New Spam

[Drew Marshall]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Roger Jochem said:
> Hello all!
>
> I'm receiving messages like the attached one for a while now. Is there
> some spamassassin rule that can block this kind of spam? Aparently the
> message, lokking the code, is very diferent from what is appearing on
> screen. And the original text (that doesn't appear) is always very
> diferent...

Worked for me...

Our MailScanner believes that the attachment to this message sent to you

    From: owner-mailscanner at jiscmail.ac.uk
 Subject: [MAILSCANNER] New Spam

is Unsolicited Commercial Email (spam). Unless you are sure that this message
is incorrectly thought to be spam, please delete this message without opening
it. Opening spam messages might allow the spammer to verify your email
address.

If you believe that this message has been incorrectly marked as spam, please
forward this email to postmaster.

 pts rule name              description
---- ----------------------
--------------------------------------------------
 2.5 SARE_SPOOF_COM2OTH     URI: a.com.b.c
 2.5 SARE_SPOOF_OURI        URI: URL has items in odd places
 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level domain
 0.1 HTML_TEXT_AFTER_BODY   BODY: HTML contains text after BODY close tag
 0.1 HTML_TAG_EXIST_TBODY   BODY: HTML has "tbody" tag
-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000]
 0.0 HTML_TEXT_AFTER_HTML   BODY: HTML contains text after HTML close tag
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.1 HTML_FONT_BIG          BODY: HTML tag for a big font size
 0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76 chars
 1.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
                            [URIs: spacedrugs.com]
 3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: spacedrugs.com]

As you can see the URIBLs did their job very well. I would ensure that you
are using the latest SpamAssassin and have URIBL turned on.

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!