I have two spammers that consistently get messages through to my inbox.
Based on the attached, can you make any recommendations for improvements to
my configuration that will help give these messages a higher score? I'm
calling SA (spamd, 3.0.2) as a content filter from Postfix.
Thanks,
Rhett Roy
Microsoft Mail Internet Headers Version 2.0
Received: from rh1.hospital.womans.com (spamfilter.hospital.womans.com
[10.1.100.7]) by exch-srv1.Womans.com with SMTP (Microsoft Exchange Internet
Mail Service Version 5.5.2657.72) id FS7ZTYGL; Tue, 26 Apr 2005 01:16:39 -0500
Received: by rh1.hospital.womans.com (Postfix, from userid 501) id 19BF97F4C0;
Tue, 26 Apr 2005 03:28:07 -0400 (EDT)
Received: from mail.bulgaria.com (i60-34-36-43.s02.a006.ap.plala.or.jp
[60.34.36.43]) by rh1.hospital.womans.com (Postfix) with ESMTP id 98FD97F4A9;
Tue, 26 Apr 2005 03:27:42 -0400 (EDT)
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Content-Transfer-Encoding: binary
x-spam-checker-version: SpamAssassin 3.0.2 (2004-11-16) on
rh1.hospital.womans.com
x-spam-level: *
x-spam-status: No, score=1.4 required=5.0 tests=BAYES_00=-2.599,
DCC_CHECK=2.169,DIGEST_MULTIPLE=0.098,HTML_50_60=0.087,
HTML_MESSAGE=0.001,MIME_QP_LONG_LINE=0.039,
RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511 autolearn=no version=3.0.2
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: Please note that our prices have never been this low
Date: Tue, 26 Apr 2005 02:19:53 -0500
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: <[EMAIL PROTECTED]>
Thread-Topic: Please note that our prices have never been this low
Thread-Index: AcVKJ4IdHl4/6p5cT/aFK3tHkVqVjw==
From: "SimplyRX" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2900.2627" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV align=center><FONT face=Arial><STRONG>Overnight Shipping and Low
Prices!</STRONG></FONT></DIV>
<DIV align=center><A href="http://coolestrxever.com:";><IMG alt="Meds Here!"
hspace=0
src="cid:[EMAIL PROTECTED]" align=baseline border=0></A></DIV>
<DIV align=center><FONT face=Arial color=#ff0000 size=2><STRONG>Todays
Specials!</STRONG></FONT></DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT size=2> </FONT>
<P><FONT face=Arial size=1>That's the message from a group of published and
award-winning novelists in an open letter to influential television talk-show
host Oprah Winfrey, begging her to resume picking new novels for members of her
popular book club. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>"There's a widely-held belief that the landscape of
literary fiction is now a gloomy place," Word of Mouth, a loose alliance of
women's authors, wrote. It said fiction sales began to plummet when the The
Oprah Winfrey Book Club went off the air in 2002 and stopped featuring
contemporary authors. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>"Book Club members stopped buying new fiction, and
this changed the face of American publishing," said the letter, which was
signed
by 158 authors. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Among those signing the letter were Pulitzer Prize
winner Jhumpa Lahiri and Amy Tan, author of "The Joy Luck Club." Several male
authors also signed. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>The letter expressed thanks for Winfrey's
contribution to book sales and asked her to "consider focusing, once again, on
contemporary writers in your book club." </FONT></P>
<P><FONT face=Arial size=1>Getting people to read is about the most important
contribution that anyone can make to American society," Sharp told Reuters.
"It's a stunning achievement to get 500,00O people to go to bookstores.
</FONT></P>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Oprah's Book Club began as a segment on Winfrey's
talk show in 1996. An Oprah's Book Club logo on a novel's cover helped many of
her picks garner sales of more than 1 million copies. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>The club became embroiled in controversy in 2001
when
Jonathan Franzen publicly objected to the selection of his novel, "The
Corrections," and said he feared it might affect his reputation in literary
circles. He later said he regretted voicing his reservations. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Winfrey suspended the club in April 2002, saying she
would only make occasional recommendations because, "It has become harder and
harder to find books on a monthly basis that I feel absolutely compelled to
share." </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Relaunched in June 2003, the club now picks classics
such as John Steinbeck's "East of Eden" and Leo Tolstoy's "Anna Karenina"
rather
than new books. </FONT></P></DIV></BODY></HTML>
Microsoft Mail Internet Headers Version 2.0
Received: from rh1.hospital.womans.com (spamfilter.hospital.womans.com
[10.1.100.7]) by exch-srv1.Womans.com with SMTP (Microsoft Exchange Internet
Mail Service Version 5.5.2657.72) id FS7ZTZJ7; Tue, 26 Apr 2005 06:41:15 -0500
Received: by rh1.hospital.womans.com (Postfix, from userid 501) id 4124C7F4B1;
Tue, 26 Apr 2005 08:52:44 -0400 (EDT)
Received: from hafad071097.uclm.es (hafad071097.uclm.es [161.67.91.44]) by
rh1.hospital.womans.com (Postfix) with ESMTP id 97E247F4C0 for <[EMAIL
PROTECTED]>; Tue, 26 Apr 2005 08:52:39 -0400 (EDT)
Received: from kegel.com (vroo.pair.com [209.68.1.136]) by hafad071097.uclm.es
with esmtp id C735CD8EB4 for <[EMAIL PROTECTED]>; Tue, 26 Apr 2005 04:40:51
-0700
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: binary
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
x-spam-checker-version: SpamAssassin 3.0.2 (2004-11-16) on
rh1.hospital.womans.com
x-spam-level: ***
x-spam-status: No, score=3.5 required=5.0 tests=BAYES_60=0.372,
HTML_90_100=0.022,HTML_IMAGE_ONLY_24=0.502,HTML_MESSAGE=0.001,
RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511,URIBL_SBL=0.996 autolearn=no
version=3.0.2
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: FW: Average Bithecs big dick action
Date: Tue, 26 Apr 2005 06:40:51 -0500
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator: <[EMAIL PROTECTED]>
Thread-Topic: Average Bithecs big dick action
Thread-Index: AcVKVNq98wsbTV9BR9+zY7X+R8PUzw==
From: "Toothiest B. Limeades" <[EMAIL PROTECTED]>
To: "ROY,RHETT G" <[EMAIL PROTECTED]>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2800.1437" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>
Haven't we met somewhere before? :)))
<A
href="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.htm";
title="bred">
<BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/jn1GMup/fl0TwXG.jpG";
alt="collaring" border='0'><BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
border=0><BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/1CzXjQW/Wn/HZ.gif";
border='0'><br></A>Si jaamaRhonanai
<br>
Hey honey! :)<BR><BR>
<A
href="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.htm";
target="preempts"><BR><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/p5hQt/TMdc5cgpBD.jpG";
alt="hydrants" border='0'><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
alt="optometry" border='0'><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/h6oLlKL5h/tJ6Uj4eD/b1WC6w.gif";
alt="Libby" border=0><br></A>Ka kite ano
Pleased to meet you!
<BR>
<A
href="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.htm";
title="fretfully">
<br><br>
<IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/G/dtO1H16UtB.jpG";
alt="Ptolemy" border="0"><BR><IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
alt="recidivists" border="0"><BR><IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/wvzr/DUk0z/G85YTn.gif";
border='0'><BR><BR></A>Soreja
<br><br>
<A href="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/cTdg7Z.html";
target="woody" title="lama"><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/do.gif"; border='0'>
</A></DIV></BODY></HTML>
debug: SpamAssassin version 3.0.2
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
debug: config: read file /etc/mail/spamassassin/init.pre
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: config: read file /usr/share/spamassassin/70_sare_evilnum0.cf
debug: config: read file /usr/share/spamassassin/70_sare_genlsubj0.cf
debug: config: read file /usr/share/spamassassin/70_sare_header0.cf
debug: config: read file /usr/share/spamassassin/70_sare_html0.cf
debug: config: read file /usr/share/spamassassin/70_sare_specific.cf
debug: config: read file /usr/share/spamassassin/70_sare_uri0.cf
debug: config: read file /usr/share/spamassassin/99_FVGT_Tripwire.cf
debug: config: read file /usr/share/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /usr/share/spamassassin/backhair.cf
debug: config: read file /usr/share/spamassassin/bogus-virus-warnings.cf
debug: config: read file /usr/share/spamassassin/chickenpox.cf
debug: config: read file /usr/share/spamassassin/evilnumbers.cf
debug: config: read file /usr/share/spamassassin/rhett.cf
debug: config: read file /usr/share/spamassassin/tripwire.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: using "/var/spool/filter/.spamassassin/user_prefs" for user prefs file
debug: config: read file /var/spool/filter/.spamassassin/user_prefs
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730) implements
'parse_config'
debug: config: SpamAssassin failed to parse line, skipping: rewrite_subject
1
debug: config: SpamAssassin failed to parse line, skipping: always_add_report
1
debug: config: SpamAssassin failed to parse line, skipping: use_terse_report
1
debug: config: SpamAssassin failed to parse line, skipping: auto_learn
1
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: bayes: 11560 tie-ing to DB file R/O
/var/spool/filter/.spamassassin/bayes_toks
debug: bayes: 11560 tie-ing to DB file R/O
/var/spool/filter/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: Score set 3 chosen.
