Mailing List Archive

CN-BR Spam sneaking through
I was surprised that all those cc: headers (96 of them) didn't trip
something. Is there an optional rule I should install to check
messages like this? I have bigevil and backhair currently. Spam in
english advertising a chinese site sent to me via Brazil. Weeeee.

> Return-Path: <olaeazl@hgju77gf.com>
> X-Original-To: kreme@kreme.com
> Delivered-To: kreme@covisp.net
> Received: from plen-server1 (unknown [200.105.22.134])
> by mail.covisp.net (Postfix) with ESMTP id 3232A118ACCC
> for <kreme@kreme.com>; Sun, 7 Mar 2004 15:42:03 -0700 (MST)
> Received: from 218.106.114.212 ([61.187.54.185]) by plen-server1 with
> Microsoft SMTPSVC(6.0.3790.0);
> Sun, 7 Mar 2004 17:40:25 -0500
> From: "tamera" <olaeazl@hgju77gf.com>
> To: "mortal@iname.com" <mortal@iname.com>
> Cc: den@cadvision.com
> Cc: cyberspace3@europay.com
> Cc: eharsh@usa.net
> Cc: kreme@kreme.com
> Cc: grnigrl@freeuk.com
> Cc: wbingham@twlakes.net
> Cc: pegg@mit-it.com
> Cc: schmoop@worldnet.att.net
> Cc: snook5@ij.net
> Cc: ashort@northwestfederal.com
> Cc: geirpb2000@hotmail.com
> Cc: mal3@angelfire.com
> Cc: marcia@castles.com
> Cc: rpd158@bellsouth.net
> Cc: crystal.image@nashville.com
> Cc: rakhan50@hotmail.com
> Cc: doha66@pce.net
> Cc: jimor29@usa.net
> Cc: consultdoh@ponyexpress.net
> Cc: altair@pegasus.com
> Cc: pfg11@juno.com
> Cc: aaron_van@address.com
> Cc: stepan@niakwa.com
> Cc: sales@bjcrystal.com
> Cc: century@usafast.com
> Cc: cferrell@nstar.net
> Cc: jax@europe.com
> Cc: bobbyc@eastky.net
> Cc: 90130893@mobilpost.com
> Cc: michael@zilchmail.zzn.com
> Cc: firestarter_76@hotmail.com
> Cc: gable00@msn.com
> Cc: fncbl@lycos.com
> Cc: pajarotuc@aasia.com
> Cc: ivory74@juno.com
> Cc: hall276@hotmail.com
> Cc: nguyenjj@ifrance.com
> Cc: alester@toad.net
> Cc: rosko@tampa.mindspring.com
> Cc: shanedis@hotmail.com
> Cc: breathing1@excite.com
> Cc: alvwood@hawaii.com
> Cc: shadowhawk@telia.com
> Cc: albrooklyn@earthlink.com
> Cc: news40@msn.com
> Cc: jrsobo@webbox.com
> Cc: clothier@netpci.com
> Cc: piszasz@hotmail.com
> Cc: scparker@westsound.com
> Cc: ranran67@hotmail.com
> Cc: jesseo@themail.com
> Cc: johnson@camtel.net
> Cc: melvin@illusions.net
> Cc: rodneyl_ms@msn.com
> Cc: jsdess@iname.com
> Cc: ticket@quinlanroad.com
> Cc: softwar@flashmail.com
> Cc: lgorth@certifiedmail.com
> Cc: dlmoore@primary.net
> Cc: the.internet.express@alltel.net
> Cc: taranicaustin@usa.net
> Cc: cadilstyle@mail.com
> Cc: joeantonellis@hotmail.com
> Cc: jamess3270@freeuk.com
> Cc: nms@flashmail.com
> Cc: passionflower@visto.com
> Cc: ipo_3@naples.net
> Cc: sam@sanskritc.com
> Cc: jnyikos@excite.com
> Cc: rogerst@hushmail.com
> Cc: craigeden@msn.com
> Cc: mlalonde@scia.net
> Cc: elrad@siscom.net
> Cc: albertwong@earthlink.net
> Cc: bellamore@gte.net
> Cc: chandler@dmcom.net
> Cc: jant@narf.com
> Cc: vilhelmina@ecity.net
> Cc: zacksmith@ignmail.com
> Cc: lilliank@qvs.com
> Cc: vanessa_nadine@hotmail.com
> Cc: babydoll@oasisol.com
> Cc: rsturdy@intcon.net
> Cc: etrier@excite.com
> Cc: mush_220@hotmail.com
> Cc: gdavis@pcpros.net
> Cc: howardjr@excite.com
> Cc: micwolfe@webtv.net
> Cc: bk1@webtv.net
> Cc: mbparker@gtsoftware.com
> Cc: enyawrolyat@hotmail.com
> Cc: gawlda@msn.com
> Cc: dpierce747@thenetmyway.com
> Cc: bienn@gte.net
> Cc: bach1115@hawaii.com
> Cc: hgd1@excite.com
> Subject: only you will know
> Date: Sun, 07 Mar 2004 15:48:09 00700
> MIME-Version: 1.0
> Content-Type: text/html
> Message-ID: <PLEN-SERVER1iIWeTlh0000019d@plen-server1>
> X-OriginalArrivalTime: 07 Mar 2004 22:40:27.0531 (UTC)
> FILETIME=[300245B0:01C40495]
> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> akane.covisp.net
> X-Spam-Level: **
> X-Spam-Status: No, hits=2.2 required=5.0
> tests=BAYES_01,DATE_IN_PAST_06_12,
> HTML_60_70,HTML_IMAGE_ONLY_02,HTML_MESSAGE,MIME_HTML_NO_CHARSET,
> MIME_HTML_ONLY,TO_ADDRESS_EQ_REAL autolearn=no version=2.63
>
>
>
> <html>
> <head>
> <title>weeks ago when rebels began driving police from towns
> and</title>
> </head>
> <body>
> <BR>
> <p><a href="http://www.hgju77gf.com/cu"><img
> border="0" src="http://df3ssw.com/2/"></a></p>
> <a href="http://www.hgju77gf.com/a.html">easy exit</a>
> <BR>
> <BR>
> <BR>
> <BR>
> </body>
> </html>

