It would appear that I was wrong about double reply-to's. that's just something that OSX's Mail.app is doing.
>From [EMAIL PROTECTED] Fri Dec 12 16:28:13 2003
Received: (qmail 24655 invoked from network); 12 Dec 2003 22:28:12 -0000
Received: from d.dailye-mail.com (216.109.86.52)
by grub.camros.com with SMTP; 12 Dec 2003 22:28:12 -0000
To: [EMAIL PROTECTED]
Date: Fri, 12 Dec 2003 17:28:24 -0500
Message-ID: <[EMAIL PROTECTED]>
X-Mailer: ListManager Web Interface
From: Advance in Pay <[EMAIL PROTECTED]>
Return-Path: <[EMAIL PROTECTED]>
Reply-To: <[EMAIL PROTECTED]>
Subject: Need cash in the bank ASAP?
X-MimeOLE: Prodigy Compatibility V 4.3f9be237 or later
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
grub.camros.com
X-Spam-Level:
X-Spam-Status: No, hits=0.1 required=0.6 tests=MISSING_OUTLOOK_NAME
autolearn=no version=2.60
Lines: 24Get $500 by tomorrow. It's quick, easy and confidential. Your cash advance is electronically deposited directly into your checking account within 24 hours. It's secure and safe. http://lc.orderfreebies.com/newlc/go/2746 Use the money anyway you like: * Pay off your bills * Help you and your family through an emergency * Repair your car A credit check is NOT required. Home ownership is NOT required. You just need a steady paycheck and an active checking account. Get your advance today. http://lc.orderfreebies.com/newlc/go/2746 Follow this link if you no longer wish to be contacted. http://lc.orderfreebies.com/central/[EMAIL PROTECTED]
On Dec 13, 2003, at 12:00 AM, Bryan Hoover wrote:
Robert Nicholson wrote:
Anybody who's installed A 2.61
Can you tell me what the score for the following email was
From: Advance in Pay <[EMAIL PROTECTED]> Subject: Need cash in the bank ASAP? Date: December 12, 2003 4:28:24 PM CST To: Robert David Nicholson <[EMAIL PROTECTED]> Reply-To: <[EMAIL PROTECTED]> <[EMAIL PROTECTED]>
i'm refering to the spammer who's using double reply-to's with angle brackets.
<snip (other exp's)>
Are these getting high scores with 2.61?
In 2.60 I'm seeing them score 0.0
I wasn't aware 2.61 was addressing this - haven't installed it yet either, so pardon me for barging in, but have you been following the first thread you started on this:
news://news.gmane.org/[EMAIL PROTECTED]
Within the thread, the double reply-to's are covered, and then the thread continues to the more abstract matching of words in both From:, and Subject:, which was also a pattern in the first set of examples you posted. None of it's been formalized into an SA usable rule yet though.
Your spammer seems rather specific. I wonder if anyone else is getting such mails. If they are, as mentioned in the previous thread, I would think razor, and surely, dcc would be picking them up -- though neither of these would likely be enough to score as spam.
You never mentioned, from the first thread - what's in the body of the messages?
Bryan
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
-- Nothing in the world has more potential for beauty than woman. Nothing has more potential to destroy it, than the world. - (Anonymous)
http://www.wecs.com/content.htm
This signature file is generated by Pick-a-Tag ! Written by Jeroen van Vaarsel http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
