New Spam

[Roger Jochem]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Did you change the score of these rules in spamassassin or this are default
scores?

----- Original Message -----
From: "Drew Marshall" <drew at THEMARSHALLS.CO.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Wednesday, March 23, 2005 7:20 AM
Subject: Re: New Spam


> Roger Jochem said:
> > Hello all!
> >
> > I'm receiving messages like the attached one for a while now. Is there
> > some spamassassin rule that can block this kind of spam? Aparently the
> > message, lokking the code, is very diferent from what is appearing on
> > screen. And the original text (that doesn't appear) is always very
> > diferent...
>
> Worked for me...
>
> Our MailScanner believes that the attachment to this message sent to you
>
>     From: owner-mailscanner at jiscmail.ac.uk
>  Subject: [MAILSCANNER] New Spam
>
> is Unsolicited Commercial Email (spam). Unless you are sure that this
message
> is incorrectly thought to be spam, please delete this message without
opening
> it. Opening spam messages might allow the spammer to verify your email
> address.
>
> If you believe that this message has been incorrectly marked as spam,
please
> forward this email to postmaster.
>
>  pts rule name              description
> ---- ----------------------
> --------------------------------------------------
>  2.5 SARE_SPOOF_COM2OTH     URI: a.com.b.c
>  2.5 SARE_SPOOF_OURI        URI: URL has items in odd places
>  2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level
domain
>  0.1 HTML_TEXT_AFTER_BODY   BODY: HTML contains text after BODY close tag
>  0.1 HTML_TAG_EXIST_TBODY   BODY: HTML has "tbody" tag
> -2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
>                             [score: 0.0000]
>  0.0 HTML_TEXT_AFTER_HTML   BODY: HTML contains text after HTML close tag
>  0.0 HTML_MESSAGE           BODY: HTML included in message
>  0.1 HTML_FONT_BIG          BODY: HTML tag for a big font size
>  0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76
chars
>  1.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
>                             [URIs: spacedrugs.com]
>  3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL
blocklist
>                             [URIs: spacedrugs.com]
>
> As you can see the URIBLs did their job very well. I would ensure that you
> are using the latest SpamAssassin and have URIBL turned on.
>
> Drew
>
> --
> In line with our policy, this message has
> been scanned for viruses and dangerous
> content by MailScanner, and is believed to be clean.
> www.themarshalls.co.uk/policy
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!