Hello,
Received the following piece of spam today:
<snip>
>From [EMAIL PROTECTED] Sat Sep 13 13:57:20 2003
Received: from hubert.mail.atl.earthlink.net (hubert.mail.atl.earthlink.net
[207.69.200.45])
by sdf.lonestar.org (8.12.9/8.12.8) with ESMTP id h8DDvK5M002072
for <[EMAIL PROTECTED]>; Sat, 13 Sep 2003 13:57:20 GMT
Received: from aaron.mail.atl.earthlink.net ([207.69.200.106])
by hubert.mail.atl.earthlink.net with smtp (Exim 3.33 #1)
id 19yAts-0006Cb-00
for [EMAIL PROTECTED]; Sat, 13 Sep 2003 09:57:20 -0400
X-MindSpring-Loop: [EMAIL PROTECTED]
Received: from off.ne.jp ([141.149.243.21])
by aaron.mail.atl.earthlink.net (Earthlink Mail Service) with SMTP id
19YaTQ6E43Nl3qa0
for <[EMAIL PROTECTED]>; Sat, 13 Sep 2003 09:57:18 -0400 (EDT)
Subject: =?iso-8859-1?b?UmU6VHJ5IFNpbGRlbmFmaWwgQ2l0cmF0ZQ==?=
X-MimeOLE: Produced By Microsoft Exchange V6.0.6509.0
Date: Sat, 13 Sep 2003 13:57:18 +0000
MIME-Version: 1.0
To: [EMAIL PROTECTED]
From: "Gail Walsh" <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
Content-Type: text/html
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, hits=3.7 required=5.0
tests=HTML_80_90,HTML_IMAGE_ONLY_02,HTML_IMAGE_RATIO_02,
HTML_MESSAGE,MIME_HTML_ONLY,MSGID_GOOD_EXCHANGE,
RCVD_IN_NJABL,X_NJABL_DIALUP
version=2.55
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Keywords:
X-UID: 65
<html><body>
<center><!--1a4hh2fkyp1--><a href="http://www.eibs3.com/host/default.asp?ID=omni";><img
src="http://discountrate2.com/pics/gv1.gif"; height="270" width="405"></a></center>
</html></body>
</snip>
When I checked to razor, it seemed to not see the message somehow.
Some snipped verbose output:
<snip>
Sep 13 15:01:20.400351 check[984]: [ 6] truth.cloudmark.com is a
Catalogue Server srl 68; computed min_cf=6, Server se: 58
Sep 13 15:01:20.401196 check[984]: [ 8] Computed supported_engines: 4
Sep 13 15:01:20.401944 check[984]: [ 8] Using next closest server
truth.cloudmark.com:2703, cached info srl 68
Sep 13 15:01:20.402672 check[984]: [ 8] mail 1 Subject:
=?iso-8859-1?b?UmU6VHJ5IFNpbGRlbmFmaWwgQ2l0cmF0ZQ==?=
Sep 13 15:01:20.408217 check[984]: [ 6] preproc: mail 1.0 went from
291 bytes to 0, erasing
Sep 13 15:01:20.409130 check[984]: [ 5] Connecting to
truth.cloudmark.com ...
Sep 13 15:01:20.506269 check[984]: [ 8] Connection established
Sep 13 15:01:20.506964 check[984]: [ 4] truth.cloudmark.com >> 29
server greeting: sn=C&srl=68&ep4=7542-10&a=l
Sep 13 15:01:20.508070 check[984]: [ 6] truth.cloudmark.com is a
Catalogue Server srl 68; computed min_cf=6, Server se: 58
Sep 13 15:01:20.508911 check[984]: [ 8] Computed supported_engines: 4
Sep 13 15:01:20.509620 check[984]: [ 8] mail 1.0 skipped in check
Sep 13 15:01:20.510219 check[984]: [ 5] No queries, no spam
Sep 13 15:01:20.510852 check[984]: [ 5] disconnecting from server
truth.cloudmark.com
Sep 13 15:01:20.511724 check[984]: [ 4] truth.cloudmark.com << 5
Sep 13 15:01:20.512314 check[984]: [ 6] a=q
Use of uninitialized value in numeric gt (>) at
/usr/pkg/lib/perl5/site_perl/5.6.1/Razor2/Client/Agent.pm line 540,
<GEN0> line 1.
Use of uninitialized value in numeric eq (==) at
/usr/pkg/lib/perl5/site_perl/5.6.1/Razor2/Client/Agent.pm line 540,
<GEN0> line 1.
Sep 13 15:01:20.513868 check[984]: [ 8] razor-check finished
successfully.
</snip>
I tried different methods of feeding the message to razor-check, all
with the same results (piped the message to razor from my client,
mutt, cat spam|razor-check --verbose, razor-check --verbose < spam)
...
razor-check seems to at least be picking up the subject, but for some
reason it's missing everything else. My guess is that it's been fooled
by the "Content-Transfer-Encoding:8 bit" header, ever though the
message is actually just plain text. But, I'm probably wrong :) Any
thoughts?
TIA<
Bob
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Razor-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/razor-users
![http://discountrate2.com/pics/gv1.gif"](http://discountrate2.com/pics/gv1.gif"){kind=link}