id 5F42490991; Fri, 12 Dec 2003 08:14:28 +0100 (CET) Received: from localhost [127.0.0.1] by smtp-fe2 with SpamAssassin (2.60 1.212-2003-09-23-exp); Fri, 12 Dec 2003 08:14:28 +0100 From: [EMAIL PROTECTED] Add to Address Book To: [EMAIL PROTECTED] Subject: *****SPAM***** The Beautiful Art of Female Ejaculation. xdvldmgzyohhmcn. Date: Fri, 12 Dec 2003 07:17:08 +0100 (CET) Message-Id: <[EMAIL PROTECTED]> X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on smtp-fe2 X-Spam-Level: ******** X-Spam-Status: Yes, hits=8.4 required=5.0 tests=FROM_ENDS_IN_NUMS,HTML_60_70, HTML_FONTCOLOR_RED,HTML_FONTCOLOR_UNSAFE,HTML_FONT_BIG, HTML_IMAGE_ONLY_06,HTML_MESSAGE,MIME_HTML_ONLY,MSGID_FROM_MTA_SHORT, NO_REAL_NAME,USERPASS autolearn=no version=2.60 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_3FD96AD4.DCF97DEB" X-Sanitizer: Ballou mail filter / virus scanner Content-Length: 2088 ======================================================= Anyone know how this could have happened? I'm just curious. I've NEVER seen Yahoo! tagged bulk email with SA tags. TIA, Joe K. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
