One of our users here sent me a spam that got through. (The raw message is
included as an attachment) It only scored 0.9 One thing that stood out were
some of the headers: "X-Company_ID: 12444" and "X-Campaign: 29ed298423"
My questions are:
Should X-Company_ID and X-Campaign be considered definate spam-sign?
How often do you see these headers?
Do you or somebody you know have a rule for this? (I write regex the same
way I write aramaic... It just never works out, lol)
Thanks in advance for any help.
J.C. Blouin
[EMAIL PROTECTED]
++++++++++++++++++++++++++++++++++++++++
+ If the only tool you've got is an +
+ axe, every problem looks like fun! +
++++++++++++++++++++++++++++++++++++++++
P.S. Sorry for any oddities in this mailing, btw... the weather during
spring in new england fluctuates more than the NASDAQ, and that wreaks havoc
on my body. If anybody can recommend a cold remedy that actually works, but
doesn't make me all loopy & insane-like, please, PLEASE let me know. ;)
>From an older postfix-group post:
>There are quite a few if you closely scrutinize the headers. Here's
>a few that have seemed useful in filtering here, at least at some
>point; change the "Q-" to an "X-" (so as to avoid running into other
>people's body checks.)
>
>
> ^X-ClickitTarget:
> ^X-Advertisement:
> ^X-Campaign:
> ^X-Mailer: [KQ]I[0-9][0-9]*
> ^X-Ezauth:
> ^X-M.*:.*diffondi
> ^X-Mailer: mail bomber
> ^X-Mailer: X-Mailer:
> ^X-Message-ID1:
> ^Complain-To:
> ^X-MB-(M|P)id:
> ^X-Mailer: OutLook Express 3.14159
> ^X-Mailer: Novasoft Sagittarius Professional
> ^X-Stormpost-To:
> ^X-Mailer: StormPost
>
>
> Some of these spamware IDs might now be obsolete, YMMV.
Received: from mail by internalmail.ourdomain with SMTP (Microsoft Exchange
Internet Mail Service Version 5.0.1460.8)
id H25F4VB3; Wed, 24 Mar 2004 09:53:53 -0500
Received: by mail.ourdomain.com (Postfix, from userid 33343)
id A94A2146CE2; Wed, 24 Mar 2004 09:51:46 -0500 (EST)
Received: from mkt7.verticalresponse.com (mkt7.verticalresponse.com
[209.66.113.62])
by mail.ourdomain.com (Postfix) with SMTP id 36BAE146C87
for <[EMAIL PROTECTED]>; Wed, 24 Mar 2004 09:51:26 -0500 (EST)
Received: from o.vresp.com (192.168.0.8)
by mkt7.verticalresponse.com with QMQP; 24 Mar 2004 06:50:14 -0800
From: "Michelle Wages" <[EMAIL PROTECTED]>
Reply-To: "Michelle Wages" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: You Are Invited!
Date: Wed, 24 Mar 2004 14:50:14 +0000
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Company_ID: 12444
X-Campaign: 29ed298423
Content-Type: multipart/alternative;
boundary="__________MIMEboundary__________"
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
mail.wittmann-ct
X-Spam-Level:
X-Spam-Status: No, hits=0.9 required=5.0 tests=EXCUSE_14,HTML_50_60,
HTML_FONTCOLOR_RED,HTML_MESSAGE,MIME_HTML_NO_CHARSET autolearn=no
version=2.61
This is a multi-part message in MIME format.
--__________MIMEboundary__________
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
You Are Invited!
As a preferred customer of the Hartford Courant, you are cordially invited
to attend a sneak preview of the latest addition to our unbeatable cast of
multimedia recruitment products...
CareerBuilder TV
Come learn how you can enhance your employment brand and recruitment
strategy by increasing the reach of your career opportunities with this
brand new, cost-effective, high-interest television program. We'll show
you how you can...
- Enhance your brand
- Extend your message beyond print and online
- Obtain low-cost TV exposure
Presentations and Q & A will last about one hour, and you have your choice
of dates and times:
Monday, April 5th, 1pm
Tuesday, April 6th, 9am
Tuesday, April 6th, 1pm
Wednesday, April 7th, 9am
All sessions will be held at the Hartford Courant, 285 Broad Street,
Hartford.
Please R.S.V.P. to your Hartford Courant representative by phone or fax as
to which presentation you will be attending. (You may also contact Donna
Schweder, [EMAIL PROTECTED], 860-520-6914, and she will add your name
to the list.)
Be sure to attend to have your chance to win gifts and FREE advertising!
I look forward to seeing you in April!
Sincerely,
Michelle Wages
Recruitment Manager
The Hartford Courant
[EMAIL PROTECTED]
860-520-6926
______________________________________________________________________
If you no longer wish to receive these emails, please reply to this
message with "Unsubscribe" in the subject line or simply click on the
following link:
http://unsub.vresp.com/u.html?
