From: san [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, November 29, 2006 11:33 PM
> To: users@spamassassin.apache.org
> Subject: Stock Spam
>
>
>
> Hi All,
>
> I am recieving lot of stock related spam mails which spam assassin is not
> able catch as spam. I have added Sare_stcok.cf file. I cant use imageinfo,
> fuzzy ocr as iam using 2.6o ver of spam assassin i think. I have enclosed
> the undecoded letter mail of one kind below. Can you plz help me to make
> this kind of mails as spam.
These are the scores it would get on a 3.1.7 + some sare rules:
1.9 MSGID_MULTIPLE_AT Message-ID contains multiple '@' characters
0.8 FH_HOST_EQ_D_D_D_D Host starts with d-d-d-d
0.9 FH_HOST_EQ_D_D_D_DB Host is d-d-d-d
3.8 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr
2)
1.6 FH_HELO_EQ_D_D_D_D Helo is d-d-d-d
1.1 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
[SPF failed: Please see
http://www.openspf.org/why.html?sender=how%40sotelrostov.ru&ip=84.120.14.114&receiver=ns2.edlui.it]
0.1 TW_YD BODY: Odd Letter Triples with YD
0.1 TW_VP BODY: Odd Letter Triples with VP
0.1 TW_TV BODY: Odd Letter Triples with TV
0.4 HTML_30_40 BODY: Message is 30% to 40% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
2.2 TVD_FW_GRAPHIC_ID2 BODY: TVD_FW_GRAPHIC_ID2
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[84.120.14.114 listed in dnsbl.sorbs.net]
3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[84.120.14.114 listed in sbl-xbl.spamhaus.org]
2.0 FM_DDDD_TIMES_2 Dual helo + host eq d_d_d_d
I have fuzzyocr, but it doesn't even need to be invoked: this mail scores
enough to be just thrown away...
> X-Real-To: anyname
> Return-Path: <[EMAIL PROTECTED]>
> Received: by some.com (CommuniGate Pro PIPE 5.1.1)
> with PIPE id 1368603; Mon, 27 Nov 2006 17:39:57 -0600
> Received: from [EMAIL PROTECTED]
> by mail.seatoncorp.com (CommuniGate Pro GROUP 5.1.1)
> with GROUP id 1368364; Mon, 27 Nov 2006 17:38:31 -0600
> X-Autogenerated: group
> Received: from 84-120-14-114.onocable.ono.com ([84.120.14.114] verified)
> by some.com (CommuniGate Pro SMTP 5.1.1)
> with ESMTP id 1368200 for [EMAIL PROTECTED]; Mon, 27 Nov 2006
> 17:37:50 -0600
> Received-SPF: neutral
> receiver=some.com; client-ip=XX.XX.XX.XX;
> [EMAIL PROTECTED]
> Received: from [131.121.84.151] (port=5734 helo=JMfieKIKDzZ)
> by qMfMKKYkDTw with asmtp
> id bhqPeb-KhbbzT-07
> for [EMAIL PROTECTED]; Tue, 28 Nov 2006 00:38:20 +0100
> Date: Tue, 28 Nov 2006 00:37:46 +0100
> From: "reserved" <[EMAIL PROTECTED]>
> X-Mailer: The Bat! (v3.0) Professional
> Reply-To: [EMAIL PROTECTED]
> X-Priority: 3 (Normal)
> Message-ID: <[EMAIL PROTECTED]@some.com>
> To: [EMAIL PROTECTED]
> Subject: Delay Albert Strategist
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----------305E3064BA67"
> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
> evg60ms_email.seatoncorp.com
> X-Spam-Status: No, hits=4.1 required=4.5 tests=HTML_20_30,HTML_MESSAGE,
>
> HTML_TITLE_EMPTY,RATWR9_MESSID,SARE_MSGID_DBL_AT,Seaton_Signup,TW_TV,
> TW_VP,TW_YD autolearn=no version=2.60
> X-Spam-Level: ****
> X-TFF-CGPSA-Filter: Scanned
> X-TFF-CGPSA-Version: 1.2.5
>
> ------------305E3064BA67
> Content-Type: multipart/alternative;
> boundary="----------EF0BA740CEFEF7D2"
>
>
> ------------EF0BA740CEFEF7D2
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> Hoffman head rands office leading expert returns think. Eroding getting,
> steeper say! Older americans improved shows, findings good? Sd encoder
> simple styles videowave sorry. Half awardsjune social delivery systems far
> apart, medicare. Easy dvdit, pro mydvd essentials premeier photosuite,
> primetime.
