One spammer is persistently slipping through...

Mon Apr 26 10:53:55 IST 2004

Attached  is a df/qf pair with example spam we are receiving.

I don't know why but for some reason these assholes are never blocked.
They never appear to be in any dns blacklist, scoring on the bayesian db
is always negative.

They seem to have found a way to always let their crap slip through, VERY
frustrating.

The format of the mails is always the same (small coloured crap
surrounded by lots of white space) and the subject totally different each
time.

Has anyone managed to succesfully block this crap?

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html
-------------- next part --------------

<HTML>
<BODY bgcolor=#FFFFFF leftmargin=0 topmargin=0 marginwidth=0 marginheight=0>
	<center><img src='http://stockfolly.com/images/91276446674107943/spacer.gif'></center><br>
	<TABLE width=550 border=0 cellpadding=0 cellspacing=0 align="center">
	<TR>
	<TD><A href="http://stockfolly.com/go/91276446674107943/"><IMG src="http://stockfolly.com/sites/00001079/images/main_01.jpg" width=320 height=157 border=0 alt=""></A></TD>
	<TD colspan=2><A href="http://stockfolly.com/go/91276446674107943/"><IMG src="http://stockfolly.com/sites/00001079/images/main_02.gif" width=230 height=157 border=0 alt=""></A></TD></TR>
	<TR>
	<TD colspan=3><A href="http://stockfolly.com/go/91276446674107943/"><IMG src="http://stockfolly.com/sites/00001079/images/main_03.gif" width=550 height=27 border=0 alt=""></A></TD></TR>
	<TR>
	<TD colspan=3><A href="http://stockfolly.com/go/91276446674107943/"><IMG src="http://stockfolly.com/sites/00001079/images/main_04.gif" width=550 height=78 border=0 alt=""></A></TD></TR>
	<TR>
	<TD colspan=2 rowspan=2><A href="http://stockfolly.com/go/91276446674107943/"><!--  his head. And they were always fixed on Syme.  Syme felt moved to spring up and leap over the balcony. When the President's eyes were on him he felt as if he were made of glass. He had hardly the shred of a doubt that in some silent and extraordinary way Sunday had found out that he was a spy. He looked over the edge of the balcony, and saw a policeman, standing abstractedly just bene --><IMG src="http://stockfolly.com/sites/00001079/images/main_05.gif" width=419 height=238 border=0 alt=""></A></TD>
	<TD><A href="http://stockfolly.com/go/91276446674107943/"><IMG src="http://stockfolly.com/sites/00001079/images/main_06.jpg" width=131 height=114 border=0 alt=""></A></TD></TR>
	<TR>
	<TD><A href="http://stockfolly.com/go/91276446674107943/"><IMG src="http://stockfolly.com/sites/00001079/images/main_07.jpg" width=131 height=124 border=0 alt=""></A></TD></TR>
	<TR>
	<TD><!-- or. Now I am a humanitarian myself, but I have, I hope, enough intellectual breadth to understand the position of those who, like Nietzsche, admire violence--the proud, mad war of Nature and all that, you know. I threw my --><IMG src="http://stockfolly.com/sites/00001079/images/spacer.gif" width=320 height=1 alt=""></TD>
	<TD><IMG src="http://stockfolly.com/sites/00001079/images/spacer.gif" width=99 height=1 alt=""></TD>
	<TD><IMG src="http://stockfolly.com/sites/00001079/images/spacer.gif" width=131 height=1 alt=""></TD></TR>
	</TABLE>
	<table width="450" border="0" cellspacing="0" cellpadding="2" align="center" bgcolor="#FFFFFF">
	<tr>
	<td height="12" align="center"><font size="1" face="Arial, Helvetica, sans-serif" color="#000000"><TABLE cellSpacing=0 cellPadding=0 width=450 border=0><TBODY><TR><TD align=middle height=12><FONT face="Arial, Helvetica,sans-serif" size=1>We are distributing this magnificent ad because you applied for it or you've been a official member of one of our many diverse membership sites. If you'd like to be taken away from this exceptional email service any longer. Please do - <a href="http://stockfolly.com/link/91276446674107943/">Make your wish come true by going here. </a></FONT></TD></TR></TBODY></TABLE><BR></font></td></tr>
	</table>
</BODY>
</HTML>

-------------- next part --------------
V6
T1082970919
K0
N0
P30932
Fbs
$_gw.ecem.com [10.1.0.6]
$rESMTP
$sook.vaag.nu
${daemon_flags}
${if_addr}10.1.0.3
S<SusanLewis at stockfolly.com>
rRFC822; j.pereira at ecem.com
RPFD:<j.pereira at ecem.com>
H?P?Return-Path: <?g>
H??Received: from ook.vaag.nu (gw.ecem.com [10.1.0.6])
	by linuxgw.ecem.it (8.12.8/8.12.8) with ESMTP id i3Q9FIot018811
	for <j.pereira at ecem.com>; Mon, 26 Apr 2004 11:15:19 +0200
H??Received: from maildrop6.xs4all.nl (maildrop6.xs4all.nl [194.109.127.136])
	by ook.vaag.nu (8.12.10/8.12.10) with ESMTP id i3Q9FFuR011655
	for <j.pereira at ecem.com>; Mon, 26 Apr 2004 11:15:18 +0200
H??Received: from mxzilla2.xs4all.nl (mxzilla2.xs4all.nl [194.109.24.132])
	by maildrop6.xs4all.nl (8.12.9/8.12.6) with ESMTP id i3Q9FFIt090981
	for <j.pereira at ecem.com>; Mon, 26 Apr 2004 11:15:15 +0200 (CEST)
H??Received: from stockfolly.com ([66.249.106.232])
	by mxzilla2.xs4all.nl (8.12.10/8.12.10) with SMTP id i3Q9F5GV071076
	for <j.pereira at ecem.com>; Mon, 26 Apr 2004 11:15:10 +0200 (CEST)
H??Message-Id: <200404260915.i3Q9F5GV071076 at mxzilla2.xs4all.nl>
H??To: <j.pereira at ecem.com>
H??From: Susan Lewis <SusanLewis at stockfolly.com>
H??Reply-To: <SusanLewis at stockfolly.com>
H??Date: Mon, 26 Apr 2004 02:15:10 -0700
H??X-Mailer: Microsoft Outlook Express 5.01.2764.4667
H??MIME-version: 1.0
H??Content-type: Text/HTML
H??Subject: Repossessed Cars Database Access
.