_____________________________________________________________________
This message was sent by Michelle Wages using
VerticalResponse's iBuilder (TM)
Hartford Courant
285 Broad Street
Hartford, CT 06115
USA
Read the VerticalResponse marketing policy:
http://www.verticalresponse.com/content/pm_policy.html
--__________MIMEboundary__________
Content-Type: text/html
Content-Transfer-Encoding: 7bit
<body bgcolor="#FFFFFF" text="#000000" link="#FF8040"
vlink="#FF8040">
<table width="605" border="0" cellspacing="0"
cellpadding="0" height="473">
<tr>
<td width="120" bgcolor="#FF8040" height="10" colspan="2"><font
color="#FF6633"><a name="top"></a>
<!--Unable to read HTML email? Visit www.ctnow.com/recruitct to see
this newsletter online. -->
</font></td>
<td height="10"
width="300"> </td>
<td height="10" width="180"><img
src="http://www.ctnow.com/media/photo/2002-11/5337107.jpg"; width="180"
height="2"></td>
<td width="5"></td>
</tr>
<tr>
<td width="120" height="8" bgcolor="#FF8040" colspan="2"><font
color="#FF6633"></font></td>
<td height="8" colspan="2"
valign="middle">
<div align="center"><img
src="http://www.ctnow.com/media/photo/2004-03/11890658.jpg"; width="386"
height="65">
</div>
</td>
<td width="5" height="8"></td>
</tr>
<tr>
<td width="120" height="478" bgcolor="#FF8040" colspan="2">
<blockquote><font color="#CC6633"><font color="#CC6633"><font
color="#FF6633"></font></font></font></blockquote>
</td>
<td
height="478" colspan="2">
<blockquote>
<p align="left"><font size="2" face="Arial, Helvetica,
sans-serif"><br>
As a preferred customer of the Hartford
Courant, you are cordially invited
to attend a sneak preview of the latest addition to our
unbeatable cast
of multimedia recruitment products...</font><br>
</p>
<p></p>
<p></p>
<p> </p>
<p
align="center"><font face="Arial, Helvetica, sans-serif" size="2"><img
src="http://www.ctnow.com/media/photo/2004-03/11890620.jpg"; width="262"
height="47"></font></p>
<p><font size="2" face="Arial, Helvetica,
sans-serif">Come learn how you
can enhance your employment brand and recruitment strategy by
increasing
the reach of your career opportunities with this brand new,
cost-effective,
high-interest television program. We'll show you how you
can...</font></p>
</blockquote>
<ul>
<ul>
<ul>
<li><font face="Arial, Helvetica, sans-serif"
size="2">Enhance your
brand</font></li>
<li><font face="Arial,
Helvetica, sans-serif" size="2">Extend your
message beyond print and online</font></li>
<li><font face="Arial, Helvetica, sans-serif" size="2">Obtain low-cost
TV exposure</font></li>
</ul>
</ul>
</ul>
<blockquote>
<p align="left"><font size="2" face="Arial, Helvetica,
sans-serif">Presentations
and Q & A will last about one hour, and you have your choice
of
dates and times:</font></p>
<table width="240"
align="center">
<tr>
<td width="178"><font face="Arial, Helvetica, sans-serif"
size="2"><b>Date</b></font></td>
<td width="50"><font
face="Arial, Helvetica, sans-serif" size="2"><b>Time</b></font></td>
</tr>
<tr>
<td width="178"><font size="2" face="Arial, Helvetica,
sans-serif">Monday,
April 5th </font></td>
<td width="50"><font
size="2" face="Arial, Helvetica, sans-serif">1pm</font></td>
</tr>
<tr>
<td width="178"><font size="2" face="Arial, Helvetica,
sans-serif">Tuesday,
April 6th</font></td>
<td width="50"><font
size="2" face="Arial, Helvetica, sans-serif">9am</font></td>
</tr>
<tr>
<td width="178"><font size="2" face="Arial, Helvetica,
sans-serif">Tuesday,
April 6th</font></td>
<td width="50"><font
size="2" face="Arial, Helvetica, sans-serif">1pm</font></td>
</tr>
<tr>
<td width="178"><font size="2" face="Arial, Helvetica,
sans-serif">Wednesday,
April 7th</font></td>
<td width="50"><font
size="2" face="Arial, Helvetica, sans-serif">9am</font></td>
</tr>
</table>
<p><font face="Arial, Helvetica,
sans-serif" size="2">All sessions will
be held at the Hartford Courant, 285 Broad Street,
Hartford.</font></p>
<p align="left"><font size="2" face="Arial,