> Copy inc, all rights reserved privacy use press gt.
> Charles deborah hensler, becomes senior fellow. Reassuring individual alan
> charles deborah hensler becomes. Urge equals between trustees elects.
> Unless accept following terms provided site are.
> Elects paul reform act fails slash delay albert strategist. Rom formatter
> roxio creator? You can get yearmore than gift. Clare ellinger director,
> human, sentencing laws undermine control goals. Angeles mayor richard
> riordan deliver launches. Firm memo financial reporters. Training
> admissions
> people life after. Trends indicate need natalie.
> Accept following terms provided site?
> Service wide range private venture is. Admissions people life after events
> calendar?
> Minimums strategy curbs crimemay writers re icj economic! Economy eroding,
> getting, steeper say trends indicate need. Pricestips tvpopular networks
> pswiixbox, pussycat dollsfree!
> On, amp, trickscnet, tvcompare prices plustm shields.
> Results both reassuring individual. Bust ignore continuing many countries
> term.
> Bf log, in sign upwhy.
> Impact class action tobacco lawsapril that heart.
> High grades india pakistan nuclear explosions, were detected.
> Chairjune ticking, time bomb, shrink commission urges. Burnersdvd
> toolshome
> toolsmedia find the, perfect gadget. Cebit support enterprise affiliate
> program legal leader decoder.
> Slight previous estimates greatly overstate effects.
> Way as do obtain ownership right. Public safety science technology. Moment
> will be redirected to latest version of. Technology, substance abuse
> terrorism homeland workforce workplace, current!
> ------------EF0BA740CEFEF7D2
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <HTML><HEAD><TITLE></TITLE>
> <STYLE type="text/css"><!--
> BODY {
> margin: 5px 5px 5px 5px;
> background-color: #FFFFFF;
> }
> /*----------Text Styles----------*/
> HR { color: #000000}
> BODY, TABLE /* Normal text */
> {
> font-size: 9pt;
> font-family: 'Courier New';
> font-style: normal;
> font-weight: normal;
> color: #000000;
> text-decoration: none;
> }
> SPAN.RVTS1 /* Heading */
> {
> font-size: 10pt;
> font-family: 'Arial';
> font-weight: bold;
> color: #0000FF;
> }
> SPAN.RVTS2 /* Subheading */
> {
> font-size: 10pt;
> font-family: 'Arial';
> font-weight: bold;
> color: #000080;
> }
> SPAN.RVTS3 /* Keywords */
> {
> font-size: 10pt;
> font-family: 'Arial';
> font-style: italic;
> color: #800000;
> }
> A.RVTS4, SPAN.RVTS4 /* Jump 1 */
> {
> font-size: 10pt;
> font-family: 'Arial';
> color: #008000;
> text-decoration: underline;
> }
> A.RVTS5, SPAN.RVTS5 /* Jump 2 */
> {
> font-size: 10pt;
> font-family: 'Arial';
> color: #008000;
> text-decoration: underline;
> }
> /*----------Para Styles----------*/
> P,UL,OL /* Paragraph Style */
> {
> text-align: left;
> text-indent: 0px;
> padding: 0px 0px 0px 0px;
> margin: 0px 0px 0px 0px;
> }
> RVPS1 /* Centered */
> {
> text-align: center;
> white-space: normal;
> }
>
> --></STYLE>
> </HEAD>
> <BODY>
>
> <P> cid:9DA8A230.A858D7B9.28ECE30B.B80A31AB_csseditor </P>
> <P>Hoffman head rands office leading expert returns think.