debug: received-header: parsed as [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=0 id=FS7ZTZJ7 auth= ]
debug: received-header: parsed as [ ip=161.67.91.44 rdns=hafad071097.uclm.es
helo=hafad071097.uclm.es by=rh1.hospital.womans.com ident= envfrom= intl=0
id=97E247F4C0 auth= ]
debug: received-header: parsed as [ ip=209.68.1.136 rdns=vroo.pair.com
helo=kegel.com by=hafad071097.uclm.es ident= envfrom= intl=0 id=C735CD8EB4
auth= ]
debug: received-header: relay 10.1.100.7 trusted? yes internal? yes
debug: received-header: relay 161.67.91.44 trusted? no internal? no
debug: received-header: relay 209.68.1.136 trusted? no internal? no
debug: metadata: X-Spam-Relays-Trusted: [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=1 id=FS7ZTZJ7 auth= ]
debug: metadata: X-Spam-Relays-Untrusted: [ ip=161.67.91.44
rdns=hafad071097.uclm.es helo=hafad071097.uclm.es by=rh1.hospital.womans.com
ident= envfrom= intl=0 id=97E247F4C0 auth= ] [ ip=209.68.1.136
rdns=vroo.pair.com helo=kegel.com by=hafad071097.uclm.es ident= envfrom= intl=0
id=C735CD8EB4 auth= ]
debug: ---- MIME PARSER START ----
debug: main message type: application/ms-tnef
debug: parsing normal part
debug: added part, type: application/ms-tnef
debug: ---- MIME PARSER END ----
debug: Message too short for language analysis
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'parsed_metadata'
debug: dns_available set to yes in config file, skipping test
debug: URIDNSBL: domains to query:
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.23
debug: all '*From' addrs: [EMAIL PROTECTED]
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730))
debug: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: SPF: checking HELO (helo=hafad071097.uclm.es, ip=161.67.91.44)
debug: SPF: trimmed HELO down to 'uclm.es'
debug: SPF: cannot load or create Mail::SPF::Query module
debug: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730))
debug: all '*To' addrs: [EMAIL PROTECTED]
debug: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: SPF: relayed through one or more trusted relays, cannot use header-based
Envelope-From, skipping
debug: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: registering glue method for check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: forged-HELO: from=hafad071097.uclm.es helo=hafad071097.uclm.es
by=womans.com
debug: forged-HELO: from=pair.com helo=kegel.com by=hafad071097.uclm.es
debug: forged-HELO: mismatch on HELO: 'kegel.com' != 'pair.com'
debug: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: registering glue method for check_for_spf_helo_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0))
debug: bayes corpus size: nspam = 385327, nham = 337795
debug: tokenize: header tokens for MIME-Version = " "
debug: tokenize: header tokens for *c = " application/ms-tnef;
name="winmail.dat""
debug: tokenize: header tokens for Content-Transfer-Encoding = " binary"
debug: tokenize: header tokens for *x = " Microsoft Outlook Express
6.00.2800.1437"
debug: tokenize: header tokens for X-MimeOLE = " Produced By Microsoft Exchange
V6.5.7226.0"
debug: tokenize: header tokens for Content-class = "
urn:content-classes:message"
debug: tokenize: header tokens for *M = " OEA1111 OEB5112 OEC746b94a3 kegel
com "
debug: tokenize: header tokens for X-MS-Has-Attach = " "
debug: tokenize: header tokens for X-MS-TNEF-Correlator = " <[EMAIL PROTECTED]>"
debug: tokenize: header tokens for *F = "U*overland D*kegel.com D*com"
debug: tokenize: header tokens for To = "U*isrgr D*womans.com D*com"
debug: tokenize: header tokens for *RT = " [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=1 id=FS7ZTZJ7 auth= ]"
debug: tokenize: header tokens for *RU = " [ ip=161.67.91.44
rdns=hafad071097.uclm.es helo=hafad071097.uclm.es by=rh1.hospital.womans.com
ident= envfrom= intl=0 id=97E247F4C0 auth= ] [ ip=209.68.1.136
rdns=vroo.pair.com helo=kegel.com by=hafad071097.uclm.es ident= envfrom= intl=0
id=C735CD8EB4 auth= ]"
debug: tokenize: header tokens for *r = " kegel.com (vroo.pair.com [209.68.1
ip*209.68.1.136 ]) by hafad071097.uclm.es esmtp <[EMAIL PROTECTED]>; "
debug: tokenize: header tokens for *r = " kegel.com (vroo.pair.com [209.68.1
ip*209.68.1.136 ]) by hafad071097.uclm.es esmtp <[EMAIL PROTECTED]>;
hafad071097.uclm.es (hafad071097.uclm.es [161.67.91 ip*161.67.91.44 ]) by
rh1.hospital.womans.com (Postfix) <[EMAIL PROTECTED]>; "
debug: bayes token 'H*c:application' => 0.000459436379163109
debug: bayes token 'HContent-class:urn' => 0.00124478779704921
debug: bayes token 'HContent-class:message' => 0.00125488306339636
debug: bayes token 'HContent-class:content-classes' => 0.00129696305576781
debug: bayes token 'HX-MimeOLE:V6.5.7226.0' => 0.00242811607141443
debug: bayes token 'H*M:OEA1111' => 0.978
debug: bayes token 'H*MI:OEA1111' => 0.978
debug: bayes token 'H*Ad:U*isrgr' => 0.97532901281568
debug: bayes token 'HTo:U*isrgr' => 0.972249548198296
debug: bayes token 'H*r:sk:[EMAIL PROTECTED]' => 0.969778033801266
debug: bayes token 'HX-MimeOLE:Exchange' => 0.0424188643647326
debug: bayes token 'H*RT:auth' => 0.0919996839964183
debug: bayes token 'H*RT:intl' => 0.0993002041644666
debug: bayes token 'H*RT:helo' => 0.0993002041644666
debug: bayes token 'H*RT:envfrom' => 0.0993002041644666
debug: bayes token 'H*RT:rdns' => 0.0993002041644666
debug: bayes token 'H*RT:ident' => 0.0993002041644666
debug: bayes token 'H*RT:sk:rh1.hos' => 0.0993002041644666
debug: bayes: score = 0.344666495676421
debug: bayes: 11560 untie-ing
debug: bayes: 11560 untie-ing db_toks
debug: bayes: 11560 untie-ing db_seen
debug: Razor2 is available
debug: entering helper-app run mode
Razor-Log: Computed razorhome from env: /var/spool/filter/.razor
Razor-Log: Found razorhome: /var/spool/filter/.razor
Razor-Log: No /var/spool/filter/.razor/razor-agent.conf found, skipping.
Razor-Log: No razor-agent.conf found, using defaults.
Apr 26 09:29:35.727168 check[11560]: [ 2] [bootup] Logging initiated
LogDebugLevel=9 to stdout
Apr 26 09:29:35.727774 check[11560]: [ 5] computed
razorhome=/var/spool/filter/.razor, conf=,
ident=/var/spool/filter/.razor/identity
Apr 26 09:29:35.728173 check[11560]: [ 8] Client supported_engines: 4 8
Apr 26 09:29:35.752344 check[11560]: [ 8] prep_mail done: mail 1 headers=1726,
mime0=2077
Apr 26 09:29:35.753175 check[11560]: [ 5] read_file: 2 items read from
/var/spool/filter/.razor/servers.discovery.lst
Apr 26 09:29:35.753705 check[11560]: [ 5] read_file: 2 items read from
/var/spool/filter/.razor/servers.nomination.lst
Apr 26 09:29:35.754143 check[11560]: [ 5] read_file: 3 items read from
/var/spool/filter/.razor/servers.catalogue.lst
Apr 26 09:29:35.754699 check[11560]: [ 9] Assigning defaults to
joy.cloudmark.com
Apr 26 09:29:35.754945 check[11560]: [ 9] Assigning defaults to
folly.cloudmark.com
Apr 26 09:29:35.755190 check[11560]: [ 9] Assigning defaults to
wonder.cloudmark.com
Apr 26 09:29:35.755410 check[11560]: [ 9] Assigning defaults to
pride.cloudmark.com
Apr 26 09:29:35.755623 check[11560]: [ 9] Assigning defaults to
thrill.cloudmark.com
Apr 26 09:29:35.756683 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.shock.cloudmark.com.conf
Apr 26 09:29:35.757372 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.shock.cloudmark.com.conf
Apr 26 09:29:35.757971 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.vanity.cloudmark.com.conf
Apr 26 09:29:35.758524 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.vanity.cloudmark.com.conf
Apr 26 09:29:35.759132 check[11560]: [ 5] read_file: 13 items read from
/var/spool/filter/.razor/server.truth.cloudmark.com.conf
Apr 26 09:29:35.759700 check[11560]: [ 5] read_file: 13 items read from
/var/spool/filter/.razor/server.truth.cloudmark.com.conf
Apr 26 09:29:35.760259 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.panic.cloudmark.com.conf
Apr 26 09:29:35.760801 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.panic.cloudmark.com.conf
Apr 26 09:29:35.761462 check[11560]: [ 5] read_file: 16 items read from
/var/spool/filter/.razor/server.stress.cloudmark.com.conf
Apr 26 09:29:35.762134 check[11560]: [ 5] read_file: 16 items read from
/var/spool/filter/.razor/server.stress.cloudmark.com.conf
Apr 26 09:29:35.762796 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.wonder.cloudmark.com.conf
Apr 26 09:29:35.763448 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.wonder.cloudmark.com.conf
Apr 26 09:29:35.764092 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.pride.cloudmark.com.conf
Apr 26 09:29:35.764725 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.pride.cloudmark.com.conf
Apr 26 09:29:35.765388 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.thrill.cloudmark.com.conf
Apr 26 09:29:35.766020 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.thrill.cloudmark.com.conf
Apr 26 09:29:35.766645 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.robust.cloudmark.com.conf
Apr 26 09:29:35.767264 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.robust.cloudmark.com.conf
Apr 26 09:29:35.767915 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.tension.cloudmark.com.conf
Apr 26 09:29:35.768522 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.tension.cloudmark.com.conf
Apr 26 09:29:35.769165 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.prejudice.cloudmark.com.conf
Apr 26 09:29:35.769766 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.prejudice.cloudmark.com.conf
Apr 26 09:29:35.770110 check[11560]: [ 5] server discovery overdue by 27555141
seconds
Apr 26 09:29:35.770306 check[11560]: [ 8] already have 2 discovery servers
Apr 26 09:29:35.770468 check[11560]: [ 8] Checking with Razor Discovery Server
66.151.150.35
Apr 26 09:29:35.770654 check[11560]: [ 6] No port specified, using 2703
Apr 26 09:29:35.770790 check[11560]: [ 5] Connecting to 66.151.150.35 ...
Apr 26 09:29:35.868597 check[11560]: [ 8] Connection established
Apr 26 09:29:35.868949 check[11560]: [ 4] 66.151.150.35 >> 35 server greeting:
sn=D&srl=491&a=l&a=cg&ep4=7542-10
Apr 26 09:29:35.869278 check[11560]: [ 4] 66.151.150.35 << 12
Apr 26 09:29:35.869423 check[11560]: [ 6] a=g&pm=csl
Apr 26 09:29:35.918122 check[11560]: [ 4] 66.151.150.35 >> 32
Apr 26 09:29:35.918295 check[11560]: [ 6] response to sent.1
-csl=?
shock.cloudmark.com
.
Apr 26 09:29:35.918679 check[11560]: [ 8] Discovery Server 66.151.150.35
replying with csl=shock.cloudmark.com
Apr 26 09:29:35.918921 check[11560]: [ 4] 66.151.150.35 << 12
Apr 26 09:29:35.919073 check[11560]: [ 6] a=g&pm=nsl
Apr 26 09:29:35.967729 check[11560]: [ 4] 66.151.150.35 >> 51
Apr 26 09:29:35.967901 check[11560]: [ 6] response to sent.2
-nsl=?
folly.cloudmark.com
joy.cloudmark.com
.
Apr 26 09:29:35.968336 check[11560]: [ 8] Discovery Server 66.151.150.35
replying with nsl=folly.cloudmark.com
Apr 26 09:29:35.968491 check[11560]: [ 8] Discovery Server 66.151.150.35
replying with nsl=joy.cloudmark.com
Apr 26 09:29:35.968636 check[11560]: [ 8] Checking with Razor Discovery Server
66.151.150.36
Apr 26 09:29:35.968799 check[11560]: [ 6] losing old server connection,
66.151.150.35, for new server, 66.151.150.36
Apr 26 09:29:35.968939 check[11560]: [ 5] disconnecting from server
66.151.150.35
Apr 26 09:29:35.969185 check[11560]: [ 4] 66.151.150.35 << 5
Apr 26 09:29:35.969326 check[11560]: [ 6] a=q
Apr 26 09:29:35.969512 check[11560]: [ 6] No port specified, using 2703
Apr 26 09:29:35.969643 check[11560]: [ 5] Connecting to 66.151.150.36 ...
