Mailing List Archive: Tricky spam

Anyone else receive one like below? It's tricky in that it shows up as
a forward, and has a bunch of MailScanner info in the headers. I'm not
running MailScanner on my server...

--
Regards,
Matt

Return-Path: <info@wisemansbridge.com>
X-Original-To: matt@thoene.net
Delivered-To: matt@thoene.net
Received: from mkango.zamnet.zm (unknown [208.224.176.34])
by ns1.thoene.net (Postfix) with ESMTP id 4A806544C4
for <matt@thoene.net>; Tue, 2 Mar 2004 10:38:25 -0800 (PST)
Received: from kaingo.zamnet.zm (kaingo.zamnet.zm [208.224.176.42])
by mkango.zamnet.zm (8.12.10/8.12.10) with ESMTP id i22HUjkB033122
for <matt@thoene.net>; Tue, 2 Mar 2004 19:30:45 +0200 (ZMT)
Received: from dylan (ppp007-lk.zamnet.zm [208.224.183.7]) by zamnet.zm
(Rockliffe SMTPRA 6.0.6) with SMTP id <B0028983425@kaingo.zamnet.zm>;
Tue, 2 Mar 2004 19:22:30 +0200
Message-ID: <00d501c4007b$57d63510$07b7e0d0@dylan>
From: "Wisemansbridge" <info@wisemansbridge.com>
To: info@wisemansbridge.com
Subject: Fw: special offer tortoise for sale
Date: Tue, 2 Mar 2004 19:16:25 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_00CE_01C4008A.DAF3E3C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2720.3000
Disposition-Notification-To: "Wisemansbridge" <info@wisemansbridge.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam, SpamAssassin (score=1.3, required 9.5,
HTML_70_80 0.33, HTML_IMAGE_ONLY_10 0.33, OFFER 0.10,
UPPERCASE_50_75 0.61)
X-MailScanner-SpamScore: s
X-Spam-Checker-Version: SpamAssassin 2.70-cvs (1.220-2003-12-04-exp) on
ns1.thoene.net
X-Spam-Report:
* 0.0 HTML_IMAGE_ONLY_10 BODY: HTML: images with 800-1000 bytes of words
* 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
* [score: 0.5075]
* 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.3 HTML_FONT_BIG BODY: HTML has a big font
* 0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
* [208.224.183.7 listed in dnsbl.sorbs.net]
* 0.1 RCVD_IN_RFCI RBL: Sent via a relay in ipwhois.rfc-ignorant.org
* [Inaccurate or missing WHOIS data]
* 0.0 UPPERCASE_50_75 message body is 50-75% uppercase
X-Spam-Status: No, hits=0.7 required=2.1 tests=BAYES_50,HTML_70_80,
HTML_FONT_BIG,HTML_IMAGE_ONLY_10,HTML_MESSAGE,RCVD_IN_RFCI,
RCVD_IN_SORBS,UPPERCASE_50_75 autolearn=no version=2.70-cvs
X-Spam-Level:
X-UIDL: ?9#"!1JW"!QI`"!V'X"!

------=_NextPart_000_00CE_01C4008A.DAF3E3C0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

----- Original Message -----=20
From: Wisemansbridge=20
To: info@wisemansbridge.com=20
Sent: Tuesday, March 02, 2004 6:27 PM
Subject: Fw: special offer tortoise for sale

=20

SPECIAL OFFER

(TO NON EU AND NON US COUNTRIES)

AFRICAN REPTILE BREEDERS

PO BOX 34086

LUSAKA

ZAMBIA

WE HAVE CITES F11 LEOPARD TORTOISE (GEOCHELONE PARDALIS) AVAILABLE NOW.

REPLY TO US STATING AIRPORT OF CHOICE

NUMBER REQUIRED

SIZE REQUIRED

SEX REQUIRED=20

AND WE WILL GET BACK TO YOU WITH PRICING.