> Eroding getting,
> steeper say! Older americans improved shows, findings good? Sd encoder
> simple styles videowave sorry. Half awardsjune social delivery systems far
> apart, medicare. Easy dvdit, pro mydvd essentials premeier photosuite,
> primetime.
> Copy inc, all rights reserved privacy use press gt.
> Charles deborah hensler, becomes senior fellow. Reassuring individual alan
> charles deborah hensler becomes. Urge equals between trustees elects.
> Unless accept following terms provided site are.
> Elects paul reform act fails slash delay albert strategist. Rom formatter
> roxio creator? You can get yearmore than gift. Clare ellinger director,
> human, sentencing laws undermine control goals. Angeles mayor richard
> riordan deliver launches. Firm memo financial reporters. Training
> admissions
> people life after. Trends indicate need natalie.
> Accept following terms provided site?
> Service wide range private venture is. Admissions people life after events
> calendar?
> Minimums strategy curbs crimemay writers re icj economic! Economy eroding,
> getting, steeper say trends indicate need. Pricestips tvpopular networks
> pswiixbox, pussycat dollsfree!
> On, amp, trickscnet, tvcompare prices plustm shields.
> Results both reassuring individual. Bust ignore continuing many countries
> term.
> Bf log, in sign upwhy.
> Impact class action tobacco lawsapril that heart.
> High grades india pakistan nuclear explosions, were detected.
> Chairjune ticking, time bomb, shrink commission urges. Burnersdvd
> toolshome
> toolsmedia find the, perfect gadget. Cebit support enterprise affiliate
> program legal leader decoder.
> Slight previous estimates greatly overstate effects.
> Way as do obtain ownership right. Public safety science technology. Moment
> will be redirected to latest version of. Technology, substance abuse
> terrorism homeland workforce workplace, current!</P>
> </BODY></HTML>
> ------------EF0BA740CEFEF7D2--
>
> ------------305E3064BA67
> Content-Type: image/gif; name="Good Families.gif"
> Content-Transfer-Encoding: base64