Apr 26 09:29:36.068464 check[11560]: [ 8] Connection established
Apr 26 09:29:36.068976 check[11560]: [ 4] 66.151.150.36 >> 24 server greeting:
sn=L&srl=9000&a=l&a=cg
Apr 26 09:29:36.069320 check[11560]: [ 4] 66.151.150.36 << 12
Apr 26 09:29:36.069464 check[11560]: [ 6] a=g&pm=csl
Apr 26 09:29:36.122734 check[11560]: [ 4] 66.151.150.36 >> 9
Apr 26 09:29:36.123024 check[11560]: [ 6] response to sent.4
err=240
Apr 26 09:29:36.123516 check[11560]: [ 4] 66.151.150.36 << 12
Apr 26 09:29:36.123688 check[11560]: [ 6] a=g&pm=nsl
Apr 26 09:29:36.172863 check[11560]: [ 4] 66.151.150.36 >> 9
Apr 26 09:29:36.173087 check[11560]: [ 6] response to sent.5
err=240
Apr 26 09:29:36.173746 check[11560]: [ 5] writeservers skipping .lst file:
/var/spool/filter/.razor/servers.catalogue.lst
Apr 26 09:29:36.173997 check[11560]: [ 5] writeservers skipping .lst file:
/var/spool/filter/.razor/servers.nomination.lst
Apr 26 09:29:36.174340 check[11560]: [ 6] shock.cloudmark.com is a Catalogue
Server srl 5074; computed min_cf=6, Server se: C8
Apr 26 09:29:36.174663 check[11560]: [ 8] Computed supported_engines: 4 8
Apr 26 09:29:36.174876 check[11560]: [ 8] Using next closest server
shock.cloudmark.com:2703, cached info srl 5074
Apr 26 09:29:36.175346 check[11560]: [ 8] mail 1 Subject: FW: Average Bithecs
big dick action
Apr 26 09:29:36.177541 check[11560]: [ 6] preproc: mail 1.0 went from 2077
bytes to 1910
Apr 26 09:29:36.177832 check[11560]: [ 6] computing sigs for mail 1.0, len 141
Apr 26 09:29:36.201709 check[11560]: [ 6] skipping whitelist file (empty?):
/var/spool/filter/.razor/razor-whitelist
Apr 26 09:29:36.202090 check[11560]: [ 6] losing old server connection,
66.151.150.36, for new server, shock.cloudmark.com
Apr 26 09:29:36.202261 check[11560]: [ 5] disconnecting from server
66.151.150.36
Apr 26 09:29:36.202561 check[11560]: [ 4] 66.151.150.36 << 5
Apr 26 09:29:36.202698 check[11560]: [ 6] a=q
Apr 26 09:29:36.202902 check[11560]: [ 5] Connecting to shock.cloudmark.com ...
Apr 26 09:29:36.305122 check[11560]: [ 8] Connection established
Apr 26 09:29:36.305575 check[11560]: [ 4] shock.cloudmark.com >> 36 server
greeting: sn=C&srl=5074&a=l&a=cg&ep4=7542-10
Apr 26 09:29:36.306132 check[11560]: [ 4] shock.cloudmark.com << 25
Apr 26 09:29:36.306315 check[11560]: [ 6] cn=razor-agents&cv=2.67
Apr 26 09:29:36.306632 check[11560]: [ 6] shock.cloudmark.com is a Catalogue
Server srl 5074; computed min_cf=6, Server se: C8
Apr 26 09:29:36.306949 check[11560]: [ 8] Computed supported_engines: 4 8
Apr 26 09:29:36.307207 check[11560]: [ 8] mail 1.0 e4 sig:
JcFEpNZ_cuc323lYy3TikAzbkPcA
Apr 26 09:29:36.307451 check[11560]: [ 8] mail 1.0 e8 sig: icpFRu2ISpcA
Apr 26 09:29:36.307700 check[11560]: [ 8] preparing 2 queries
Apr 26 09:29:36.308115 check[11560]: [ 8] sending 1 batches
Apr 26 09:29:36.308362 check[11560]: [ 4] shock.cloudmark.com << 80
Apr 26 09:29:36.308520 check[11560]: [ 6]
-a=c&e=4&ep4=7542-10&s=JcFEpNZ_cuc323lYy3TikAzbkPcA
a=c&e=8&s=icpFRu2ISpcA
.
Apr 26 09:29:36.589868 check[11560]: [ 4] shock.cloudmark.com >> 21
Apr 26 09:29:36.590061 check[11560]: [ 6] response to sent.8
-p=0
p=1&cf=100
.
Apr 26 09:29:36.590754 check[11560]: [ 6] mail 1.0 e=4
sig=JcFEpNZ_cuc323lYy3TikAzbkPcA: sig not found.
Apr 26 09:29:36.590984 check[11560]: [ 6] mail 1.0 e=8 sig=icpFRu2ISpcA: Is
spam: cf 100 >= min_cf 6
Apr 26 09:29:36.591183 check[11560]: [ 7] method 4: mail 1.0: no-contention
part, spam=1
Apr 26 09:29:36.591327 check[11560]: [ 7] method 4: mail 1: a non-contention
part was spam, mail spam
Apr 26 09:29:36.591454 check[11560]: [ 3] mail 1 is known spam.
Apr 26 09:29:36.591592 check[11560]: [ 5] disconnecting from server
shock.cloudmark.com
Apr 26 09:29:36.591835 check[11560]: [ 4] shock.cloudmark.com << 5
Apr 26 09:29:36.591965 check[11560]: [ 6] a=q
debug: Using results from Razor v2.67
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: Found Razor2 part: part=0 engine=8 ct=0 cf=100
debug: leaving helper-app run mode
debug: Razor2 results: spam? 1 highest cf score: 100
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-1.04
debug: running full-text regexp tests; score so far=-1.04
debug: Razor2 is available
debug: Current PATH is:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: executable for dccproc was found at /usr/local/bin/dccproc
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 11568: ruid=501 euid=501
debug: DCC: got response: X-DCC-EATSERVER-Metrics: rh1.hospital.womans.com
1166; Body=1 Fuz1=1
debug: leaving helper-app run mode
debug: Running tests for priority: 500
debug: RBL: success for 14 of 14 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'check_post_dnsbl'
debug: running meta tests; score so far=1.687
debug: running header regexp tests; score so far=1.687
debug: running body-text per-line regexp tests; score so far=1.687
debug: running uri tests; score so far=1.687
debug: running raw-body-text per-line regexp tests; score so far=1.687
debug: running full-text regexp tests; score so far=1.687
debug: Running tests for priority: 1000
debug: running meta tests; score so far=1.687
debug: running header regexp tests; score so far=1.687
debug: running body-text per-line regexp tests; score so far=1.687
debug: running uri tests; score so far=1.687
debug: running raw-body-text per-line regexp tests; score so far=1.687
debug: running full-text regexp tests; score so far=1.687
debug: auto-learn: currently using scoreset 3, recomputing score based on
scoreset 1.
debug: auto-learn: message score: 1.687, computed score for autolearn: 3.467
debug: auto-learn? ham=0.1, spam=12, body-points=3.467, head-points=1.982,
learned-points=-1.096
debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
debug: is spam? score=1.687 required=5
debug: tests=BAYES_40,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET
debug:
subtests=__ANY_OUTLOOK_MUA,__CT,__CTE,__HAS_MIMEOLE,__HAS_MSGID,__HAS_OUTLOOK_IN_MAILER,__HAS_SUBJECT,__HAS_X_MAILER,__IS_EXCH,__MIME_VERSION,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__OE_MSGID_2,__OE_MUA,__OUTLOOK_DOLLARS_MSGID,__SANE_MSGID,__SARE_HTML_HAS_TO
Microsoft Mail Internet Headers Version 2.0
Received: from rh1.hospital.womans.com (spamfilter.hospital.womans.com
[10.1.100.7]) by exch-srv1.Womans.com with SMTP (Microsoft Exchange Internet
Mail Service Version 5.5.2657.72) id FS7ZTZJ7; Tue, 26 Apr 2005 06:41:15 -0500
Received: by rh1.hospital.womans.com (Postfix, from userid 501) id 4124C7F4B1;
Tue, 26 Apr 2005 08:52:44 -0400 (EDT)
Received: from hafad071097.uclm.es (hafad071097.uclm.es [161.67.91.44]) by
rh1.hospital.womans.com (Postfix) with ESMTP id 97E247F4C0 for <[EMAIL
PROTECTED]>; Tue, 26 Apr 2005 08:52:39 -0400 (EDT)
Received: from kegel.com (vroo.pair.com [209.68.1.136]) by hafad071097.uclm.es
with esmtp id C735CD8EB4 for <[EMAIL PROTECTED]>; Tue, 26 Apr 2005 04:40:51
-0700
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: binary
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: FW: Average Bithecs big dick action
Date: Tue, 26 Apr 2005 06:40:51 -0500
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator: <[EMAIL PROTECTED]>
Thread-Topic: Average Bithecs big dick action
Thread-Index: AcVKVNq98wsbTV9BR9+zY7X+R8PUzw==
From: "Toothiest B. Limeades" <[EMAIL PROTECTED]>
To: "ROY,RHETT G" <[EMAIL PROTECTED]>
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
rh1.hospital.womans.com
X-Spam-Level: *
X-Spam-Status: No, score=1.7 required=5.0 tests=BAYES_40=-1.096,
RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511,
RCVD_IN_BL_SPAMCOP_NET=1.216 autolearn=no version=3.0.2
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2800.1437" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>
Haven't we met somewhere before? :)))
<A
href="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.htm";
title="bred">
<BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/jn1GMup/fl0TwXG.jpG";
alt="collaring" border='0'><BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
border=0><BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/1CzXjQW/Wn/HZ.gif";
border='0'><br></A>Si jaamaRhonanai
<br>
Hey honey! :)<BR><BR>
<A
href="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.htm";
target="preempts"><BR><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/p5hQt/TMdc5cgpBD.jpG";
alt="hydrants" border='0'><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
alt="optometry" border='0'><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/h6oLlKL5h/tJ6Uj4eD/b1WC6w.gif";
alt="Libby" border=0><br></A>Ka kite ano
Pleased to meet you!
