Hello List, I am running SA 2.63, Posfix 2 & Amavisd-new. I have many updated rule sets, any rules out there to "see" letters spelled as below?
The following spam got in, just thought I'd share with the list, I have never seen this technique. My tagged above is set to -100 so I can see the tests that were run and hit (see headers below), then I just adjust the rule scores so it doesn't happen again. Anyone else doing this? TIA Eric ;===Begin Spam=== <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content="MSHTML 6.00.2800.1400" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#FFFFFF link=#000000> <A href="http://uk.geocities.com/hoop85518ha/?a=YijfMnQrPSZX&q=opMzI4MjctYWFudzYyMTMwNw";>----------------------------------------------------------------V-I-E-W-----------------------------------------------------------</A> <font size=-10 color=black><b> <pre> 3164295462 059534810326 299487683680 066214765950 2747141003 887914428411 0646 5847 8985 6721 2577 7645 3321 8378 91 9712 3457 7292 8838 7452 9403 4142 8518 8752 25 6405 7451 2850 5685 8280 4727 7894 0369 3707 4190 369760 0090654176 147166672904 645513634095 980430932265 8244298398 816201975860 560275 8858 7206 6417 0314 0726 8710 2878 635989 0803 7395 9471 8514 0445 43 1079 1817 5477 1416 0270 9933 4080 3683 1048 60 9134 6482 7119 6949 7775 7925 8940 234358413242 059869444007 9883835663 783688691917 1737 9356 </pre> </div></b> </font> <A href="http://uk.geocities.com/hoop85518ha/?a=YijfMnQrPSZX&q=opMzI4MjctYWFudzYyMTMwNw";>----------------------------------------------------------------V-I-E-W-----------------------------------------------------------</A> <BR><BR><BR><BR><BR><font size=1 face=verdana><br>You either signed to free Internet resource lately or some person<br> entered your address for you. To discontinue press here: <a href="http://uk.geocities.com/hoop85518ha/?a=YijfMnQrPSZX&q=opMzI4MjctYWFudzYyMTMwNw&e=wlZXJpY0B2aXBzdHJ1Y3R1cmVzLmNvbQ";>stop</a></font> </BODY></HTML> ;==End Spam=== Received: from bossuet-6-82-229-169-73.fbx.proxad.net (bossuet-6-82-229-169-73.fbx.proxad.net [82.229.169.73]) by godzilla.vipstructures.com (Postfix) with SMTP id 3E04528499 for <[EMAIL PROTECTED]>; Tue, 22 Mar 2005 03:32:13 -0500 (EST) Received: from [66.90.216.151] (HELO iXcWepl) by bossuet-6-82-229-169-73.fbx.proxad.net with Microsoft SMTPSVC(5.0.2195.5600); Tue, 22 Mar 2005 03:31:44 -0500 From: "Lydia" <[EMAIL PROTECTED]> Date: Tue, 22 Mar 2005 03:31:36 -0500 Message-ID: <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: SEXUALLY-EXPLICIT: Hot older broads lookin' for a young guy. MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_A3E5_8B539763.8553F75C" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-Antivirus: checked by Norton Anti Virus X-MTA-Mailer: Postfix 2 by Wietse Venema - http://www.postfix.org X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on godzilla.vipstructures.com X-Spam-Status: No, hits=4.0 tagged_above=-100.0 required=8.0 tests=BAYES_44, HTML_FONTCOLOR_UNKNOWN, HTML_MESSAGE, MY_MANY_BR, MY_PHRS_LOW, RATWR7a_MESSID, RCVD_IN_NJABL, RCVD_IN_SORBS, SUBJECT_SEXUAL, TM2_MISC_INVISI_FONT X-Spam-Level: **** Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 22 Mar 2005 08:32:20.0717 (UTC) FILETIME=[AA13A9D0:01C52EB9] ------=_NextPart_000_A3E5_8B539763.8553F75C Content-Type: text/plain; charset="iso-8859-1" ------=_NextPart_000_A3E5_8B539763.8553F75C Content-Type: text/html; charset="iso-8859-1" ------=_NextPart_000_A3E5_8B539763.8553F75C--
