Here's a couple of headers , how do I go about posting the actual message?
1.
Microsoft Mail Internet Headers Version 2.0
Received: from mail.familycareintl.org ([192.168.1.4]) by
mail.familycareintl.org with Microsoft SMTPSVC(6.0.3790.1830);
Mon, 19 Sep 2005 08:43:52 -0400
Received: from linkfe02.link.net ([62.241.134.100])
by mail.familycareintl.org with esmtp (Exim 4.50 (FreeBSD))
id 1EHL2k-0009Q6-5g
for [EMAIL PROTECTED]; Mon, 19 Sep 2005 08:47:02 -0400
Received: from smtpgw5.link.net ([213.131.64.222]) by linkfe02.link.net with
Microsoft SMTPSVC(6.0.3790.0);
Mon, 19 Sep 2005 15:43:12 +0300
Received: from gateway2.link.net (Not Verified[213.131.64.206]) by
smtpgw5.link.net with LINKdotNET MailFilter
id <B000f2ca82>; Mon, 19 Sep 2005 15:43:18 +0300
Received: from nashwa ([82.201.235.21]) by gateway2.link.net with Microsoft
SMTPSVC(6.0.3790.175);
Mon, 19 Sep 2005 15:42:38 +0300
From: "advekit" <[EMAIL PROTECTED]>
To: "advekit" <[EMAIL PROTECTED]>
Subject: www.kit.com.eg
Date: Mon, 19 Sep 2005 14:57:02 +0300
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_017C_01C5BD30.D41AC050"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: AcW8tvFLB6lpk3uMRG+GOEaQEkf4eQAVZvlgAADlS/A=
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2096
Message-ID: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 19 Sep 2005 12:42:38.0834 (UTC)
FILETIME=[9E573520:01C5BD17]
X-Spam-Score: 4.2 (++++)
X-Spam-Report: Spam detection software, running on the system "milter", has
identified this incoming email as possible spam. The original
message
has been attached to this so you can view it (if it isn't spam) or
label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview:
<http://www.kit.com.eg/arabic/hardware/offers_hw_sets.htm>
<http://www.kit.com.eg/arabic/about_kit/kit_advertising.htm> ??????
????? ?????????? ?? ??? ??????? ??? ???? ????? ????? ???
<mailto:[EMAIL PROTECTED]>
[EMAIL PROTECTED] [...]
Content analysis details: (4.2 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.5 FROM_ENDS_IN_NUMS From: ends in numbers
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above
50%
[cf: 100]
0.2 HTML_90_100 BODY: Message is 90% to 100% HTML
0.1 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?82.201.235.21>]
Return-Path: [EMAIL PROTECTED]
------=_NextPart_000_017C_01C5BD30.D41AC050
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_017D_01C5BD30.D41AC050"
------=_NextPart_001_017D_01C5BD30.D41AC050
Content-Type: text/plain;
charset="windows-1256"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_017D_01C5BD30.D41AC050
Content-Type: text/html;
charset="windows-1256"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_017D_01C5BD30.D41AC050--
------=_NextPart_000_017C_01C5BD30.D41AC050
Content-Type: image/jpeg;
name="image001.jpg"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_017C_01C5BD30.D41AC050
Content-Type: image/gif;
name="image002.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_017C_01C5BD30.D41AC050--
2.
Microsoft Mail Internet Headers Version 2.0
Received: from mail.familycareintl.org ([192.168.1.4]) by
mail.familycareintl.org with Microsoft SMTPSVC(6.0.3790.1830);
Sun, 18 Sep 2005 05:03:35 -0400
Received: from linkfe01.link.net ([62.241.134.94])
by mail.familycareintl.org with esmtp (Exim 4.50 (FreeBSD))
id 1EGv7x-00083i-2Q
for [EMAIL PROTECTED]; Sun, 18 Sep 2005 05:06:36 -0400
Received: from smtpgw5.link.net ([213.131.64.222]) by linkfe01.link.net with
Microsoft SMTPSVC(6.0.3790.0);
Sun, 18 Sep 2005 12:02:39 +0300
Received: from gateway3.link.net (Not Verified[213.131.64.207]) by
smtpgw5.link.net with LINKdotNET MailFilter
id <B000ef5fc2>; Sun, 18 Sep 2005 12:03:08 +0300
Received: from nashwa ([82.201.235.21]) by gateway3.link.net with Microsoft
SMTPSVC(6.0.3790.211);
Sun, 18 Sep 2005 12:02:49 +0300
From: "advertising" <[EMAIL PROTECTED]>
To: "advertising" <[EMAIL PROTECTED]>
Subject: =?windows-1256?B?IMfP0e3H5CDH4ePax8/s?=
Date: Sun, 18 Sep 2005 12:02:39 +0300
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0086_01C5BC48.F2BAE910"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: AcW8LTA+rEiDYs/OS621d235wg/8FAAACYQwAACWUZA=
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2096
Message-ID: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 18 Sep 2005 09:02:49.0373 (UTC)
FILETIME=[BE656CD0:01C5BC2F]
X-Spam-Score: 2.3 (++)
X-Spam-Report: Spam detection software, running on the system "milter", has
identified this incoming email as possible spam. The original
message
has been attached to this so you can view it (if it isn't spam) or
label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview:
<http://www.kit.com.eg/arabic/about_kit/kit_advertising.htm> ??????
????? ?????????? ?? ??? ??????? ??? ???? ????? ????? ???
<mailto:[EMAIL PROTECTED]>
[EMAIL PROTECTED] [...]
Content analysis details: (2.3 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.5 FROM_ENDS_IN_NUMS From: ends in numbers
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above
50%
[cf: 100]
0.2 HTML_90_100 BODY: Message is 90% to 100% HTML
0.1 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
Return-Path: [EMAIL PROTECTED]
------=_NextPart_000_0086_01C5BC48.F2BAE910
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0087_01C5BC48.F2BAE910"
------=_NextPart_001_0087_01C5BC48.F2BAE910
Content-Type: text/plain;
charset="windows-1256"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_0087_01C5BC48.F2BAE910
Content-Type: text/html;
charset="windows-1256"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_0087_01C5BC48.F2BAE910--
------=_NextPart_000_0086_01C5BC48.F2BAE910
Content-Type: image/gif;
name="image002.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0086_01C5BC48.F2BAE910
Content-Type: image/gif;
name="image003.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0086_01C5BC48.F2BAE910--
-----Original Message-----
From: Pierre Thomson [mailto:[EMAIL PROTECTED]
Sent: Tuesday, September 20, 2005 11:34 AM
To: Jean-Paul Natola
Subject: RE: Resource box
easy target for dictionary attacks? It might get different sorts of spams
than users with less easily guessed usernames.
Of course, samples with full headers would let the rest of us test SA's
response...
Pierre Thomson
BIC
-----Original Message-----
From: Jean-Paul Natola [mailto:[EMAIL PROTECTED]
Sent: Tuesday, September 20, 2005 11:25 AM
To: users@spamassassin.apache.org
Subject: Resource box
Hi all,
I've been running SA for about 2 months now, working really well (for the
most part) We do have a resources@ mailbox that I took a look at today and
low and behold of the 2018 messages only 15 or so were legit, why would that
one account get hammered so much more than all others?
Any thoughts?