<BR>
<A
href="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.htm";
title="fretfully">
<br><br>
<IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/G/dtO1H16UtB.jpG";
alt="Ptolemy" border="0"><BR><IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
alt="recidivists" border="0"><BR><IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/wvzr/DUk0z/G85YTn.gif";
border='0'><BR><BR></A>Soreja
<br><br>
<A href="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/cTdg7Z.html";
target="woody" title="lama"><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/do.gif"; border='0'>
</A></DIV></BODY></HTML>
Spam detection software, running on the system "rh1.hospital.womans.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (1.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.1 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.3447]
0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
[cf: 100]
1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?161.67.91.44>]
sh-2.05b$
sh-2.05b$ exit
exit
[EMAIL PROTECTED] root]# cat > /tmp/spam
Microsoft Mail Internet Headers Version 2.0
Received: from rh1.hospital.womans.com (spamfilter.hospital.womans.com
[10.1.100.7]) by exch-srv1.Womans.com with SMTP (Microsoft Exchange Internet
Mail Service Version 5.5.2657.72) id FS7ZTYGL; Tue, 26 Apr 2005 01:16:39 -0500
Received: by rh1.hospital.womans.com (Postfix, from userid 501) id 19BF97F4C0;
Tue, 26 Apr 2005 03:28:07 -0400 (EDT)
Received: from mail.bulgaria.com (i60-34-36-43.s02.a006.ap.plala.or.jp
[60.34.36.43]) by rh1.hospital.womans.com (Postfix) with ESMTP id 98FD97F4A9;
Tue, 26 Apr 2005 03:27:42 -0400 (EDT)
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Content-Transfer-Encoding: binary
x-spam-checker-version: SpamAssassin 3.0.2 (2004-11-16) on
rh1.hospital.womans.com
x-spam-level: *
x-spam-status: No, score=1.4 required=5.0 tests=BAYES_00=-2.599,
DCC_CHECK=2.169,DIGEST_MULTIPLE=0.098,HTML_50_60=0.087,
HTML_MESSAGE=0.001,MIME_QP_LONG_LINE=0.039,
RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511 autolearn=no version=3.0.2
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: Please note that our prices have never been this low
Date: Tue, 26 Apr 2005 02:19:53 -0500
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: <[EMAIL PROTECTED]>
Thread-Topic: Please note that our prices have never been this low
Thread-Index: AcVKJ4IdHl4/6p5cT/aFK3tHkVqVjw==
From: "SimplyRX" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2900.2627" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV align=center><FONT face=Arial><STRONG>Overnight Shipping and Low
Prices!</STRONG></FONT></DIV>
<DIV align=center><A href="http://coolestrxever.com:";><IMG alt="Meds Here!"
hspace=0
src="cid:[EMAIL PROTECTED]" align=baseline border=0></A></DIV>
<DIV align=center><FONT face=Arial color=#ff0000 size=2><STRONG>Todays
Specials!</STRONG></FONT></DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT size=2> </FONT>
<P><FONT face=Arial size=1>That's the message from a group of published and
award-winning novelists in an open letter to influential television talk-show
host Oprah Winfrey, begging her to resume picking new novels for members of her
popular book club. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>"There's a widely-held belief that the landscape of
literary fiction is now a gloomy place," Word of Mouth, a loose alliance of
women's authors, wrote. It said fiction sales began to plummet when the The
Oprah Winfrey Book Club went off the air in 2002 and stopped featuring
contemporary authors. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>"Book Club members stopped buying new fiction, and
this changed the face of American publishing," said the letter, which was signed
by 158 authors. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Among those signing the letter were Pulitzer Prize
winner Jhumpa Lahiri and Amy Tan, author of "The Joy Luck Club." Several male
authors also signed. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>The letter expressed thanks for Winfrey's
contribution to book sales and asked her to "consider focusing, once again, on
contemporary writers in your book club." </FONT></P>
<P><FONT face=Arial size=1>Getting people to read is about the most important
contribution that anyone can make to American society," Sharp told Reuters.
debug: SpamAssassin version 3.0.2
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
debug: config: read file /etc/mail/spamassassin/init.pre
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: config: read file /usr/share/spamassassin/70_sare_evilnum0.cf
debug: config: read file /usr/share/spamassassin/70_sare_genlsubj0.cf
debug: config: read file /usr/share/spamassassin/70_sare_header0.cf
debug: config: read file /usr/share/spamassassin/70_sare_html0.cf
debug: config: read file /usr/share/spamassassin/70_sare_specific.cf
debug: config: read file /usr/share/spamassassin/70_sare_uri0.cf
debug: config: read file /usr/share/spamassassin/99_FVGT_Tripwire.cf
debug: config: read file /usr/share/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /usr/share/spamassassin/backhair.cf
debug: config: read file /usr/share/spamassassin/bogus-virus-warnings.cf
debug: config: read file /usr/share/spamassassin/chickenpox.cf
debug: config: read file /usr/share/spamassassin/evilnumbers.cf
debug: config: read file /usr/share/spamassassin/rhett.cf
debug: config: read file /usr/share/spamassassin/tripwire.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: using "/var/spool/filter/.spamassassin/user_prefs" for user prefs file
debug: config: read file /var/spool/filter/.spamassassin/user_prefs
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8eba4dc)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8edd694)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8eba4dc) implements
'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8edd694) implements
'parse_config'
debug: config: SpamAssassin failed to parse line, skipping: rewrite_subject
1
debug: config: SpamAssassin failed to parse line, skipping: always_add_report
1
debug: config: SpamAssassin failed to parse line, skipping: use_terse_report
1
debug: config: SpamAssassin failed to parse line, skipping: auto_learn
1
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: bayes: 11693 tie-ing to DB file R/O
/var/spool/filter/.spamassassin/bayes_toks
debug: bayes: 11693 tie-ing to DB file R/O
/var/spool/filter/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: Score set 3 chosen.
debug: received-header: parsed as [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=0 id=FS7ZTYGL auth= ]
debug: received-header: parsed as [ ip=60.34.36.43
rdns=i60-34-36-43.s02.a006.ap.plala.or.jp helo=mail.bulgaria.com
by=rh1.hospital.womans.com ident= envfrom= intl=0 id=98FD97F4A9 auth= ]
debug: received-header: relay 10.1.100.7 trusted? yes internal? yes
debug: received-header: relay 60.34.36.43 trusted? no internal? no
debug: metadata: X-Spam-Relays-Trusted: [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=1 id=FS7ZTYGL auth= ]
debug: metadata: X-Spam-Relays-Untrusted: [ ip=60.34.36.43
rdns=i60-34-36-43.s02.a006.ap.plala.or.jp helo=mail.bulgaria.com
by=rh1.hospital.womans.com ident= envfrom= intl=0 id=98FD97F4A9 auth= ]
debug: ---- MIME PARSER START ----
debug: main message type: application/ms-tnef
debug: parsing normal part
debug: added part, type: application/ms-tnef
debug: ---- MIME PARSER END ----
debug: Message too short for language analysis
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8eba4dc) implements
'parsed_metadata'
debug: dns_available set to yes in config file, skipping test
debug: URIDNSBL: domains to query:
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.23
debug: all '*From' addrs: [EMAIL PROTECTED]
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8edd694))
debug: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0))
debug: SPF: checking HELO (helo=mail.bulgaria.com, ip=60.34.36.43)
debug: SPF: trimmed HELO down to 'bulgaria.com'
debug: SPF: cannot load or create Mail::SPF::Query module
debug: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8edd694))
debug: all '*To' addrs: [EMAIL PROTECTED]
debug: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0))
debug: SPF: relayed through one or more trusted relays, cannot use header-based
Envelope-From, skipping
debug: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0))
debug: registering glue method for check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0))
debug: forged-HELO: from=plala.or.jp helo=bulgaria.com by=womans.com
debug: forged-HELO: mismatch on HELO: 'bulgaria.com' != 'plala.or.jp'
debug: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0))
debug: registering glue method for check_for_spf_helo_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ecbbf0))
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8eba4dc))
debug: bayes corpus size: nspam = 385328, nham = 337799
debug: tokenize: header tokens for MIME-Version = " "
debug: tokenize: header tokens for *c = " application/ms-tnef;
name="winmail.dat""
debug: tokenize: header tokens for *x = " Microsoft Outlook Express
6.00.2900.2180"
debug: tokenize: header tokens for Content-Transfer-Encoding = " binary"
debug: tokenize: header tokens for X-MimeOLE = " Produced By Microsoft Exchange
V6.5.7226.0"
debug: tokenize: header tokens for Content-class = "
urn:content-classes:message"
debug: tokenize: header tokens for *M = " OEA002d OEBf571 OECcce5c478 BQHZV "
debug: tokenize: header tokens for X-MS-Has-Attach = " yes"
debug: tokenize: header tokens for X-MS-TNEF-Correlator = " <[EMAIL PROTECTED]>"
debug: tokenize: header tokens for *F = "U*lailagentsy D*mail.bulgaria.com
D*bulgaria.com D*com"
debug: tokenize: header tokens for To = "U*ingram D*womans.com D*com"
debug: tokenize: header tokens for *RT = " [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=1 id=FS7ZTYGL auth= ]"
debug: tokenize: header tokens for *RU = " [ ip=60.34.36.43
rdns=i60-34-36-43.s02.a006.ap.plala.or.jp helo=mail.bulgaria.com
by=rh1.hospital.womans.com ident= envfrom= intl=0 id=98FD97F4A9 auth= ]"
debug: tokenize: header tokens for *r = " mail.bulgaria.com
(i60-34-36-43.s02.a006.ap.plala.or.jp [60.34.36 ip*60.34.36.43 ]) by
rh1.hospital.womans.com (Postfix) ; "
debug: tokenize: header tokens for *r = " mail.bulgaria.com
(i60-34-36-43.s02.a006.ap.plala.or.jp [60.34.36 ip*60.34.36.43 ]) by
rh1.hospital.womans.com (Postfix) ; by rh1.hospital.womans.com (Postfix,
userid 501) ; "
debug: bayes token 'H*c:application' => 0.000459436379163109
debug: bayes token 'HContent-class:urn' => 0.00124479923844154
debug: bayes token 'HContent-class:message' => 0.00125489459746277
debug: bayes token 'HContent-class:content-classes' => 0.00129697498010257
debug: bayes token 'HX-MimeOLE:V6.5.7226.0' => 0.00242813835429496
debug: bayes token 'HX-MS-Has-Attach:yes' => 0.00617553710589234
debug: bayes token 'H*M:OEA002d' => 0.00664197530864198
debug: bayes token 'H*MI:OEA002d' => 0.0256190476190476
debug: bayes token 'H*Ad:U*ingram' => 0.958
debug: bayes token 'HX-MimeOLE:Exchange' => 0.0424192399243781
debug: bayes token 'H*r:501' => 0.0489090909090909
debug: bayes token 'H*x:6.00.2900.2180' => 0.0748103578594112
debug: bayes token 'H*UA:6.00.2900.2180' => 0.0748103578594112
debug: bayes token 'H*RT:auth' => 0.0920004521275823
debug: bayes token 'H*RT:intl' => 0.0993010261171637
debug: bayes token 'H*RT:helo' => 0.0993010261171637
debug: bayes token 'H*RT:envfrom' => 0.0993010261171637
debug: bayes token 'H*RT:rdns' => 0.0993010261171637
debug: bayes token 'H*RT:ident' => 0.0993010261171637
debug: bayes token 'H*RT:sk:rh1.hos' => 0.0993010261171637
debug: bayes token 'H*r:userid' => 0.12857180759445
debug: bayes: score = 3.50716791164274e-08
debug: bayes: 11693 untie-ing
debug: bayes: 11693 untie-ing db_toks
debug: bayes: 11693 untie-ing db_seen
debug: Razor2 is available
debug: entering helper-app run mode
Razor-Log: Computed razorhome from env: /var/spool/filter/.razor
Razor-Log: Found razorhome: /var/spool/filter/.razor
Razor-Log: No /var/spool/filter/.razor/razor-agent.conf found, skipping.
Razor-Log: No razor-agent.conf found, using defaults.
