RE: [SAtalk] Finding a rule to catch a particular spam

Wed, 07 Jan 2004 15:21:12 -0800 

Here they are, I hope they've extracted OK. So does anybody have a way of
catching them?

Thanks,
Geoff

> Yes you may post the spam. Is it the white image with a doctor standing
> there looking like G.W.Bush contemplating his exhistence? The one selling
> 6
> kinds of Mr. Wiggly enhancing drugs?
>
> If so......I'm working on it :)
>
> --Chris
>
>> -----Original Message-----
>> From: Geoff Soper [mailto:[EMAIL PROTECTED]
>> Sent: Wednesday, January 07, 2004 11:26 AM
>> To: [EMAIL PROTECTED]
>> Subject: [SAtalk] Finding a rule to catch a particular spam
>>
>>
>> I'm getting two spams quite frequently and wondered how I can
>> find a rule
>> to catch them (assuming one already exists)? There's no
>> obvious phrase I
>> can catch them on, they are HTML with a single image and are
>> getting low
>> scores. Do I post an example of them here? If so then how do I extract
>> them correctly? I use SquirrelMail and Outlook Express.

X-POP3-From:    [EMAIL PROTECTED]
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Wed, 31 Dec 2003 08:16:10 +0000
Received: from xxxx by bismuth.webfusion.co.uk with local (Exim 3.36 #1)
        id 1AbbWU-0001GG-00
        for [EMAIL PROTECTED]; Wed, 31 Dec 2003 08:16:10 +0000
Received: from server16.donhost.co.uk ([81.21.65.152])
        by bismuth.webfusion.co.uk with smtp (Exim 3.36 #1)
        id 1AbbWS-0001G3-00
        for xxxx; Wed, 31 Dec 2003 08:16:08 +0000
Received: (qmail 83699 invoked by uid 68); 31 Dec 2003 08:16:08 -0000
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 83621 invoked from network); 31 Dec 2003 08:16:06 -0000
Received: from unknown (HELO on-luebeck.de) (209.78.19.203)
  by server16.donhost.co.uk with SMTP; 31 Dec 2003 08:16:06 -0000
Date: Wed, 31 Dec 2003 08:14:56 +0000
MIME-Version: 1.0
To: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
Subject: =?iso-8859-1?b?UmU6TmV3cyBMaW5lOiBDbGluaWNhbCB0cmlhbCByZXN1bHRz?=
From: "Bobbi Galvan" <[EMAIL PROTECTED]>
Content-Type: multipart/alternative;
        boundary="----=_NextPart_000_08A1_AEEE6C93.DD6E3087"
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on 
        bismuth.webfusion.co.uk
X-Spam-Status: No, hits=2.3 required=5.0 tests=HTML_60_70,HTML_IMAGE_ONLY_02,
        HTML_MESSAGE autolearn=no version=2.61
X-Spam-Level: **

This is a multi-part message in MIME format.

------=_NextPart_000_08A1_AEEE6C93.DD6E3087
Content-Type: text/plain;
        charset="us-ascii"
Content-Transfer-Encoding: 8bit




------=_NextPart_000_08A1_AEEE6C93.DD6E3087
Content-Type: text/html;
        charset="us-ascii"
Content-Transfer-Encoding: 8bit

<html><body>
<center><!--lekb4r3ysdkyw--><a 
href="http://www.hw3456.com/ghr/?aff=2&cac=mas3";><!--sr1I1g4a0lkj--><img 
src="http://www.bay4545.com/g9.gif"; border=0></a></center>
</html></body>



------=_NextPart_000_08A1_AEEE6C93.DD6E3087--



X-POP3-From:    [EMAIL PROTECTED]
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Sat, 03 Jan 2004 13:25:03 +0000
Received: from xxxx by bismuth.webfusion.co.uk with local (Exim 3.36 #1)
        id 1Aclm3-0007iy-00
        for [EMAIL PROTECTED]; Sat, 03 Jan 2004 13:25:03 +0000
Received: from server16.donhost.co.uk ([81.21.65.152])
        by bismuth.webfusion.co.uk with smtp (Exim 3.36 #1)
        id 1Aclm1-0007ir-00
        for [EMAIL PROTECTED]; Sat, 03 Jan 2004 13:25:02 +0000
Received: (qmail 71278 invoked by uid 68); 3 Jan 2004 13:18:21 -0000
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 71154 invoked from network); 3 Jan 2004 13:18:13 -0000
Received: from unknown (HELO gmcc.ab.ca) (69.160.23.61)
  by server16.donhost.co.uk with SMTP; 3 Jan 2004 13:18:13 -0000
From: "Sylvester Herron" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
MIME-Version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
Date: Sat, 03 Jan 2004 13:16:44 +0000
Message-ID: <[EMAIL PROTECTED]>
Subject: =?ISO-8859-1?b?TGV0IHVzIGZpbGwgeW91ciBwcmVzW2NyaXB0aW9ucyEgVG9kYXkh?=
Content-Type: multipart/alternative;
        boundary="----=_NextPart_000_049B_920A456F.0F1CBD1D"
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on 
        bismuth.webfusion.co.uk
X-Spam-Status: No, hits=3.8 required=5.0 tests=FORGED_OUTLOOK_TAGS,HTML_70_80,
        HTML_IMAGE_ONLY_02,HTML_MESSAGE,MANY_EXCLAMATIONS autolearn=no 
        version=2.61
X-Spam-Level: ***

This is a multi-part message in MIME format.

------=_NextPart_000_049B_920A456F.0F1CBD1D
Content-Type: text/plain;
        charset="us-ascii"
Content-Transfer-Encoding: 8bit




------=_NextPart_000_049B_920A456F.0F1CBD1D
Content-Type: text/html;
        charset="us-ascii"
Content-Transfer-Encoding: 8bit

<html><body>
<center><!--oq76rjy68zz--><a 
href="http://www.5757fj.com?rid=1099";><!--srSEIod1QDNb--><img 
src="http://www.induction3.com/c2.gif"; border=0></a><br><a 
href="http://www.atlast7.com/r.php";><br><img 
src="http://www.lexrtrt.com/r.gif"; border=0></a></center>
</html></body>


------=_NextPart_000_049B_920A456F.0F1CBD1D--

Reply via email to