Subject Tag - Most but not all spams tagged

[Scott Hares]

Ah, now this rings a bell. I have seen other servers that had problems
handling spams with mime encoded subject lines as expected. Could be the
same kind of thing.


>I witnessed this more than once... I posted it to the list... it
>happened on _some_ 8bit subjects with strange encodings, or when
>another header was somehow strange, I don't quite recall...
>
>I DO believe there's a bug lurking in there, but I never had time to
>look thoroughly in it... :-(
>
>On Fri, 30 Jul 2004 17:24:24 +0100, Scott Hares
><shares at group1internet.com> wrote:
>> I've got subject line tagging working for the most part. Oddly enough,
I've
>> got two spams out of about 100 that did not get the subject line tagged.
>> Any suggestions would be appreciated. Please note the headers of the
>> offending spam below.
>>
>> To: scott at NOSPAMgarlic.com
>> Date: Thu, 29 Jul 2004 19:33:34 -0600
>> Message-ID: <1091147614.8228 at mx5.consumer-based.com>
>> From: "Mystery Classics " <ADV at CONSUMER-BASED.COM>
>> Reply-To: "Mystery Classics" <ADV at CONSUMER-BASED.COM>
>> Subject:Get 50 Full Length Movies for the Price of 1
>> Content-Type: text/html
>> X-UIDL: $ic!!4dd!!C//!!i8`!!
>> X-rc.group1internet.com-MailScanner-Information: Please contact the ISP
for
>> more information
>> X-rc.group1internet.com-MailScanner: Found to be clean
>> X-rc.group1internet.com-MailScanner-SpamCheck: spam,
>>  SpamAssassin (score=33.598, required 6, BANG_MORE 1.16,
>>  BAYES_99 11.01, EMAIL_ROT13 4.10, G1I_MY_OBFUJ 0.45,
>>  G1I_MY_OBFUQa 1.45, G1I_MY_OBFUX 0.45, G1I_OBFU_word_03 0.40,
>>  G1I_OBFU_word_04 0.40, G1I_REMOVE 0.30, HTML_70_80 2.00,
>>  HTML_FONTCOLOR_RED 0.10, HTML_FONT_BIG 0.27,
>>  HTML_FONT_INVISIBLE 0.60, HTML_IMAGE_ONLY_04 1.00, HTML_MESSAGE 0.10,
>>  MAILTO_SUBJ_REMOVE 0.89, MIME_HEADER_CTYPE_ONLY 2.23,
>>  MIME_HTML_NO_CHARSET 0.56, MIME_HTML_ONLY 0.32, OBSCURED_EMAIL 2.70,
>>  RCVD_IN_SBL 1.11, RCVD_IN_SBL_CSMA 2.00)
>> X-rc.group1internet.com-MailScanner-SpamScore:
>> sssssssssssssssssssssssssssssssss
>> X-MailScanner-From: adv at consumer-based.com
>>
>> Here is a spam of approximately the same score that did get tagged.
>>
>> Date: Thu, 29 Jul 2004 19:55:47 +0000
>> From: "Liberty Wireless" <ADV at Go2eBuy.com>
>> Reply-To: "Liberty Wireless" <ADV at Go2eBuy.com>
>> To: <scott at NOSPAMgarlic.com>
>> Content-Type: text/html
>> Message-Id: <20040729205610.981DB387D at quake.garlic.com>
>> X-UIDL: doU!!~DG!!YKS"!`53"!
>> X-rc.group1internet.com-MailScanner-Information: Please contact the ISP
for
>> more information
>> X-rc.group1internet.com-MailScanner: Found to be clean
>> X-rc.group1internet.com-MailScanner-SpamCheck: spam,
>>  SpamAssassin (score=33.243, required 6, BAD_CREDIT 0.36,
>>  BAYES_99 11.01, G1I_MY_OBFUJ 0.45, G1I_MY_OBFUX 0.45,
>>  G1I_MY_OBFUZ 0.45, G1I_OBFU_word_01 3.40, G1I_OBFU_word_04 0.40,
>>  G1I_REMOVE 0.30, HTML_80_90 2.00, HTML_IMAGE_AREA_05 2.20,
>>  HTML_IMAGE_ONLY_02 1.23, HTML_MESSAGE 0.10,
>>  HTTP_WITH_EMAIL_IN_URL 0.20, MAILTO_SUBJ_REMOVE 0.89,
>>  MIME_HEADER_CTYPE_ONLY 2.23, MIME_HTML_NO_CHARSET 0.56,
>>  MIME_HTML_ONLY 0.32, NO_CREDIT_CHECK 2.70, RCVD_IN_BL_CSMA 2.00,
>>  RCVD_IN_BL_SPAMCOP_NET 2.00)
>> X-rc.group1internet.com-MailScanner-SpamScore:
>> sssssssssssssssssssssssssssssssss
>> X-MailScanner-From: adv at go2ebuy.com
>> Subject: [Spam 33] Get a Sanyo Color Cell Phone with No Credit Check!
>>
>> -------------------------- MailScanner list ----------------------
>> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>> Before posting, please see the Most Asked Questions at
>> http://www.mailscanner.biz/maq/     and the archives at
>> http://www.jiscmail.ac.uk/lists/mailscanner.html
>>
>
>
>--
>Mariano Absatz - El Baby
>el (dot) baby (AT) gmail (dot) com
>el (punto) baby (ARROBA:@) gmail (punto) com
>
>-------------------------- MailScanner list ----------------------
>To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>Before posting, please see the Most Asked Questions at
>http://www.mailscanner.biz/maq/     and the archives at
>http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html