WE HAVE SHIED TO EUROPE AND FAR EAST AND HAVE 100% SUCCESS

=20

------=_NextPart_000_00CE_01C4008A.DAF3E3C0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns:o =3D "urn:schemas-microsoft-com:office:office"><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2737.800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV> </DIV>
<DIV style=3D"FONT: 10pt arial">----- Original Message -----=20
<DIV style=3D"BACKGROUND: #e4e4e4; font-color: black">From: <A=20
title=3Dinfo@wisemansbridge.com=20
href=3D"mailto:info@wisemansbridge.com">Wisemansbridge</A> </DIV>
<DIV>To: <A title=3Dinfo@wisemansbridge.com=20
href=3D"mailto:info@wisemansbridge.com">info@wisemansbridge.com</A> =
</DIV>
<DIV>Sent: Tuesday, March 02, 2004 6:27 PM</DIV>
<DIV>Subject: Fw: special offer tortoise for sale</DIV></DIV>
<DIV> </DIV>
<DIV><FONT=20
face=3D"Times New Roman"> <SPAN=20
style=3D"FONT-FAMILY: 'Arial Unicode =
MS'"><o:p></o:p></DIV>
<DIV>
 
<SPAN=20
style=3D"FONT-SIZE: 18pt; COLOR: red; FONT-FAMILY: Arial">SPECIAL=20
OFFER
<SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: red; FONT-FAMILY: Arial">(TO NON EU AND =
NON US=20
COUNTRIES)
 
 
 
 
 
<IMG height=3D277 alt=3D"LEOPARD TORTOISE"=20
src=3D"file:///C:/DOCUME~1/Dylan1/LOCALS~1/Temp/msoclip1/01/clip_image001=
.jpg"=20
width=3D417 v:shapes=3D"_x0000_i1025">
 
 
 
 
 
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">AFRICAN =
REPTILE=20
BREEDERS
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">PO BOX=20
34086
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: =
Arial">LUSAKA
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: =
Arial">ZAMBIA
 
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">WE HAVE =
CITES F11=20
LEOPARD TORTOISE (GEOCHELONE PARDALIS) AVAILABLE NOW.
 
 
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">REPLY TO =
US STATING=20
AIRPORT OF CHOICE
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">NUMBER=20
REQUIRED
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">SIZE=20
REQUIRED
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">SEX =
REQUIRED=20

 
<SPAN=20
style=3D"FONT-SIZE: 13.5pt; COLOR: green; FONT-FAMILY: Arial">AND WE =
WILL GET BACK=20
TO YOU WITH PRICING.
 
 
WE=20
HAVE SHIED TO EUROPE AND FAR EAST AND HAVE 100% SUCCESS
<FONT=20
face=3D"Times New =
Roman"> <o:p></o:p></DIV></BODY></HTML>

------=_NextPart_000_00CE_01C4008A.DAF3E3C0--

BWahahahahahha....... oh my!

Can't you people see?? This is obviously Bayes poison for the Black market
turtle industry! I'm sure there will be an uproar at this years convention!
Those 2 guys are gonna be real pissed :)

> SEX REQUIRED=20

Sounds good to me!!

--Chris (Thanks for the laugh!)

