In answer to Greg's question, 11 of the 13 show the following:
X-Spam-Status: No, score=5.8 required=6.9 tests=ALL_TRUSTED,BAYES_99, X-Spam-Status: No, score=3.3 required=6.9 tests=ALL_TRUSTED,BAYES_50, X-Spam-Status: No, score=0.9 required=6.9 tests=ALL_TRUSTED,BAYES_50, X-Spam-Status: No, score=3.3 required=6.9 tests=ALL_TRUSTED,BAYES_50, X-Spam-Status: No, score=3.1 required=6.9 tests=ALL_TRUSTED,BAYES_99, X-Spam-Status: No, score=3.4 required=6.9 tests=ALL_TRUSTED,BAYES_80, X-Spam-Status: No, score=4.4 required=6.9 tests=ALL_TRUSTED,BAYES_99, X-Spam-Status: No, score=6.4 required=6.9 tests=ALL_TRUSTED,BAYES_99, X-Spam-Status: No, score=5.5 required=6.9 tests=ALL_TRUSTED,BAYES_99, X-Spam-Status: No, score=3.7 required=6.9 tests=ALL_TRUSTED,BAYES_60, X-Spam-Status: No, score=3.7 required=6.9 tests=ALL_TRUSTED,BAYES_60,
At 08:03 AM Friday, 10/1/2004, Gregory Zornetzer wrote -=>
Well, if there's no clear removal option, then the mailer is violating the CAN-SPAM act. Now all you need is an ISP who wants to sue.. (or send a cease-and-desist). :P
Maybe these sorts of spams will die off since they can be traced so easily. Ed, do all of the spams pass the ALL-TRUSTED test in spamassassin?
-Greg
On Fri, 1 Oct 2004, Kristopher Austin wrote:
> I went ahead and clicked the link and it is apparently a redirect to a > redirect to a redirect before it finally lands at > http://www.wherechristiansmeet.com/index.php?affil=1529-CS0930F . > > I'm not sure what to do from there. > > Kris > > -----Original Message----- > From: Gregory Zornetzer [mailto:[EMAIL PROTECTED] > Sent: Friday, October 01, 2004 9:36 AM > To: [EMAIL PROTECTED] > Subject: Re: FN's with 3.0.0 > > Hi Ed, > > On Fri, 1 Oct 2004, Ed Kasky wrote: > > > I have had 13 FN's since upgrading to 3.0.0 on Sunday. This is a > > substantial increase from the one or two I used to get weekly. > > > > I have included the text of the most recent one below. They are all > > scoring betwee 3 and 4 and are all formatted pretty much like this > one. > <snipped> > > > ---------- Forwarded message ---------- > > Return-Path: <[EMAIL PROTECTED]> > > Received: from moxmail06.flawlessorganization.com > > (moxmail-1-41.flawlessorganization.com [64.237.3.41]) > > by wrenkasky.com (8.12.11/8.12.11) with ESMTP id i91CaWps022097 > moxmail-1-41.flawlessorganization is a real address, so the header > doesn't > look like it was forged. Maybe this was sent with legitimate > bulk-mailing > software, whereas SpamAssassin really goes after spams with obfuscated > headers and return addresses. > > > > for <[EMAIL PROTECTED]>; Fri, 1 Oct 2004 05:36:33 -0700 > > Received: from flawlessorganization.com (localhost.localdomain > [127.0.0.1]) > > by moxmail06.flawlessorganization.com (Postfix) with ESMTP id > > 02C806710D54D > > for <[EMAIL PROTECTED]>; Fri, 1 Oct 2004 05:36:15 -0700 (PDT) > > MIME-Version: 1.0 > > From: "Christian Singles" <[EMAIL PROTECTED]> > > To: [EMAIL PROTECTED] > > Subject: Meet quality Christians > > Message-Id: <[EMAIL PROTECTED]> > > Content-Type: text/plain > > Content-Disposition: inline > > Content-Transfer-Encoding: 7bit > > Date: Fri, 1 Oct 2004 05:36:15 -0700 (PDT) > > X-Spam-Status: No, score=3.7 required=6.9 tests=ALL_TRUSTED,BAYES_60, > > DCC_CHECK,EVILNUMBER_A_2XX_1,EXCUSE_6,SARE_SXLIFE autolearn=no > > version=3.0.0 > > X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on > > yoda2.wrenkasky.com > > X-Spam-Level: *** > > > There's also not a bunch of HTML tags or weird words and phrases at the > beginning, so it passes through most of the rules. The website appears > to > be in the USA, so perhaps this is one of the few bulk emailers who is > fully CAN-SPAM compliant? Or maybe it's just the latest from the > spammers... Use a CAN-SPAM compliant email to generate their lists of > addresses from the remove requests. > > One thing that I did notice was that the domain flawlessorganization.com > is literally 1 week old according to whois, created September 24, 2004. > Perhaps someone could write a module that penalizes email from domains > that have been created recently? This would give Bayes some time to > "catch up". > > Again, noting below that the web links are all for the same domain as > the > email came from. This is perhaps the least obfuscated spam that I've > ever > seen (at least recently). > > > Are you Christian? Are you Single? We have the solution for you! At > WhereChristiansMeet, you can meet like-minded Christians that are also > single! This isn't an ONLINE dating site full of fake profiles! These > are REAL PEOPLE just like you. Click the link below and meet someone > REAL today! > > > > Click Here: > http://flawlessorganization.com/r/2307/8223547/252408859574
Ed . . . . . . . . Maybe I'm lucky to be going so slowly, because I may be going in the wrong direction. -- Ashleigh Brilliant