> Content-ID: <9DA8A230.A858D7B9.28ECE30B.B80A31AB_csseditor>
>
> R0lGODlheAH8AIcJAAAFAHsLAACKB46FAAAGgHwIgwB3jcrLxr/OvJ/V7UIeAGoXDI
> geAqgaCs4m
> CNMfCAsyABQ7AEAyAFsxAHg0AKE8C8RBAO07BwBkACdZCEhXAF1gDnNrDpphCcZUB+
> RlAwtyACaH
> AEaMCmGJAHuBAJuEALV/DuCLAACnABuiADOnAGeaCnKUAJSeALmbBN+pAAKyBRnHAE
> y5AG7OCHvO
> AJe0ALa7BN2yDADgChPSDD7qAGXUDYjZDaHpDMPkB9LUAgQARyADOjYBS2wFTYcBNK
> cATMYANtEN
> TQsiPyYqPk4hNF4cQ4cmPK0fNMsWNd0cPQhCORZNNjNOPWFJNnFCRpE8NcVNQ9tCSQ
> RYPR1uTD5j
> OmVrRYhTB6xSTcdkSNhhNAB5RiWBR0p/QlFzSXaGM5t4NrFyNO6ORg6gPBiuQTyWPG
> OuTYOZPq6t
> RMWsTumnRwu4RCS2SkayS2LDQIjNRqazM7rKR9XHNQ3SSCfrQULYPlHRSHHjQJnuMr
> jeP9XnPgMD
> jB4AfDkAemMNiIMEeZwAh8gGe+0Afg0cch8peDkajloehnoqhasYe8EteNIZjABJcy
> dGfEk8cmJC
> gYNGh545eMtEe9dIgABqjSRSdUFsg2Nbjn5XfaFSerxuc9hZdwGFhRWBjj+Kell5ho
> KBiZ+KhLyC
> geV5cgCoiSSljEKUi2ujcoGhjJaffMSdhdiacgK/gCXLh0nKd2e1h3K0cqy7dsq3i9
> G4gADfcSDc
> gTHYdGjaeHHZgqDfgsLSeOPlggAAsRwGvUsAwF4At3QAwKkLuMoAuuwAugkXtSUdvT
> UXuG4SuXIi
> uZ8gyLYUvu0RyABGwCtMtkM4v1ZIunVNxpdNw7pCxNU1xABguhxYuT1bwlNTyIVbxK
> 5bwbxutexa
> tACCwS1ywzeHxFt6wIeItqx7uMmLuuKAzgmuwxmfu0KlwmSszICYvZmRvMCiuNyftA
> 27uBG2yjy5
> xmi1tH3CxavMxf/t5Jipo4GAef8BAAD/Cvz7DAAN//8A/wD///v+/yH5BACjn9cALA
> AAAAB4AfwA
> Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNqzGivo8ePIEOKHEmypMmTKF
> OqXMmypcuX
> MGPKnEmzJs2NOHPq3Mmzp8+fQIMKHUq0qNGjSJMqtWizqdOnUKNKnUq1qtWrWLNq3c
> q1q9evMZeK
> HUu2rNmzGsGqXcu2rdu3NdHKnUu3rt2gcPPq3cu3r9W7gAMLHky4sOHDiBMrXsy4sW
> OxfiNLnky5
> sr3HmDNr3jwwQICCnv95Hj1aNOnPnVETDI3wtMDTrmEfdJ3aIOvXtG3Lxq3bdG/OwA
> nf5j28Nm/j
> x2erLs58uWrTzlGXXi19ePHkvrNTx349uPe6t1l3/w//PHt37MpBO9/OnnT78gmtV/
> 9tHv73+3LJ
> o0/efD/y1uXp519oBK53XnrGXSfggfg1KNaCsH0mIHUMaocgchNuV2BtFVLo3n7yde
> jgiBi55Jk9
> J3aUIkgprshiACiRJpKLKMJY40c0qghjizaeuOJpM9qo45AvFmnZkUimNNGGA354YU
> MKBuhkk9pt
> GOWTvl3JHolc7mTijkLmeOOYIYlZEo1o9igkmTiC2aaPaxJppEdwlhmnmUnmmSRF01
> Hp50P9bSmf
> etxNFyihGsJ3aJeMKtWnhf9pGd96iEYaXWrzUYjbc+NxSimI9g36X6OkvjTam0CmOS
> dJQNq5Kput
> yv9J55qwjRThizK6qquseOrp66/ABivssMQWa+yxyL5E6rLMNuvss9Daley01FZr7b
> XYZqvtttx2
> a1lEAghAULjjihvuuef+Q2656qKbrkHrsuuuuAzFO6+97woUr770RuuvXPji2y5CAg
