weird spam, included in a word document

[Anthony Peacock]

Hi,

DAve wrote:
> Anthony Peacock wrote:
>> Hi,
>>
>> Ugo Bellavance wrote:
>>> Hi,
>>>
>>>     I just received one funny spam.  The subject is : "Bill Summary - 
>>> Invoice #26820".
>>>
>>> The body is "Invoice Code Change to Invoice Identifier"
>>>
>>> And there is a word document attached.  I scanned it with 
>>> bitdefender, symantec, clamav, norman and AVG before opening it and 
>>> it is... spam (software sellers).
>>>
>>>     Anyone getting these?
>>>
>>> Ugo
>>>
>>
>> Getting loads, but they are all getting caught scoring about 10 SA 
>> points.
>>
> 
> Can you post your test results? Our SA is missing them completely.

One recent one:

3.50	BAYES_99	Bayesian spam probability is 99 to 100%
2.17	DCC_CHECK	Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
1.00	RCVD_IN_JANET_DUL	Relay in JANET MAPS RBL+ DUL
1.46	RCVD_IN_SORBS_WEB	SORBS: sender is a abuseable web server
3.90	RCVD_IN_XBL	Received via a relay in Spamhaus XBL

Another one:

3.50	BAYES_99	Bayesian spam probability is 99 to 100%
2.17	DCC_CHECK	Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
1.56	RCVD_IN_BL_SPAMCOP_NET	Received via a relay in bl.spamcop.net
1.00	RCVD_IN_JANET_DUL	Relay in JANET MAPS RBL+ DUL
1.95	RCVD_IN_NJABL_DUL	NJABL: dialup sender did non-local SMTP
2.05	RCVD_IN_SORBS_DUL	SORBS: sent directly from dynamic IP address
1.46	RCVD_IN_SORBS_WEB	SORBS: sender is a abuseable web server
3.90	RCVD_IN_XBL	Received via a relay in Spamhaus XBL

-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"If you have an apple and I have  an apple and we  exchange apples
then you and I will still each have  one apple. But  if you have an
idea and I have an idea and we exchange these ideas, then each of us
will have two ideas." -- George Bernard Shaw