Apr 26 09:32:30.966293 check[11693]: [ 2] [bootup] Logging initiated
LogDebugLevel=9 to stdout
Apr 26 09:32:30.966864 check[11693]: [ 5] computed
razorhome=/var/spool/filter/.razor, conf=,
ident=/var/spool/filter/.razor/identity
Apr 26 09:32:30.967249 check[11693]: [ 8] Client supported_engines: 4 8
Apr 26 09:32:30.991396 check[11693]: [ 8] prep_mail done: mail 1 headers=1594,
mime0=4435
Apr 26 09:32:30.992253 check[11693]: [ 5] read_file: 2 items read from
/var/spool/filter/.razor/servers.discovery.lst
Apr 26 09:32:30.992749 check[11693]: [ 5] read_file: 2 items read from
/var/spool/filter/.razor/servers.nomination.lst
Apr 26 09:32:30.993183 check[11693]: [ 5] read_file: 3 items read from
/var/spool/filter/.razor/servers.catalogue.lst
Apr 26 09:32:30.993652 check[11693]: [ 9] Assigning defaults to
joy.cloudmark.com
Apr 26 09:32:30.993899 check[11693]: [ 9] Assigning defaults to
folly.cloudmark.com
Apr 26 09:32:30.994129 check[11693]: [ 9] Assigning defaults to
wonder.cloudmark.com
Apr 26 09:32:30.994342 check[11693]: [ 9] Assigning defaults to
pride.cloudmark.com
Apr 26 09:32:30.994545 check[11693]: [ 9] Assigning defaults to
thrill.cloudmark.com
Apr 26 09:32:30.995613 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.shock.cloudmark.com.conf
Apr 26 09:32:30.996291 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.shock.cloudmark.com.conf
Apr 26 09:32:30.996881 check[11693]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.vanity.cloudmark.com.conf
Apr 26 09:32:30.997454 check[11693]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.vanity.cloudmark.com.conf
Apr 26 09:32:30.998042 check[11693]: [ 5] read_file: 13 items read from
/var/spool/filter/.razor/server.truth.cloudmark.com.conf
Apr 26 09:32:30.998608 check[11693]: [ 5] read_file: 13 items read from
/var/spool/filter/.razor/server.truth.cloudmark.com.conf
Apr 26 09:32:30.999167 check[11693]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.panic.cloudmark.com.conf
Apr 26 09:32:30.999727 check[11693]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.panic.cloudmark.com.conf
Apr 26 09:32:31.000366 check[11693]: [ 5] read_file: 16 items read from
/var/spool/filter/.razor/server.stress.cloudmark.com.conf
Apr 26 09:32:31.000990 check[11693]: [ 5] read_file: 16 items read from
/var/spool/filter/.razor/server.stress.cloudmark.com.conf
Apr 26 09:32:31.001712 check[11693]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.wonder.cloudmark.com.conf
Apr 26 09:32:31.002350 check[11693]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.wonder.cloudmark.com.conf
Apr 26 09:32:31.003009 check[11693]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.pride.cloudmark.com.conf
Apr 26 09:32:31.003655 check[11693]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.pride.cloudmark.com.conf
Apr 26 09:32:31.004308 check[11693]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.thrill.cloudmark.com.conf
Apr 26 09:32:31.004932 check[11693]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.thrill.cloudmark.com.conf
Apr 26 09:32:31.005568 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.robust.cloudmark.com.conf
Apr 26 09:32:31.006170 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.robust.cloudmark.com.conf
Apr 26 09:32:31.006780 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.tension.cloudmark.com.conf
Apr 26 09:32:31.007402 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.tension.cloudmark.com.conf
Apr 26 09:32:31.008033 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.prejudice.cloudmark.com.conf
Apr 26 09:32:31.008624 check[11693]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.prejudice.cloudmark.com.conf
Apr 26 09:32:31.008962 check[11693]: [ 5] server discovery overdue by 27545308
seconds
Apr 26 09:32:31.009161 check[11693]: [ 8] already have 2 discovery servers
Apr 26 09:32:31.009319 check[11693]: [ 8] Checking with Razor Discovery Server
66.151.150.35
Apr 26 09:32:31.009504 check[11693]: [ 6] No port specified, using 2703
Apr 26 09:32:31.009638 check[11693]: [ 5] Connecting to 66.151.150.35 ...
Apr 26 09:32:31.118653 check[11693]: [ 8] Connection established
Apr 26 09:32:31.118988 check[11693]: [ 4] 66.151.150.35 >> 35 server greeting:
sn=D&srl=491&a=l&a=cg&ep4=7542-10
Apr 26 09:32:31.119303 check[11693]: [ 4] 66.151.150.35 << 12
Apr 26 09:32:31.119444 check[11693]: [ 6] a=g&pm=csl
Apr 26 09:32:31.173940 check[11693]: [ 4] 66.151.150.35 >> 32
Apr 26 09:32:31.174121 check[11693]: [ 6] response to sent.1
-csl=?
shock.cloudmark.com
.
Apr 26 09:32:31.174505 check[11693]: [ 8] Discovery Server 66.151.150.35
replying with csl=shock.cloudmark.com
Apr 26 09:32:31.174741 check[11693]: [ 4] 66.151.150.35 << 12
Apr 26 09:32:31.174903 check[11693]: [ 6] a=g&pm=nsl
Apr 26 09:32:31.229272 check[11693]: [ 4] 66.151.150.35 >> 51
Apr 26 09:32:31.229425 check[11693]: [ 6] response to sent.2
-nsl=?
joy.cloudmark.com
folly.cloudmark.com
.
Apr 26 09:32:31.229839 check[11693]: [ 8] Discovery Server 66.151.150.35
replying with nsl=joy.cloudmark.com
Apr 26 09:32:31.229980 check[11693]: [ 8] Discovery Server 66.151.150.35
replying with nsl=folly.cloudmark.com
Apr 26 09:32:31.230121 check[11693]: [ 8] Checking with Razor Discovery Server
66.151.150.36
Apr 26 09:32:31.230284 check[11693]: [ 6] losing old server connection,
66.151.150.35, for new server, 66.151.150.36
Apr 26 09:32:31.230436 check[11693]: [ 5] disconnecting from server
66.151.150.35
Apr 26 09:32:31.230655 check[11693]: [ 4] 66.151.150.35 << 5
Apr 26 09:32:31.230794 check[11693]: [ 6] a=q
Apr 26 09:32:31.230973 check[11693]: [ 6] No port specified, using 2703
Apr 26 09:32:31.231104 check[11693]: [ 5] Connecting to 66.151.150.36 ...
Apr 26 09:32:31.329546 check[11693]: [ 8] Connection established
Apr 26 09:32:31.330019 check[11693]: [ 4] 66.151.150.36 >> 24 server greeting:
sn=L&srl=9000&a=l&a=cg
Apr 26 09:32:31.330334 check[11693]: [ 4] 66.151.150.36 << 12
Apr 26 09:32:31.330470 check[11693]: [ 6] a=g&pm=csl
Apr 26 09:32:31.379553 check[11693]: [ 4] 66.151.150.36 >> 9
Apr 26 09:32:31.379716 check[11693]: [ 6] response to sent.4
err=240
Apr 26 09:32:31.380145 check[11693]: [ 4] 66.151.150.36 << 12
Apr 26 09:32:31.380327 check[11693]: [ 6] a=g&pm=nsl
Apr 26 09:32:31.429649 check[11693]: [ 4] 66.151.150.36 >> 9
Apr 26 09:32:31.429821 check[11693]: [ 6] response to sent.5
err=240
Apr 26 09:32:31.430436 check[11693]: [ 5] writeservers skipping .lst file:
/var/spool/filter/.razor/servers.catalogue.lst
Apr 26 09:32:31.430682 check[11693]: [ 5] writeservers skipping .lst file:
/var/spool/filter/.razor/servers.nomination.lst
Apr 26 09:32:31.431048 check[11693]: [ 6] shock.cloudmark.com is a Catalogue
Server srl 5074; computed min_cf=6, Server se: C8
Apr 26 09:32:31.431362 check[11693]: [ 8] Computed supported_engines: 4 8
Apr 26 09:32:31.431569 check[11693]: [ 8] Using next closest server
shock.cloudmark.com:2703, cached info srl 5074
Apr 26 09:32:31.432057 check[11693]: [ 8] mail 1 Subject: Please note that our
prices have never been this low
Apr 26 09:32:31.434800 check[11693]: [ 6] preproc: mail 1.0 went from 4435
bytes to 4268
Apr 26 09:32:31.435153 check[11693]: [ 6] computing sigs for mail 1.0, len 2133
Apr 26 09:32:31.458439 check[11693]: [ 6] skipping whitelist file (empty?):
/var/spool/filter/.razor/razor-whitelist
Apr 26 09:32:31.458812 check[11693]: [ 6] losing old server connection,
66.151.150.36, for new server, shock.cloudmark.com
Apr 26 09:32:31.459473 check[11693]: [ 5] disconnecting from server
66.151.150.36
Apr 26 09:32:31.459864 check[11693]: [ 4] 66.151.150.36 << 5
Apr 26 09:32:31.460009 check[11693]: [ 6] a=q
Apr 26 09:32:31.460216 check[11693]: [ 5] Connecting to shock.cloudmark.com ...
Apr 26 09:32:31.561019 check[11693]: [ 8] Connection established
Apr 26 09:32:31.561452 check[11693]: [ 4] shock.cloudmark.com >> 36 server
greeting: sn=C&srl=5074&a=l&a=cg&ep4=7542-10
Apr 26 09:32:31.561986 check[11693]: [ 4] shock.cloudmark.com << 25
Apr 26 09:32:31.562164 check[11693]: [ 6] cn=razor-agents&cv=2.67
Apr 26 09:32:31.562478 check[11693]: [ 6] shock.cloudmark.com is a Catalogue
Server srl 5074; computed min_cf=6, Server se: C8
Apr 26 09:32:31.562786 check[11693]: [ 8] Computed supported_engines: 4 8
Apr 26 09:32:31.563038 check[11693]: [ 8] mail 1.0 e4 sig:
2ZKfrJCcC92ez7mcY6HyadzgdMsA
Apr 26 09:32:31.563281 check[11693]: [ 8] mail 1.0 e8 sig: yGd6IMbcPp8A
Apr 26 09:32:31.563520 check[11693]: [ 8] preparing 2 queries
Apr 26 09:32:31.563911 check[11693]: [ 8] sending 1 batches
Apr 26 09:32:31.564151 check[11693]: [ 4] shock.cloudmark.com << 80
Apr 26 09:32:31.564301 check[11693]: [ 6]
-a=c&e=4&ep4=7542-10&s=2ZKfrJCcC92ez7mcY6HyadzgdMsA
a=c&e=8&s=yGd6IMbcPp8A
.
Apr 26 09:32:33.889249 check[11693]: [ 4] shock.cloudmark.com >> 21
Apr 26 09:32:33.889389 check[11693]: [ 6] response to sent.8
-p=0
p=1&cf=100
.
Apr 26 09:32:33.889843 check[11693]: [ 6] mail 1.0 e=4
sig=2ZKfrJCcC92ez7mcY6HyadzgdMsA: sig not found.
Apr 26 09:32:33.889978 check[11693]: [ 6] mail 1.0 e=8 sig=yGd6IMbcPp8A: Is
spam: cf 100 >= min_cf 6
Apr 26 09:32:33.890059 check[11693]: [ 7] method 4: mail 1.0: no-contention
part, spam=1
Apr 26 09:32:33.890116 check[11693]: [ 7] method 4: mail 1: a non-contention
part was spam, mail spam
Apr 26 09:32:33.890170 check[11693]: [ 3] mail 1 is known spam.