--
Rid yourself of doubt --
or should you?
-George Carlin
RE: CN-BR Spam sneaking through [ In reply to ]
Although sending with such a long list of CCs is bad practice a lot of
*cough* users do it all the same. If you blocked based on the number of CCs
you would also run the risk of blocking valid emails.


Mr. Michele Neylon
Blacknight Internet Solutions Ltd
http://www.blacknightsolutions.ie/
http://www.search.ie/
Tel. + 353 (0)59 9137101
Lowest price domains in Ireland

> -----Original Message-----
> From: LuKreme [mailto:kremels@kreme.com]
> Sent: 07 March 2004 22:56
> To: spamassassin-users@incubator.apache.org
> Subject: CN-BR Spam sneaking through
>
>
>
> I was surprised that all those cc: headers (96 of them) didn't trip
> something. Is there an optional rule I should install to check
> messages like this? I have bigevil and backhair currently. Spam in
> english advertising a chinese site sent to me via Brazil. Weeeee.
>
> > Return-Path: <olaeazl@hgju77gf.com>
> > X-Original-To: kreme@kreme.com
> > Delivered-To: kreme@covisp.net
> > Received: from plen-server1 (unknown [200.105.22.134])
> > by mail.covisp.net (Postfix) with ESMTP id 3232A118ACCC
> > for <kreme@kreme.com>; Sun, 7 Mar 2004 15:42:03 -0700 (MST)
> > Received: from 218.106.114.212 ([61.187.54.185]) by plen-server1 with
> > Microsoft SMTPSVC(6.0.3790.0);
> > Sun, 7 Mar 2004 17:40:25 -0500
> > From: "tamera" <olaeazl@hgju77gf.com>
> > To: "mortal@iname.com" <mortal@iname.com>
> > Cc: den@cadvision.com
> > Cc: cyberspace3@europay.com
> > Cc: eharsh@usa.net
> > Cc: kreme@kreme.com
> > Cc: grnigrl@freeuk.com
> > Cc: wbingham@twlakes.net
> > Cc: pegg@mit-it.com
> > Cc: schmoop@worldnet.att.net
> > Cc: snook5@ij.net
> > Cc: ashort@northwestfederal.com
> > Cc: geirpb2000@hotmail.com
> > Cc: mal3@angelfire.com
> > Cc: marcia@castles.com
> > Cc: rpd158@bellsouth.net
> > Cc: crystal.image@nashville.com
> > Cc: rakhan50@hotmail.com
> > Cc: doha66@pce.net
> > Cc: jimor29@usa.net
> > Cc: consultdoh@ponyexpress.net
> > Cc: altair@pegasus.com
> > Cc: pfg11@juno.com
> > Cc: aaron_van@address.com
> > Cc: stepan@niakwa.com
> > Cc: sales@bjcrystal.com
> > Cc: century@usafast.com
> > Cc: cferrell@nstar.net
> > Cc: jax@europe.com
> > Cc: bobbyc@eastky.net
> > Cc: 90130893@mobilpost.com
> > Cc: michael@zilchmail.zzn.com
> > Cc: firestarter_76@hotmail.com
> > Cc: gable00@msn.com
> > Cc: fncbl@lycos.com
> > Cc: pajarotuc@aasia.com
> > Cc: ivory74@juno.com
> > Cc: hall276@hotmail.com
> > Cc: nguyenjj@ifrance.com
> > Cc: alester@toad.net
> > Cc: rosko@tampa.mindspring.com
> > Cc: shanedis@hotmail.com
> > Cc: breathing1@excite.com
> > Cc: alvwood@hawaii.com
