This is an interesting one.
If you look at the HTML source, you'll see a PGP signature in an all white
font. Clearly this is an attack on SA and similar programs. Thankfully,
they made the rest of the message spammy enough that it was still over the
threshold by a wide margin. They also went to great pains to prevent a spam
phrase filter from matching.
I am continually astonished at how determined spammers are to deliver their
mail to those who go to such pains to block it.
Darren
-----Original Message-----
From: Lily Singh [mailto:[EMAIL PROTECTED]
Sent: Thursday, 19 June, 2003 08:05
To: [EMAIL PROTECTED]
Cc:
medcations online with no prior prescription
---- Start SpamAssassin results
19.80 points, 6 required;
* 4.3 -- Bulk email software fingerprint (eGroups) found in headers
* 2.7 -- BODY: Online Pharmacy
* 0.1 -- BODY: Message is 60% to 70% HTML
* 3.0 -- BODY: Bayesian classifier says spam probability is 90 to 99%
[score: 0.9786]
* 0.1 -- BODY: HTML font color is red
* 0.1 -- BODY: HTML has very strong "shouting" markup
* 0.3 -- Date: is 3 to 6 hours before Received: date
* 3.0 -- Recipient list is sorted by address
* 0.8 -- RBL: Received via a relay in dnsbl.njabl.org
[RBL check: found 201.46.165.200.dnsbl.njabl.org., type:
127.0.0.9]
* 4.3 -- RBL: Received via a relay in opm.blitzed.org
[RBL check: found 201.46.165.200.opm.blitzed.org., type:
127.1.0.6]
* 0.1 -- Message has X-MSMail-Priority, but no X-MimeOLE
* -2.3 -- Contains a PGP-signed message
* 0.0 -- Asks you to click below
* 0.1 -- Message only has text/html MIME parts
* 0.0 -- Message looks like Outlook, but isn't
* 3.2 -- HTML comments which obfuscate text
---- End of SpamAssassin results
The original message did not contain plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
--- Begin Message ---
order confirmation. your order should be shipped by January, via fedex. your
federal express tracking number is trouser.
thank you for registering. your userid is: bleach
Order Prescription Medications Online. Shipped To Your Door OVERNIGHT! No
Prescription Needed!
Cl <http://www.medz.biz> ick Here
<http://www.medz.biz> <http://www.medz.biz>
<http://www.medz.biz> <http://www.medz.biz>
<http://www.medz.biz> <http://www.medz.biz>
click here <http://www.bizminder.biz/rxgone.php> if you would not like to
receive future mailings.
-----BEGIN PGP SIGNATURE----- version: pgpfreeware 6.5.2 for non-commercial
use ksie8fg4j8r7m3s9od5h2ixrqheaqqa3ysepsq0xzdhzuvskfdktfpe9xs4fhqs
wacj49dk6u883sxo4kb9u6/jnjdx6cjqnzxpetxk9b2dogll/c/60hwrpn+vujdu
xav65sop+px4knaqcciecamqj7ugcsw+cqmpnbxwyatymjafkbkh1eulc2vrwdmd
cjdi57fh43ks9cm78h4t -----END PGP SIGNATURE-----
--- End Message ---