Helvetica, sans-serif">Please
R.S.V.P. to your Hartford Courant representative by phone or fax
as
to which presentation you will be attending. (You may also
contact Donna
Schweder, <a
href="[EMAIL PROTECTED]@courant.com">[EMAIL PROTECTED]</a>,
860-520-6914, and she will add your name to the list.)</font>
</p>
<p align="left"><font size="2" face="Arial, Helvetica,
sans-serif">Be
sure to attend to have your chance to win gifts and FREE
advertising!</font></p>
<p align="left"><font face="Arial,
Helvetica, sans-serif" size="2">I look
forward to seeing you in April!</font></p>
<p
align="left"><font face="Arial, Helvetica, sans-serif"
size="2">Sincerely,</font></p>
<p align="left"><font face="Arial,
Helvetica, sans-serif" size="2">Michelle
Wages<br>
</font><font face="Arial, Helvetica,
sans-serif" size="2">Recruitment
Manager<br>
The Hartford Courant<br>
<a
href="mailto:[EMAIL PROTECTED]">[EMAIL PROTECTED]</a><br>
860-520-6926 </font></p>
</blockquote>
</td>
<td width="5"
height="478"></td>
</tr>
<tr>
<td width="120" height="111" bgcolor="#FF8040" colspan="2"><font
color="#FF6633"></font></td>
<td colspan="2" align="right"
valign="middle"><img
src="http://www.ctnow.com/media/photo/2003-03/7154636.jpg"; width="247"
height="79"></td>
<td width="5"></td>
</tr>
<tr>
<td width="60" height="2" bgcolor="#FF8040"></td>
<td width="60"
height="2" bgcolor="#FFB997"></td>
<td height="2" colspan="2"
align="left" valign="bottom" bgcolor="#FFB997">
<div align="right"><img
src="http://www.ctnow.com/media/photo/2002-11/5337107.jpg"; width="30"
height="2"></div>
</td>
<td width="5" height="2"></td>
</tr>
<tr>
<td width="120" height="15" colspan="2" bgcolor="#FF8040"> </td>
<td height="15" colspan="2" align="left" valign="bottom"> </td>
<td width="5"></td>
</tr>
<tr>
<td width="120" height="15" colspan="2"><img
src="http://www.ctnow.com/media/photo/2002-11/5337107.jpg"; width="120"
height="8"></td>
<td height="15" colspan="2" align="left"
valign="bottom"> </td>
<td width="5"></td>
</tr>
</table>
<img
src="file:///C|/Documents%20and%20Settings/pedwards/My%20Documents/Dreamweaver/recruitment%20newsletter/images/120x2.jpg"
width="120" height="2">
<br>
<hr color=e0e0e0>
<table border=0 cellpadding=5 cellspacing=0 width=100%>
<tr>
<td><font
face="arial,verdana" size=1>If you no longer wish to receive these emails,
please reply to this message with "Unsubscribe" in the subject line or
simply click on the following link: <a
href="http://unsub.vresp.com/u.html?29e8423/165c0fc";>Unsubscribe</a></td>
</tr>
</table>
<hr
color=e0e0e0>
<table border=0 cellpadding=5 cellspacing=0
width=100%>
<tr>
<td>
<font face="arial,verdana" size=1>This
message was sent by Michelle Wages using VerticalResponse's <a
href="http://www.verticalresponse.com/landing/?mm/29ed29";>iBuilder</a>®<br></td>
<td
align=right>
<a
href="http://www.verticalresponse.com/landing/?mm/98423";><img
src="http://img.verticalresponse.com/images/pwrby_vr_logo_120.gif";
border=0></a></td>
</tr>
<tr>
<td colspan=2>
<font
face="arial,verdana" size=1>
Hartford Courant<br>
285 Broad
Street<br>
Hartford, CT 06115<br>
USA
<p>
<a
href="http://www.verticalresponse.com/content/pm_policy.html";>Read</a> the
VerticalResponse marketing policy.</td>
</tr>
</table>
<img src=http://i.verticalresponse.com/blank.gif?29e3/165c>
--__________MIMEboundary__________--
..
![http://www.ctnow.com/media/photo/2002-11/5337107.jpg"](http://www.ctnow.com/media/photo/2002-11/5337107.jpg"){kind=link}
![http://www.ctnow.com/media/photo/2004-03/11890658.jpg"](http://www.ctnow.com/media/photo/2004-03/11890658.jpg"){kind=link}
![http://www.ctnow.com/media/photo/2004-03/11890620.jpg"](http://www.ctnow.com/media/photo/2004-03/11890620.jpg"){kind=link}
![http://www.ctnow.com/media/photo/2003-03/7154636.jpg"](http://www.ctnow.com/media/photo/2003-03/7154636.jpg"){kind=link}
![http://img.verticalresponse.com/images/pwrby_vr_logo_120.gif"](http://img.verticalresponse.com/images/pwrby_vr_logo_120.gif"){kind=link}