> 9cb78DkVuw
> QvsWtO7D9DZs8L8UmwUxxPwS3C/GB8NrLsISJ5yvwxtHbLLHFafMU0vhdoSuywLATF
> LLLct8Us0f
> 0RyzRziP1HPOO9tTs84i/ezt0W1JdPHJ7c5bLsj3HiSxwlAvFPK+GF+NsMpcG0V1xh
> xrXHXHJE8c
> ctkoP/1x0yV37fZR6PK7sNRYb60xyk6TzS7D74b//fbfQMXNtsgJfZ2x3oSfXbjdig
> /MceOAR26Q
> Sy8LfS7PQYOE89CZz9y55aCv9LPRQNtMOtKoI3k55kGfvvnOp4fUM+csjf556aHTnv
> ruYFFUt9px
> N0x13nQLPvHBgjde99ySN+/889CXyPv01Fdv/fXYyxT99twflP334Icv/vjkl2/++R
> 51r3736Lfv
> vkvrxy///PRX/P79+JdU//5d5+///wAMoAAHSMDs8e+ACEygAhdTwAY68IEQRNYCJ7
> isCFqQdxTM
> YJcuyMEOevCDIAyhAzVIQgeJ8ITJKqEKV8jCFrrwhVxCoV8+8AGV0JB3N6QMAHa4Q7
> fk8Ic1pKEQ
> /2tojyEG0YggMeIRO5LDIg7RiU9sIhOjKESPPHGKVQyJEqE4RShm8SNSvKITrUhEmI
> hxi1iUYhfH
> OMYtAtGLaoTjGt/YFYnscC40FEge/5HHPQ7EjwQB5B8/UJA9GpKQgUTkIBNpED8eUo
> +IFCQfFQnJ
> SCpSkpBc5CQzyUmKPFKTnTzIJ/tIyU1uEpOaJKUpV2mXOxqEhwAQCCx5KEtYDsSW/5
> hlLXeZy1im
> 0pKsDGYoQTnITzLymMM0JSBVKUxBDnGVmHQkJUlJTWke0pnTvKQ2RQlMZRJSks8U5j
> GrWchSzsWV
> BHHlHdcZS3by8pbt9KU7e/nOShrRntpcpjknKf9EZIIznNiUZiiZ+c9+8vOb22xkQj
> Mp0FMC06DI
> hOZC/alES0JUohf9JT8VChh0wnOX7pynOm050lp6VKFKTCYoo7nPhkZUnN4cKEIzOk
> xyqtSlDtVo
> SllKUWIipKLdLKdPy2lQmqLyLCelJz1DGk+QyrOpSsXlTyuq0k7ylKhB9SkqR5nNnH
> KUkeEUJ06Z
> GVNscrOnVU1kSptZ1H1qNaNH/UlLevgRuvbwrgCwB147sle95tWueeVrYAWrRSI2MY
> 5kTGxhk2jY
> xjL2sSKhIxvpGEc1ArGMiA2jY9k42SW2sYyQ1SwYQbvGOWKWtG+s7GYTK1rJzFKwgP
> WrbF8L277/
> 0lW2HrmtYg+LRCQqlrFULG1vh1tF357xi7wFbnEbe9qRaPa5nU1jaQtrWdResbW8De
> 5nr7ta004X
> WbpdSXgjiNjxlfcvREmqQ9SLwLimzL0wjK9850tfurA3nb6sr34HMldYsmS8IQEwSv
> KRj44Q2MAF
> JrCCE1xgexx4wQeWIQQFjBIK53awLImwhhkMkg07uMEStmB4YztLwPLwwrHFbUo8/O
> EWd1jBCA4x
> B/2L273aOLC2/SuOMTxgCG8Yxh6J8IeBLGPzVWSkJWWqU5dMER8TWCBPNkiU/zHl/f
> bvJSbe8Wx1
> TFgS83glTm6wkIMM5DEXOYK3TTOXc1xjLqtY/yUsdjGZY2zmM5MvIrr86JLZSUuTPr
> WeDonylH1M
> 5XxA2dCEtnLKaGJhOzv6LY2+SpgnTWkIP/rSmM60/hTNabMQ6xCHoAqoqzJqTQuLti
> CJtKhD7RFQ
> lzokrma1PWItkleX5NWxLrWrO2LrWcva1L5KsVty7Wte/9rYyNb1sYv9kV7vGtahHr
> W0j91rYCfJ
> yznO8oWbQmtkM7vZrHY2tZdd7XKHO9rPBkm1rb0WPP+5z/PkZUk3EuuBgFog9zZIvQ
> mSb34fQt//
> Lki/7R3wf7ja4AX3d6fn8l8aq/nNJZZKt5UNbW9/G9ytzjWux11rdP963ezWIY8frl
> tV04TWFP9X