Apr 26 09:32:33.890234 check[11693]: [ 5] disconnecting from server
shock.cloudmark.com
Apr 26 09:32:33.890373 check[11693]: [ 4] shock.cloudmark.com << 5
Apr 26 09:32:33.890425 check[11693]: [ 6] a=q
debug: Using results from Razor v2.67
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: Found Razor2 part: part=0 engine=8 ct=0 cf=100
debug: leaving helper-app run mode
debug: Razor2 results: spam? 1 highest cf score: 100
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8eba4dc) implements
'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-2.543
debug: running full-text regexp tests; score so far=-2.543
debug: Razor2 is available
debug: Current PATH is:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: executable for dccproc was found at /usr/local/bin/dccproc
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 11694: ruid=501 euid=501
debug: DCC: got response: X-DCC-Servercave-Metrics: rh1.hospital.womans.com
1183; Body=1 Fuz1=1
debug: leaving helper-app run mode
debug: Running tests for priority: 500
debug: RBL: success for 8 of 8 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8eba4dc) implements
'check_post_dnsbl'
debug: running meta tests; score so far=2.044
debug: running header regexp tests; score so far=2.044
debug: running body-text per-line regexp tests; score so far=2.044
debug: running uri tests; score so far=2.044
debug: running raw-body-text per-line regexp tests; score so far=2.044
debug: running full-text regexp tests; score so far=2.044
debug: Running tests for priority: 1000
debug: running meta tests; score so far=2.044
debug: running header regexp tests; score so far=2.044
debug: running body-text per-line regexp tests; score so far=2.044
debug: running uri tests; score so far=2.044
debug: running raw-body-text per-line regexp tests; score so far=2.044
debug: running full-text regexp tests; score so far=2.044
debug: auto-learn: currently using scoreset 3, recomputing score based on
scoreset 1.
debug: auto-learn: message score: 2.044, computed score for autolearn: 4.146
debug: auto-learn? ham=0.1, spam=12, body-points=4.146, head-points=2.661,
learned-points=-2.599
debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
debug: is spam? score=2.044 required=5
debug: tests=BAYES_00,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_XBL
debug:
subtests=__ANY_OUTLOOK_MUA,__CT,__CTE,__HAS_MIMEOLE,__HAS_MSGID,__HAS_OUTLOOK_IN_MAILER,__HAS_SUBJECT,__HAS_X_MAILER,__IS_EXCH,__MIME_VERSION,__MSGID_OK_HEX,__MSGID_OK_HOST,__OE_MSGID_2,__OE_MUA,__OUTLOOK_DOLLARS_MSGID,__RCVD_IN_SBL_XBL,__SANE_MSGID,__SARE_HTML_HAS_TO
Microsoft Mail Internet Headers Version 2.0
Received: from rh1.hospital.womans.com (spamfilter.hospital.womans.com
[10.1.100.7]) by exch-srv1.Womans.com with SMTP (Microsoft Exchange Internet
Mail Service Version 5.5.2657.72) id FS7ZTYGL; Tue, 26 Apr 2005 01:16:39 -0500
Received: by rh1.hospital.womans.com (Postfix, from userid 501) id 19BF97F4C0;
Tue, 26 Apr 2005 03:28:07 -0400 (EDT)
Received: from mail.bulgaria.com (i60-34-36-43.s02.a006.ap.plala.or.jp
[60.34.36.43]) by rh1.hospital.womans.com (Postfix) with ESMTP id 98FD97F4A9;
Tue, 26 Apr 2005 03:27:42 -0400 (EDT)
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Content-Transfer-Encoding: binary
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: Please note that our prices have never been this low
Date: Tue, 26 Apr 2005 02:19:53 -0500
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: <[EMAIL PROTECTED]>
Thread-Topic: Please note that our prices have never been this low
Thread-Index: AcVKJ4IdHl4/6p5cT/aFK3tHkVqVjw==
From: "SimplyRX" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
rh1.hospital.womans.com
X-Spam-Level: **
X-Spam-Status: No, score=2.0 required=5.0 tests=BAYES_00=-2.599,
RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511,RCVD_IN_XBL=3.076
autolearn=no version=3.0.2
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2900.2627" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV align=center><FONT face=Arial><STRONG>Overnight Shipping and Low
Prices!</STRONG></FONT></DIV>
<DIV align=center><A href="http://coolestrxever.com:";><IMG alt="Meds Here!"
hspace=0
src="cid:[EMAIL PROTECTED]" align=baseline border=0></A></DIV>
<DIV align=center><FONT face=Arial color=#ff0000 size=2><STRONG>Todays
Specials!</STRONG></FONT></DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT face=Arial size=2></FONT> </DIV>
<DIV align=center><FONT size=2> </FONT>
<P><FONT face=Arial size=1>That's the message from a group of published and
award-winning novelists in an open letter to influential television talk-show
host Oprah Winfrey, begging her to resume picking new novels for members of her
popular book club. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>"There's a widely-held belief that the landscape of
literary fiction is now a gloomy place," Word of Mouth, a loose alliance of
women's authors, wrote. It said fiction sales began to plummet when the The
Oprah Winfrey Book Club went off the air in 2002 and stopped featuring
contemporary authors. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>"Book Club members stopped buying new fiction, and
this changed the face of American publishing," said the letter, which was signed
by 158 authors. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Among those signing the letter were Pulitzer Prize
winner Jhumpa Lahiri and Amy Tan, author of "The Joy Luck Club." Several male
authors also signed. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>The letter expressed thanks for Winfrey's
contribution to book sales and asked her to "consider focusing, once again, on
contemporary writers in your book club." </FONT></P>
<P><FONT face=Arial size=1>Getting people to read is about the most important
contribution that anyone can make to American society," Sharp told Reuters.
"It's a stunning achievement to get 500,00O people to go to bookstores.
</FONT></P>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Oprah's Book Club began as a segment on Winfrey's
talk show in 1996. An Oprah's Book Club logo on a novel's cover helped many of
her picks garner sales of more than 1 million copies. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>The club became embroiled in controversy in 2001 when
Jonathan Franzen publicly objected to the selection of his novel, "The
Corrections," and said he feared it might affect his reputation in literary
circles. He later said he regretted voicing his reservations. </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Winfrey suspended the club in April 2002, saying she
would only make occasional recommendations because, "It has become harder and
harder to find books on a monthly basis that I feel absolutely compelled to
share." </FONT>
<P><FONT face=Arial size=1></FONT>
<P><FONT face=Arial size=1>Relaunched in June 2003, the club now picks classics
such as John Steinbeck's "East of Eden" and Leo Tolstoy's "Anna Karenina" rather
than new books. </FONT></P></DIV></BODY></HTML>
Spam detection software, running on the system "rh1.hospital.womans.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (2.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
[cf: 100]
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[60.34.36.43 listed in sbl-xbl.spamhaus.org]
sh-2.05b$
debug: SpamAssassin version 3.0.2
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
debug: config: read file /etc/mail/spamassassin/init.pre
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: config: read file /usr/share/spamassassin/70_sare_evilnum0.cf
debug: config: read file /usr/share/spamassassin/70_sare_genlsubj0.cf
debug: config: read file /usr/share/spamassassin/70_sare_header0.cf
debug: config: read file /usr/share/spamassassin/70_sare_html0.cf
debug: config: read file /usr/share/spamassassin/70_sare_specific.cf
debug: config: read file /usr/share/spamassassin/70_sare_uri0.cf
debug: config: read file /usr/share/spamassassin/99_FVGT_Tripwire.cf
debug: config: read file /usr/share/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /usr/share/spamassassin/backhair.cf
debug: config: read file /usr/share/spamassassin/bogus-virus-warnings.cf
debug: config: read file /usr/share/spamassassin/chickenpox.cf
debug: config: read file /usr/share/spamassassin/evilnumbers.cf
debug: config: read file /usr/share/spamassassin/rhett.cf
debug: config: read file /usr/share/spamassassin/tripwire.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: using "/var/spool/filter/.spamassassin/user_prefs" for user prefs file
debug: config: read file /var/spool/filter/.spamassassin/user_prefs
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730) implements
'parse_config'
debug: config: SpamAssassin failed to parse line, skipping: rewrite_subject
1
debug: config: SpamAssassin failed to parse line, skipping: always_add_report
1
debug: config: SpamAssassin failed to parse line, skipping: use_terse_report
1
debug: config: SpamAssassin failed to parse line, skipping: auto_learn
1
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: bayes: 11560 tie-ing to DB file R/O
/var/spool/filter/.spamassassin/bayes_toks
debug: bayes: 11560 tie-ing to DB file R/O
/var/spool/filter/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: using "/var/spool/filter/.spamassassin" for user state dir
debug: Score set 3 chosen.