> -----Original Message-----
> From: Matt Thoene [mailto:matt@remedyx.com]
> Sent: Tuesday, March 02, 2004 1:56 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Tricky spam
>
>
> Anyone else receive one like below? It's tricky in that it shows up as
> a forward, and has a bunch of MailScanner info in the headers. I'm not
> running MailScanner on my server...
>
> --
> Regards,
> Matt
>
>
> Return-Path: <info@wisemansbridge.com>
> X-Original-To: matt@thoene.net
> Delivered-To: matt@thoene.net
> Received: from mkango.zamnet.zm (unknown [208.224.176.34])
> by ns1.thoene.net (Postfix) with ESMTP id 4A806544C4
> for <matt@thoene.net>; Tue, 2 Mar 2004 10:38:25 -0800 (PST)
> Received: from kaingo.zamnet.zm (kaingo.zamnet.zm [208.224.176.42])
> by mkango.zamnet.zm (8.12.10/8.12.10) with ESMTP id
> i22HUjkB033122
> for <matt@thoene.net>; Tue, 2 Mar 2004 19:30:45 +0200 (ZMT)
> Received: from dylan (ppp007-lk.zamnet.zm [208.224.183.7]) by
> zamnet.zm
> (Rockliffe SMTPRA 6.0.6) with SMTP id <B0028983425@kaingo.zamnet.zm>;
> Tue, 2 Mar 2004 19:22:30 +0200
> Message-ID: <00d501c4007b$57d63510$07b7e0d0@dylan>
> From: "Wisemansbridge" <info@wisemansbridge.com>
> To: info@wisemansbridge.com
> Subject: Fw: special offer tortoise for sale
> Date: Tue, 2 Mar 2004 19:16:25 +0200
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="----=_NextPart_000_00CE_01C4008A.DAF3E3C0"
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2720.3000
> Disposition-Notification-To: "Wisemansbridge"
> <info@wisemansbridge.com>
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
> X-MailScanner: Found to be clean
> X-MailScanner-SpamCheck: not spam, SpamAssassin (score=1.3,
> required 9.5,
> HTML_70_80 0.33, HTML_IMAGE_ONLY_10 0.33, OFFER 0.10,
> UPPERCASE_50_75 0.61)
> X-MailScanner-SpamScore: s
> X-Spam-Checker-Version: SpamAssassin 2.70-cvs
> (1.220-2003-12-04-exp) on
> ns1.thoene.net
> X-Spam-Report:
> * 0.0 HTML_IMAGE_ONLY_10 BODY: HTML: images with
> 800-1000 bytes of words
> * 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
> * [score: 0.5075]
> * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
> * 0.1 HTML_MESSAGE BODY: HTML included in message
> * 0.3 HTML_FONT_BIG BODY: HTML has a big font
> * 0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
> * [208.224.183.7 listed in dnsbl.sorbs.net]
> * 0.1 RCVD_IN_RFCI RBL: Sent via a relay in
> ipwhois.rfc-ignorant.org
> * [Inaccurate or missing WHOIS data]
> * 0.0 UPPERCASE_50_75 message body is 50-75% uppercase
> X-Spam-Status: No, hits=0.7 required=2.1 tests=BAYES_50,HTML_70_80,
> HTML_FONT_BIG,HTML_IMAGE_ONLY_10,HTML_MESSAGE,RCVD_IN_RFCI,
> RCVD_IN_SORBS,UPPERCASE_50_75 autolearn=no version=2.70-cvs
> X-Spam-Level:
> X-UIDL: ?9#"!1JW"!QI`"!V'X"!
>
> ------=_NextPart_000_00CE_01C4008A.DAF3E3C0
> Content-Type: text/plain;
> charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
>
>
> ----- Original Message -----=20
> From: Wisemansbridge=20
> To: info@wisemansbridge.com=20
> Sent: Tuesday, March 02, 2004 6:27 PM
> Subject: Fw: special offer tortoise for sale
>
>
> =20
>
>
> SPECIAL OFFER
>
> (TO NON EU AND NON US COUNTRIES)
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> AFRICAN REPTILE BREEDERS
>
> PO BOX 34086
>
> LUSAKA
>
> ZAMBIA
>
>
>
> WE HAVE CITES F11 LEOPARD TORTOISE (GEOCHELONE PARDALIS)
> AVAILABLE NOW.
>
>
>
>
>
> REPLY TO US STATING AIRPORT OF CHOICE
>
> NUMBER REQUIRED
>
> SIZE REQUIRED
>
> SEX REQUIRED=20
>
>
>
> AND WE WILL GET BACK TO YOU WITH PRICING.
>
>
>
>
>
> WE HAVE SHIED TO EUROPE AND FAR EAST AND HAVE 100% SUCCESS
>
> =20
>
> *snip*