> > Cc: shadowhawk@telia.com
> > Cc: albrooklyn@earthlink.com
> > Cc: news40@msn.com
> > Cc: jrsobo@webbox.com
> > Cc: clothier@netpci.com
> > Cc: piszasz@hotmail.com
> > Cc: scparker@westsound.com
> > Cc: ranran67@hotmail.com
> > Cc: jesseo@themail.com
> > Cc: johnson@camtel.net
> > Cc: melvin@illusions.net
> > Cc: rodneyl_ms@msn.com
> > Cc: jsdess@iname.com
> > Cc: ticket@quinlanroad.com
> > Cc: softwar@flashmail.com
> > Cc: lgorth@certifiedmail.com
> > Cc: dlmoore@primary.net
> > Cc: the.internet.express@alltel.net
> > Cc: taranicaustin@usa.net
> > Cc: cadilstyle@mail.com
> > Cc: joeantonellis@hotmail.com
> > Cc: jamess3270@freeuk.com
> > Cc: nms@flashmail.com
> > Cc: passionflower@visto.com
> > Cc: ipo_3@naples.net
> > Cc: sam@sanskritc.com
> > Cc: jnyikos@excite.com
> > Cc: rogerst@hushmail.com
> > Cc: craigeden@msn.com
> > Cc: mlalonde@scia.net
> > Cc: elrad@siscom.net
> > Cc: albertwong@earthlink.net
> > Cc: bellamore@gte.net
> > Cc: chandler@dmcom.net
> > Cc: jant@narf.com
> > Cc: vilhelmina@ecity.net
> > Cc: zacksmith@ignmail.com
> > Cc: lilliank@qvs.com
> > Cc: vanessa_nadine@hotmail.com
> > Cc: babydoll@oasisol.com
> > Cc: rsturdy@intcon.net
> > Cc: etrier@excite.com
> > Cc: mush_220@hotmail.com
> > Cc: gdavis@pcpros.net
> > Cc: howardjr@excite.com
> > Cc: micwolfe@webtv.net
> > Cc: bk1@webtv.net
> > Cc: mbparker@gtsoftware.com
> > Cc: enyawrolyat@hotmail.com
> > Cc: gawlda@msn.com
> > Cc: dpierce747@thenetmyway.com
> > Cc: bienn@gte.net
> > Cc: bach1115@hawaii.com
> > Cc: hgd1@excite.com
> > Subject: only you will know
> > Date: Sun, 07 Mar 2004 15:48:09 00700
> > MIME-Version: 1.0
> > Content-Type: text/html
> > Message-ID: <PLEN-SERVER1iIWeTlh0000019d@plen-server1>
> > X-OriginalArrivalTime: 07 Mar 2004 22:40:27.0531 (UTC)
> > FILETIME=[300245B0:01C40495]
> > X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> > akane.covisp.net
> > X-Spam-Level: **
> > X-Spam-Status: No, hits=2.2 required=5.0
> > tests=BAYES_01,DATE_IN_PAST_06_12,
> > HTML_60_70,HTML_IMAGE_ONLY_02,HTML_MESSAGE,MIME_HTML_NO_CHARSET,
> > MIME_HTML_ONLY,TO_ADDRESS_EQ_REAL autolearn=no version=2.63
> >
> >
> >
> > <html>
> > <head>
> > <title>weeks ago when rebels began driving police from towns
> > and</title>
> > </head>
> > <body>
> > <BR>
> > <p><a href="http://www.hgju77gf.com/cu"><img
> > border="0" src="http://df3ssw.com/2/"></a></p>
> > <a href="http://www.hgju77gf.com/a.html">easy exit</a>
> > <BR>
> > <BR>
> > <BR>
> > <BR>
> > </body>
> > </html>
>
> --
> Rid yourself of doubt --
> or should you?
> -George Carlin
>


--
Email scanned by Blacknight for viruses and dangerous content.
Visit http://www.blacknight.ie for more information