Here are two of the messages in a more proper form. Again I apologize for the earlier message.
Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College Red Hat Certified Technician (RHCT) -----Original Message----- From: Casartello, Thomas Sent: Monday, November 09, 2009 9:20 AM To: 'rich...@buzzhost.co.uk' Cc: Spamassassin Mailing List Subject: RE: [SPAM:6.0] Spam coming from hotmail. Yeah I should have attached those instead of copying and pasting the Outlook crap. Was pretty stupid, my apologies. Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College Red Hat Certified Technician (RHCT) -----Original Message----- From: rich...@buzzhost.co.uk [mailto:rich...@buzzhost.co.uk] Sent: Monday, November 09, 2009 8:47 AM Cc: Spamassassin Mailing List Subject: Re: [SPAM:6.0] Spam coming from hotmail. On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote: > I’ve been getting a lot of non-scoring spam coming from hotmail over > the last couple weeks. It’s one user that’s been complaining about it. > > Here’s a few samples: {serious ascii murder commited} I could not stop laughing at this given the context... > > ______________________________________________________________________ > Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign > up now.
Received-SPF: pass (hotmail.com: Sender is authorized to use
'toblosas...@hotmail.com' in 'mfrom' identity (mechanism
'include:spf-a.hotmail.com' matched)) receiver=mx1.wsc.ma.edu;
identity=mailfrom; envelope-from="toblosas...@hotmail.com";
helo=col0-omc3-s1.col0.hotmail.com; client-ip=65.55.34.139
Received: from col0-omc3-s1.col0.hotmail.com
(col0-omc3-s1.col0.hotmail.com [65.55.34.139])
by mx1.wsc.ma.edu (Postfix) with ESMTP id A54CB37600A
for <kcout...@wsc.ma.edu>; Mon, 9 Nov 2009 03:52:05 -0500 (EST)
Received: from COL114-W59 ([65.55.34.136]) by
col0-omc3-s1.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 9 Nov 2009 00:49:29 -0800
Message-ID: <col114-w59276e20ff6f4849346832af...@phx.gbl>
Content-Type: multipart/alternative;
boundary="_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_"
X-Originating-IP: [92.124.6.234]
From: oblosas towazoco <toblosas...@hotmail.com>
To: <david-deprosp...@juno.com>, <jlwedge...@msn.com>,
<davedebbiealexb...@msn.com>, <seva...@yahoo.com>,
<diamond.1...@juno.com>
CC: <stacyber...@yahoo.com>
Subject: Afternoon
Date: Mon, 9 Nov 2009 00:49:29 -0800
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 09 Nov 2009 08:49:29.0207 (UTC)
FILETIME=[8C758870:01CA6119]
--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
How are you=2C
If i recollect correctly=2C you weren't feeling well the other week
and I t=
hought you'd want to see
http://www.google.com/reader/item/tag:google.com=
=2C2005:reader/item/bfbff5e0da68bbf1
This store is an internet store with great collections. Immediately
you'll =
know that it's a bargain!
Get better=2C
Gerek
=20
_________________________________________________________________
Hotmail: Trusted email with powerful SPAM protection.
http://clk.atdmt.com/GBL/go/177141665/direct/01/=
--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--></style>
</head>
<body class=3D'hmmessage'>
How are you=2C<BR>
<BR>
If i recollect correctly=2C you weren't feeling well the other week
and I t=
hought you'd want to see <A
href=3D"http://www.google.com/reader/item/tag:g=
oogle.com=2C2005:reader/item/bfbff5e0da68bbf1">http://www.google.com/reader=
/item/tag:google.com=2C2005:reader/item/bfbff5e0da68bbf1</A><BR>
<BR>
This store is an internet store with great collections. Immediately
you'll =
know that it's a bargain!<BR>
<BR>
Get better=2C<BR>
Gerek<BR> <br /><hr />Hotmail: Trusted
email with powerful
SPAM =
protection. <a
href=3D'http://clk.atdmt.com/GBL/go/177141665/direct/01/' ta=
rget=3D'_new'>Sign up now.</a></body>
</html>=
--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_--
Received-SPF: pass (hotmail.com: Sender is authorized to use
'jmouswenf...@hotmail.com' in 'mfrom' identity (mechanism
'include:spf-a.hotmail.com' matched)) receiver=mx2.wsc.ma.edu;
identity=mailfrom; envelope-from="jmouswenf...@hotmail.com";
helo=blu0-omc2-s12.blu0.hotmail.com; client-ip=65.55.111.87
Received: from blu0-omc2-s12.blu0.hotmail.com
(blu0-omc2-s12.blu0.hotmail.com [65.55.111.87])
by mx2.wsc.ma.edu (Postfix) with ESMTP id 530D814002
for <kcout...@wsc.ma.edu>; Mon, 9 Nov 2009 00:27:50 -0500 (EST)
Received: from BLU139-W3 ([65.55.111.72]) by
blu0-omc2-s12.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 8 Nov 2009 21:26:48 -0800
Message-ID: <blu139-w38f3f898e2401a7184b7bcc...@phx.gbl>
Content-Type: multipart/alternative;
boundary="_53a4b5fd-adfc-4fd6-8e9a-5f5944ac93ec_"
X-Originating-IP: [189.69.146.53]
From: Jeffry Mouswen <jmouswenf...@hotmail.com>
To: <mo...@csus.edu>, <nightmareofdre...@gmail.com>
CC: <kcout...@wsc.ma.edu>
Subject: Interested in it
Date: Sun, 8 Nov 2009 21:26:48 -0800
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 09 Nov 2009 05:26:48.0752 (UTC)
FILETIME=[3C435B00:01CA60FD]
--_53a4b5fd-adfc-4fd6-8e9a-5f5944ac93ec_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
What you up to=2C
I just felt compelled to communicate to you about the brilliant new
way I b=
uy my pharmaceuticals.
I found this virtual distributor at
http://LudovicLen.insanejournal.com and=
I believed that you could use it too. They use the right amount of
judicio=
usness and trade in identical items as at your SavOn.
It'll be great when you guys finally purchase their reasonably-priced
stuff=
!
See you soon=2C
Ronin
=20
_________________________________________________________________
Hotmail: Trusted email with Microsoft's powerful SPAM protection.
http://clk.atdmt.com/GBL/go/177141664/direct/01/
http://clk.atdmt.com/GBL/go/177141664/direct/01/
--_53a4b5fd-adfc-4fd6-8e9a-5f5944ac93ec_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--></style>
</head>
<body class=3D'hmmessage'>
What you up to=2C<BR>
<BR>
I just felt compelled to communicate to you about the brilliant new
way I b=
uy my pharmaceuticals.<BR>
<BR>
I found this virtual distributor at <A
href=3D"http://LudovicLen.insanejour=
nal.com">http://LudovicLen.insanejournal.com</A> and I believed that
you co=
uld use it too. They use the right amount of judiciousness and trade
in ide=
ntical items as at your SavOn.<BR>
<BR>
It'll be great when you guys finally purchase their reasonably-priced
stuff=
!<BR>
<BR>
See you soon=2C<BR>
Ronin<BR> <br /><hr />Hotmail: Trusted
email with
Microsoft's po=
werful SPAM protection. <a
href=3D'http://clk.atdmt.com/GBL/go/177141664/di=
rect/01/
http://clk.atdmt.com/GBL/go/177141664/direct/01/
' target=3D'_new'>Sign up now.</a></body>
</html>=
--_53a4b5fd-adfc-4fd6-8e9a-5f5944ac93ec_--
smime.p7s
Description: S/MIME cryptographic signature