debug: received-header: parsed as [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=0 id=FS7ZTZJ7 auth= ]
debug: received-header: parsed as [ ip=161.67.91.44 rdns=hafad071097.uclm.es
helo=hafad071097.uclm.es by=rh1.hospital.womans.com ident= envfrom= intl=0
id=97E247F4C0 auth= ]
debug: received-header: parsed as [ ip=209.68.1.136 rdns=vroo.pair.com
helo=kegel.com by=hafad071097.uclm.es ident= envfrom= intl=0 id=C735CD8EB4
auth= ]
debug: received-header: relay 10.1.100.7 trusted? yes internal? yes
debug: received-header: relay 161.67.91.44 trusted? no internal? no
debug: received-header: relay 209.68.1.136 trusted? no internal? no
debug: metadata: X-Spam-Relays-Trusted: [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=1 id=FS7ZTZJ7 auth= ]
debug: metadata: X-Spam-Relays-Untrusted: [ ip=161.67.91.44
rdns=hafad071097.uclm.es helo=hafad071097.uclm.es by=rh1.hospital.womans.com
ident= envfrom= intl=0 id=97E247F4C0 auth= ] [ ip=209.68.1.136
rdns=vroo.pair.com helo=kegel.com by=hafad071097.uclm.es ident= envfrom= intl=0
id=C735CD8EB4 auth= ]
debug: ---- MIME PARSER START ----
debug: main message type: application/ms-tnef
debug: parsing normal part
debug: added part, type: application/ms-tnef
debug: ---- MIME PARSER END ----
debug: Message too short for language analysis
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'parsed_metadata'
debug: dns_available set to yes in config file, skipping test
debug: URIDNSBL: domains to query:
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.23
debug: all '*From' addrs: [EMAIL PROTECTED]
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730))
debug: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: SPF: checking HELO (helo=hafad071097.uclm.es, ip=161.67.91.44)
debug: SPF: trimmed HELO down to 'uclm.es'
debug: SPF: cannot load or create Mail::SPF::Query module
debug: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8ed1730))
debug: all '*To' addrs: [EMAIL PROTECTED]
debug: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: SPF: relayed through one or more trusted relays, cannot use header-based
Envelope-From, skipping
debug: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: registering glue method for check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: forged-HELO: from=hafad071097.uclm.es helo=hafad071097.uclm.es
by=womans.com
debug: forged-HELO: from=pair.com helo=kegel.com by=hafad071097.uclm.es
debug: forged-HELO: mismatch on HELO: 'kegel.com' != 'pair.com'
debug: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: registering glue method for check_for_spf_helo_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8ec941c))
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0))
debug: bayes corpus size: nspam = 385327, nham = 337795
debug: tokenize: header tokens for MIME-Version = " "
debug: tokenize: header tokens for *c = " application/ms-tnef;
name="winmail.dat""
debug: tokenize: header tokens for Content-Transfer-Encoding = " binary"
debug: tokenize: header tokens for *x = " Microsoft Outlook Express
6.00.2800.1437"
debug: tokenize: header tokens for X-MimeOLE = " Produced By Microsoft Exchange
V6.5.7226.0"
debug: tokenize: header tokens for Content-class = "
urn:content-classes:message"
debug: tokenize: header tokens for *M = " OEA1111 OEB5112 OEC746b94a3 kegel
com "
debug: tokenize: header tokens for X-MS-Has-Attach = " "
debug: tokenize: header tokens for X-MS-TNEF-Correlator = " <[EMAIL PROTECTED]>"
debug: tokenize: header tokens for *F = "U*overland D*kegel.com D*com"
debug: tokenize: header tokens for To = "U*isrgr D*womans.com D*com"
debug: tokenize: header tokens for *RT = " [ ip=10.1.100.7
rdns=spamfilter.hospital.womans.com helo=rh1.hospital.womans.com
by=exch-srv1.Womans.com ident= envfrom= intl=1 id=FS7ZTZJ7 auth= ]"
debug: tokenize: header tokens for *RU = " [ ip=161.67.91.44
rdns=hafad071097.uclm.es helo=hafad071097.uclm.es by=rh1.hospital.womans.com
ident= envfrom= intl=0 id=97E247F4C0 auth= ] [ ip=209.68.1.136
rdns=vroo.pair.com helo=kegel.com by=hafad071097.uclm.es ident= envfrom= intl=0
id=C735CD8EB4 auth= ]"
debug: tokenize: header tokens for *r = " kegel.com (vroo.pair.com [209.68.1
ip*209.68.1.136 ]) by hafad071097.uclm.es esmtp <[EMAIL PROTECTED]>; "
debug: tokenize: header tokens for *r = " kegel.com (vroo.pair.com [209.68.1
ip*209.68.1.136 ]) by hafad071097.uclm.es esmtp <[EMAIL PROTECTED]>;
hafad071097.uclm.es (hafad071097.uclm.es [161.67.91 ip*161.67.91.44 ]) by
rh1.hospital.womans.com (Postfix) <[EMAIL PROTECTED]>; "
debug: bayes token 'H*c:application' => 0.000459436379163109
debug: bayes token 'HContent-class:urn' => 0.00124478779704921
debug: bayes token 'HContent-class:message' => 0.00125488306339636
debug: bayes token 'HContent-class:content-classes' => 0.00129696305576781
debug: bayes token 'HX-MimeOLE:V6.5.7226.0' => 0.00242811607141443
debug: bayes token 'H*M:OEA1111' => 0.978
debug: bayes token 'H*MI:OEA1111' => 0.978
debug: bayes token 'H*Ad:U*isrgr' => 0.97532901281568
debug: bayes token 'HTo:U*isrgr' => 0.972249548198296
debug: bayes token 'H*r:sk:[EMAIL PROTECTED]' => 0.969778033801266
debug: bayes token 'HX-MimeOLE:Exchange' => 0.0424188643647326
debug: bayes token 'H*RT:auth' => 0.0919996839964183
debug: bayes token 'H*RT:intl' => 0.0993002041644666
debug: bayes token 'H*RT:helo' => 0.0993002041644666
debug: bayes token 'H*RT:envfrom' => 0.0993002041644666
debug: bayes token 'H*RT:rdns' => 0.0993002041644666
debug: bayes token 'H*RT:ident' => 0.0993002041644666
debug: bayes token 'H*RT:sk:rh1.hos' => 0.0993002041644666
debug: bayes: score = 0.344666495676421
debug: bayes: 11560 untie-ing
debug: bayes: 11560 untie-ing db_toks
debug: bayes: 11560 untie-ing db_seen
debug: Razor2 is available
debug: entering helper-app run mode
Razor-Log: Computed razorhome from env: /var/spool/filter/.razor
Razor-Log: Found razorhome: /var/spool/filter/.razor
Razor-Log: No /var/spool/filter/.razor/razor-agent.conf found, skipping.
Razor-Log: No razor-agent.conf found, using defaults.
Apr 26 09:29:35.727168 check[11560]: [ 2] [bootup] Logging initiated
LogDebugLevel=9 to stdout
Apr 26 09:29:35.727774 check[11560]: [ 5] computed
razorhome=/var/spool/filter/.razor, conf=,
ident=/var/spool/filter/.razor/identity
Apr 26 09:29:35.728173 check[11560]: [ 8] Client supported_engines: 4 8
Apr 26 09:29:35.752344 check[11560]: [ 8] prep_mail done: mail 1 headers=1726,
mime0=2077
Apr 26 09:29:35.753175 check[11560]: [ 5] read_file: 2 items read from
/var/spool/filter/.razor/servers.discovery.lst
Apr 26 09:29:35.753705 check[11560]: [ 5] read_file: 2 items read from
/var/spool/filter/.razor/servers.nomination.lst
Apr 26 09:29:35.754143 check[11560]: [ 5] read_file: 3 items read from
/var/spool/filter/.razor/servers.catalogue.lst
Apr 26 09:29:35.754699 check[11560]: [ 9] Assigning defaults to
joy.cloudmark.com
Apr 26 09:29:35.754945 check[11560]: [ 9] Assigning defaults to
folly.cloudmark.com
Apr 26 09:29:35.755190 check[11560]: [ 9] Assigning defaults to
wonder.cloudmark.com
Apr 26 09:29:35.755410 check[11560]: [ 9] Assigning defaults to
pride.cloudmark.com
Apr 26 09:29:35.755623 check[11560]: [ 9] Assigning defaults to
thrill.cloudmark.com
Apr 26 09:29:35.756683 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.shock.cloudmark.com.conf
Apr 26 09:29:35.757372 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.shock.cloudmark.com.conf
Apr 26 09:29:35.757971 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.vanity.cloudmark.com.conf
Apr 26 09:29:35.758524 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.vanity.cloudmark.com.conf
Apr 26 09:29:35.759132 check[11560]: [ 5] read_file: 13 items read from
/var/spool/filter/.razor/server.truth.cloudmark.com.conf
Apr 26 09:29:35.759700 check[11560]: [ 5] read_file: 13 items read from
/var/spool/filter/.razor/server.truth.cloudmark.com.conf
Apr 26 09:29:35.760259 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.panic.cloudmark.com.conf
Apr 26 09:29:35.760801 check[11560]: [ 5] read_file: 12 items read from
/var/spool/filter/.razor/server.panic.cloudmark.com.conf
Apr 26 09:29:35.761462 check[11560]: [ 5] read_file: 16 items read from
/var/spool/filter/.razor/server.stress.cloudmark.com.conf
Apr 26 09:29:35.762134 check[11560]: [ 5] read_file: 16 items read from
/var/spool/filter/.razor/server.stress.cloudmark.com.conf
Apr 26 09:29:35.762796 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.wonder.cloudmark.com.conf
Apr 26 09:29:35.763448 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.wonder.cloudmark.com.conf
Apr 26 09:29:35.764092 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.pride.cloudmark.com.conf
Apr 26 09:29:35.764725 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.pride.cloudmark.com.conf
Apr 26 09:29:35.765388 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.thrill.cloudmark.com.conf
Apr 26 09:29:35.766020 check[11560]: [ 5] read_file: 17 items read from
/var/spool/filter/.razor/server.thrill.cloudmark.com.conf
Apr 26 09:29:35.766645 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.robust.cloudmark.com.conf
Apr 26 09:29:35.767264 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.robust.cloudmark.com.conf
Apr 26 09:29:35.767915 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.tension.cloudmark.com.conf
Apr 26 09:29:35.768522 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.tension.cloudmark.com.conf
Apr 26 09:29:35.769165 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.prejudice.cloudmark.com.conf
Apr 26 09:29:35.769766 check[11560]: [ 5] read_file: 15 items read from
/var/spool/filter/.razor/server.prejudice.cloudmark.com.conf
Apr 26 09:29:35.770110 check[11560]: [ 5] server discovery overdue by 27555141
seconds
Apr 26 09:29:35.770306 check[11560]: [ 8] already have 2 discovery servers
Apr 26 09:29:35.770468 check[11560]: [ 8] Checking with Razor Discovery Server
66.151.150.35
Apr 26 09:29:35.770654 check[11560]: [ 6] No port specified, using 2703
Apr 26 09:29:35.770790 check[11560]: [ 5] Connecting to 66.151.150.35 ...
Apr 26 09:29:35.868597 check[11560]: [ 8] Connection established
Apr 26 09:29:35.868949 check[11560]: [ 4] 66.151.150.35 >> 35 server greeting:
sn=D&srl=491&a=l&a=cg&ep4=7542-10
Apr 26 09:29:35.869278 check[11560]: [ 4] 66.151.150.35 << 12
Apr 26 09:29:35.869423 check[11560]: [ 6] a=g&pm=csl
Apr 26 09:29:35.918122 check[11560]: [ 4] 66.151.150.35 >> 32
Apr 26 09:29:35.918295 check[11560]: [ 6] response to sent.1
-csl=?
shock.cloudmark.com
.
Apr 26 09:29:35.918679 check[11560]: [ 8] Discovery Server 66.151.150.35
replying with csl=shock.cloudmark.com
Apr 26 09:29:35.918921 check[11560]: [ 4] 66.151.150.35 << 12
Apr 26 09:29:35.919073 check[11560]: [ 6] a=g&pm=nsl
Apr 26 09:29:35.967729 check[11560]: [ 4] 66.151.150.35 >> 51
Apr 26 09:29:35.967901 check[11560]: [ 6] response to sent.2
-nsl=?
folly.cloudmark.com
joy.cloudmark.com
.
Apr 26 09:29:35.968336 check[11560]: [ 8] Discovery Server 66.151.150.35
replying with nsl=folly.cloudmark.com
Apr 26 09:29:35.968491 check[11560]: [ 8] Discovery Server 66.151.150.35
replying with nsl=joy.cloudmark.com
Apr 26 09:29:35.968636 check[11560]: [ 8] Checking with Razor Discovery Server
66.151.150.36
Apr 26 09:29:35.968799 check[11560]: [ 6] losing old server connection,
66.151.150.35, for new server, 66.151.150.36
Apr 26 09:29:35.968939 check[11560]: [ 5] disconnecting from server
66.151.150.35
Apr 26 09:29:35.969185 check[11560]: [ 4] 66.151.150.35 << 5
Apr 26 09:29:35.969326 check[11560]: [ 6] a=q
Apr 26 09:29:35.969512 check[11560]: [ 6] No port specified, using 2703
Apr 26 09:29:35.969643 check[11560]: [ 5] Connecting to 66.151.150.36 ...