> 97ktrvKKtxzj0J52xkOepxEPtq+EbfNTUL5yZlMc5BdnOcvXLfON0/zaI7/5jrWd85
> oQ29hGh/q5
> uw3zmYM76i9PN9CP/r6tz8TrNgE7188n9piU3ezLHrva106shbt9M/c959tV1nAaj8
> TkqUb1TBr9
> 5S+z/Xomx3uA/R4TC9td8H/3Ft8dfmKdD76ujWd85Ccv7L/WVa+J55a7+1yQeX/U8/
> g9CJ/lDdV4
> KzWXqJel6ufuLJjglc1+pTzhS+7fh2+59oSHbW1zn3nqjdfLObd73re9ZeLjvOl3x3
> xue68tdwM6
> qqXP733RmWTpv/v6oU9n6lfP+shJtfO4zPP/6V+Z317S0qN5liq8rX/S8ne/UV1BfE
> rkv3zmz5j3
> /aV//e3frff7//8AWBj8N4AqEYAGuBEEmIAmcYAMeBEK+IAQGIGb1oAUGBESeIEY+I
> AVuIEc2IFp
> kYEgGIIiOIKm5oEmeIIomIIqmBAk2IIuqGkrGIMySIEvWIM2eIM4mIM6uIM8+BYz+I
> MGwQ9CKIQC
> MYREWIRGyA8DMYRLqIT/QIRG+IRHeIRSyIQEYYVQmIRSiIRcWIVUiIRW6IVZeIVaCI
> ZkyIRJqIRl
> 2IVAKBAsIYQdAYdwaA9zOIcgMYQeIYf8kId7SId12Id2GBJ46IeE+BF/GId7GIh3CI
> iMuIiG/9iH
> iwiJijiJjYiIPTgSh3iIhfiIhWiEnOiHeriJIuGJofiJmQiJgliJlPiJnKiJfOiIli
> iKIxgRZTiF
> TriGY1iFBWGLY/iFQYiGahiFYIiLYdiEXViLTjiMyZiLXqiMbGiLbUgR0EiMv7iFuk
> iGXBiFWeiL
> 2xiMv5iG1XiGVMiNyWiN2OiLW0iOxmiObfiGjViKspiGiTiIsaiH8LiKpIiKiJiGqe
> iIdriKr/iI
> SeiP+viPldiCtHiL3miN6piNC8mQCqmQbHiMzIiN7LiO6wiNFjmR5qiODYmO0fgP7j
> iIBgmKeFiS
> p1iK9DiQpmiPK3mQLMmKLjmTJnmP80iSA/8Zk7J4iTzZkz75k0DpgyHJgEHJfJpokJ
> IYkzmZlLCY
> kif5jjrJh0gZi1K5j1KZlAdplZvoifWojya5j0+ZjwGpiDAIERo5jg3JkWi5ixKZju
> UIkRfJlhTZ
> lk0YkRRphheJhW15lm+pkRi5lnfpdu7YlZYYiCUJi/GoivOYiq7Yj68olgK5lK34lJ
> G4mIa5mDsZ
> kFS5lUyZmZgmEfK4jA/ZkW8phugYms74l8K4kW5ZkaZZkd2Yl8DIjrxYmhg5kWiJjG
> /XEqH5mKh4
> mDLplb2ZmcDpmIV5kwVpmZh5nF85mfDYifSImJvJmWPplZkGmvKojIAZl9tZl7rJln
> 4Zjg7/2Yzn
> 6I1f2IvF2JqjWZsHcZp9KZoZaZsN6JfbeZ7veZvxiZ/TKJ+ByYtymZ9weY3xuZflCJ
> LuKZ7daYL0
> CZ9qqY0M+p+5OZvqaaBh6J+sGaEDCqEYypreGZ7PyKAgOZQiOqIkSndF+ZklmqIquq
> Is2qIu+qIw
> GqMVeKI0WqOoI6OdZqM6uqPYgqM++qNAGqRCqqI8WmRDeqRImqRKKhFFKmNL+qRQGq
> VI2qRUWqXA
> IqUrZKVauqVcypNY+qVgKi1dOqZk6hZheqZoShZluqZsWkdpukBtGqdyShVvCqdzeq
> d4ehN1mkB5
> WkB7yqd9GqiCihJ/ikCDGkCFmqiK+oGHN+o/i/qokBqpkjqplPpCjXqpmJqp91Op7K
> OpnvqpoGo9
> nDqqpFqqpnqqqAp/obqqZJqqrhqmAQEAOw==
> ------------305E3064BA67--
>
>
> --
> View this message in context:
> http://www.nabble.com/Stock-Spam-tf2728271.html#a7609498
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