Apr 26 09:29:36.068464 check[11560]: [ 8] Connection established
Apr 26 09:29:36.068976 check[11560]: [ 4] 66.151.150.36 >> 24 server greeting:
sn=L&srl=9000&a=l&a=cg
Apr 26 09:29:36.069320 check[11560]: [ 4] 66.151.150.36 << 12
Apr 26 09:29:36.069464 check[11560]: [ 6] a=g&pm=csl
Apr 26 09:29:36.122734 check[11560]: [ 4] 66.151.150.36 >> 9
Apr 26 09:29:36.123024 check[11560]: [ 6] response to sent.4
err=240
Apr 26 09:29:36.123516 check[11560]: [ 4] 66.151.150.36 << 12
Apr 26 09:29:36.123688 check[11560]: [ 6] a=g&pm=nsl
Apr 26 09:29:36.172863 check[11560]: [ 4] 66.151.150.36 >> 9
Apr 26 09:29:36.173087 check[11560]: [ 6] response to sent.5
err=240
Apr 26 09:29:36.173746 check[11560]: [ 5] writeservers skipping .lst file:
/var/spool/filter/.razor/servers.catalogue.lst
Apr 26 09:29:36.173997 check[11560]: [ 5] writeservers skipping .lst file:
/var/spool/filter/.razor/servers.nomination.lst
Apr 26 09:29:36.174340 check[11560]: [ 6] shock.cloudmark.com is a Catalogue
Server srl 5074; computed min_cf=6, Server se: C8
Apr 26 09:29:36.174663 check[11560]: [ 8] Computed supported_engines: 4 8
Apr 26 09:29:36.174876 check[11560]: [ 8] Using next closest server
shock.cloudmark.com:2703, cached info srl 5074
Apr 26 09:29:36.175346 check[11560]: [ 8] mail 1 Subject: FW: Average Bithecs
big dick action
Apr 26 09:29:36.177541 check[11560]: [ 6] preproc: mail 1.0 went from 2077
bytes to 1910
Apr 26 09:29:36.177832 check[11560]: [ 6] computing sigs for mail 1.0, len 141
Apr 26 09:29:36.201709 check[11560]: [ 6] skipping whitelist file (empty?):
/var/spool/filter/.razor/razor-whitelist
Apr 26 09:29:36.202090 check[11560]: [ 6] losing old server connection,
66.151.150.36, for new server, shock.cloudmark.com
Apr 26 09:29:36.202261 check[11560]: [ 5] disconnecting from server
66.151.150.36
Apr 26 09:29:36.202561 check[11560]: [ 4] 66.151.150.36 << 5
Apr 26 09:29:36.202698 check[11560]: [ 6] a=q
Apr 26 09:29:36.202902 check[11560]: [ 5] Connecting to shock.cloudmark.com ...
Apr 26 09:29:36.305122 check[11560]: [ 8] Connection established
Apr 26 09:29:36.305575 check[11560]: [ 4] shock.cloudmark.com >> 36 server
greeting: sn=C&srl=5074&a=l&a=cg&ep4=7542-10
Apr 26 09:29:36.306132 check[11560]: [ 4] shock.cloudmark.com << 25
Apr 26 09:29:36.306315 check[11560]: [ 6] cn=razor-agents&cv=2.67
Apr 26 09:29:36.306632 check[11560]: [ 6] shock.cloudmark.com is a Catalogue
Server srl 5074; computed min_cf=6, Server se: C8
Apr 26 09:29:36.306949 check[11560]: [ 8] Computed supported_engines: 4 8
Apr 26 09:29:36.307207 check[11560]: [ 8] mail 1.0 e4 sig:
JcFEpNZ_cuc323lYy3TikAzbkPcA
Apr 26 09:29:36.307451 check[11560]: [ 8] mail 1.0 e8 sig: icpFRu2ISpcA
Apr 26 09:29:36.307700 check[11560]: [ 8] preparing 2 queries
Apr 26 09:29:36.308115 check[11560]: [ 8] sending 1 batches
Apr 26 09:29:36.308362 check[11560]: [ 4] shock.cloudmark.com << 80
Apr 26 09:29:36.308520 check[11560]: [ 6]
-a=c&e=4&ep4=7542-10&s=JcFEpNZ_cuc323lYy3TikAzbkPcA
a=c&e=8&s=icpFRu2ISpcA
.
Apr 26 09:29:36.589868 check[11560]: [ 4] shock.cloudmark.com >> 21
Apr 26 09:29:36.590061 check[11560]: [ 6] response to sent.8
-p=0
p=1&cf=100
.
Apr 26 09:29:36.590754 check[11560]: [ 6] mail 1.0 e=4
sig=JcFEpNZ_cuc323lYy3TikAzbkPcA: sig not found.
Apr 26 09:29:36.590984 check[11560]: [ 6] mail 1.0 e=8 sig=icpFRu2ISpcA: Is
spam: cf 100 >= min_cf 6
Apr 26 09:29:36.591183 check[11560]: [ 7] method 4: mail 1.0: no-contention
part, spam=1
Apr 26 09:29:36.591327 check[11560]: [ 7] method 4: mail 1: a non-contention
part was spam, mail spam
Apr 26 09:29:36.591454 check[11560]: [ 3] mail 1 is known spam.
Apr 26 09:29:36.591592 check[11560]: [ 5] disconnecting from server
shock.cloudmark.com
Apr 26 09:29:36.591835 check[11560]: [ 4] shock.cloudmark.com << 5
Apr 26 09:29:36.591965 check[11560]: [ 6] a=q
debug: Using results from Razor v2.67
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: Found Razor2 part: part=0 engine=8 ct=0 cf=100
debug: leaving helper-app run mode
debug: Razor2 results: spam? 1 highest cf score: 100
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-1.04
debug: running full-text regexp tests; score so far=-1.04
debug: Razor2 is available
debug: Current PATH is:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: executable for dccproc was found at /usr/local/bin/dccproc
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 11568: ruid=501 euid=501
debug: DCC: got response: X-DCC-EATSERVER-Metrics: rh1.hospital.womans.com
1166; Body=1 Fuz1=1
debug: leaving helper-app run mode
debug: Running tests for priority: 500
debug: RBL: success for 14 of 14 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8ed9de0) implements
'check_post_dnsbl'
debug: running meta tests; score so far=1.687
debug: running header regexp tests; score so far=1.687
debug: running body-text per-line regexp tests; score so far=1.687
debug: running uri tests; score so far=1.687
debug: running raw-body-text per-line regexp tests; score so far=1.687
debug: running full-text regexp tests; score so far=1.687
debug: Running tests for priority: 1000
debug: running meta tests; score so far=1.687
debug: running header regexp tests; score so far=1.687
debug: running body-text per-line regexp tests; score so far=1.687
debug: running uri tests; score so far=1.687
debug: running raw-body-text per-line regexp tests; score so far=1.687
debug: running full-text regexp tests; score so far=1.687
debug: auto-learn: currently using scoreset 3, recomputing score based on
scoreset 1.
debug: auto-learn: message score: 1.687, computed score for autolearn: 3.467
debug: auto-learn? ham=0.1, spam=12, body-points=3.467, head-points=1.982,
learned-points=-1.096
debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
debug: is spam? score=1.687 required=5
debug: tests=BAYES_40,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET
debug:
subtests=__ANY_OUTLOOK_MUA,__CT,__CTE,__HAS_MIMEOLE,__HAS_MSGID,__HAS_OUTLOOK_IN_MAILER,__HAS_SUBJECT,__HAS_X_MAILER,__IS_EXCH,__MIME_VERSION,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__OE_MSGID_2,__OE_MUA,__OUTLOOK_DOLLARS_MSGID,__SANE_MSGID,__SARE_HTML_HAS_TO
Microsoft Mail Internet Headers Version 2.0
Received: from rh1.hospital.womans.com (spamfilter.hospital.womans.com
[10.1.100.7]) by exch-srv1.Womans.com with SMTP (Microsoft Exchange Internet
Mail Service Version 5.5.2657.72) id FS7ZTZJ7; Tue, 26 Apr 2005 06:41:15 -0500
Received: by rh1.hospital.womans.com (Postfix, from userid 501) id 4124C7F4B1;
Tue, 26 Apr 2005 08:52:44 -0400 (EDT)
Received: from hafad071097.uclm.es (hafad071097.uclm.es [161.67.91.44]) by
rh1.hospital.womans.com (Postfix) with ESMTP id 97E247F4C0 for <[EMAIL
PROTECTED]>; Tue, 26 Apr 2005 08:52:39 -0400 (EDT)
Received: from kegel.com (vroo.pair.com [209.68.1.136]) by hafad071097.uclm.es
with esmtp id C735CD8EB4 for <[EMAIL PROTECTED]>; Tue, 26 Apr 2005 04:40:51
-0700
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: binary
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: FW: Average Bithecs big dick action
Date: Tue, 26 Apr 2005 06:40:51 -0500
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator: <[EMAIL PROTECTED]>
Thread-Topic: Average Bithecs big dick action
Thread-Index: AcVKVNq98wsbTV9BR9+zY7X+R8PUzw==
From: "Toothiest B. Limeades" <[EMAIL PROTECTED]>
To: "ROY,RHETT G" <[EMAIL PROTECTED]>
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
rh1.hospital.womans.com
X-Spam-Level: *
X-Spam-Status: No, score=1.7 required=5.0 tests=BAYES_40=-1.096,
RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511,
RCVD_IN_BL_SPAMCOP_NET=1.216 autolearn=no version=3.0.2
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2800.1437" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>
Haven't we met somewhere before? :)))
<A
href="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.htm";
title="bred">
<BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/jn1GMup/fl0TwXG.jpG";
alt="collaring" border='0'><BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
border=0><BR><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/1CzXjQW/Wn/HZ.gif";
border='0'><br></A>Si jaamaRhonanai
<br>
Hey honey! :)<BR><BR>
<A
href="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.htm";
target="preempts"><BR><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/p5hQt/TMdc5cgpBD.jpG";
alt="hydrants" border='0'><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
alt="optometry" border='0'><BR><IMG
src="http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/h6oLlKL5h/tJ6Uj4eD/b1WC6w.gif";
alt="Libby" border=0><br></A>Ka kite ano
Pleased to meet you!
<BR>
<A
href="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.htm";
title="fretfully">
<br><br>
<IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/G/dtO1H16UtB.jpG";
alt="Ptolemy" border="0"><BR><IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.jpg";
alt="recidivists" border="0"><BR><IMG
src="http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/wvzr/DUk0z/G85YTn.gif";
border='0'><BR><BR></A>Soreja
<br><br>
<A href="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/cTdg7Z.html";
target="woody" title="lama"><IMG
src="http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/do.gif"; border='0'>
</A></DIV></BODY></HTML>
Spam detection software, running on the system "rh1.hospital.womans.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (1.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.1 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.3447]
0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
[cf: 100]
1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?161.67.91.44>]
![http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/jn1GMup/fl0TwXG.jpG"](http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/jn1GMup/fl0TwXG.jpG"){kind=link}
![http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.jpg"](http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/DxEcNBwnEA0LAwAgQAQIDw==.jpg"){kind=link}
![http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/1CzXjQW/Wn/HZ.gif"](http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/1CzXjQW/Wn/HZ.gif"){kind=link}
![http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/p5hQt/TMdc5cgpBD.jpG"](http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/p5hQt/TMdc5cgpBD.jpG"){kind=link}
![http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.jpg"](http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/DxEcNBwnEA0LAwAgQAQIDw==.jpg"){kind=link}
![http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/h6oLlKL5h/tJ6Uj4eD/b1WC6w.gif"](http://magnanimityfd.com/lJTiAP3FcS7tE4kMTwoYLxEQw/h6oLlKL5h/tJ6Uj4eD/b1WC6w.gif"){kind=link}
![http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/G/dtO1H16UtB.jpG"](http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/G/dtO1H16UtB.jpG"){kind=link}
![http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.jpg"](http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/DxEcNBwnEA0LAwAgQAQIDw==.jpg"){kind=link}
![http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/wvzr/DUk0z/G85YTn.gif"](http://magnanimityfd.com/BEKneaJY42yT6e6ZlzDpUqjrO/wvzr/DUk0z/G85YTn.gif"){kind=link}
![http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/do.gif"](http://magnanimityfd.com/K4nPrgLXR7PcC4e9G4YWNeMAq/do.gif"){kind=link}