Mailing List Archive: How did this one get through?

How did this one get through?

Mar 12, 2004, 7:33 AM

Post #1 of 14 (1435 views)

I am running a fairly stock 2.63 installation with Postfix, antidrug,
bigevil, chickenpox, weeds_2 rule sets. I would have thought that a
spam with the big-V spelled out, not even mispeled, would have been
flagged for sure.

Here's some of the headers.

What did I mis-configure?

Thanx!

-Michael

===========================

Received: from fw-3.alliednational.com
([172.16.30.253])
by alliednational.com; Thu, 11 Mar 2004 20:09:58 -0600
Received: by fw-3.alliednational.com (Postfix, from userid 500)
id 3CB647532A; Thu, 11 Mar 2004 20:09:59 -0600 (CST)
Received: from p5087fe8a.dip.t-dialin.net (p5087FE8A.dip.t-dialin.net
[80.135.254.138])
by fw-3.alliednational.com (Postfix) with SMTP
id 173D275329; Thu, 11 Mar 2004 20:09:42 -0600 (CST)
X-Message-Info: LATVfTD89oJmpXTDc21u2JE2CLYmiUXa
Received: from pfikryb58.worldnet.att.net ([56.238.128.250]) by
zv2-o60.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824);
Fri, 12 Mar 2004 03:04:34 +0100
Received: from copefleetdemultiplexwi38 (adventitious[143.40.246.152])
by worldnet.att.net (fmntftg77) with SMTP
id <54399259871636198846dqa1l>
(Authid: LouBass);
Fri, 12 Mar 2004 06:03:34 +0400
From: "Sophie Mcneill" <FreddieL@dsb-wol.de>
To: "'CWl'" <cw@alliednational.com>
Subject: Pound her all week.
Date: Thu, 11 Mar 2004 23:03:34 -0300
Message-ID: <615456f9hw81$5f5v6484$65b3akxs@consortdandeliondiskuq77>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--45708503443214560846"
X-Spam-Status: No, hits=2.5 required=5.0 tests=BAYES_50,HTML_MESSAGE,
LOCAL_DRUGS_MALEDYSFUNCTION,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI

autolearn=no version=2.63
X-Spam-Level: **
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
fw-3.alliednational.com

----45708503443214560846
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<HTML><BODY>
Generic Cíalis (Regalís), at cheap prices. 
Most places charge $20, we charge $5. Quite a difference. 
Cialis is known as a Super-Víagra or Weekend-Víagra because its effect
s start sooner and last much longer.
Shipped worldwide. <A
HREF="http://www.mega-health.net/cia/?niceguy"
>
Your easy-to-use solution is here</A>
 Link below is for that people who dislike
adv.....
 <A HREF="http://www.mega-health.net/off.html">.</A> -==-
 accommodate elution southbound carefree remission
prosecu
te honeydew five binary balky eighth prescribe dakar saliva hadley
occipit
al wynn future pliant boardinghouse dod parson boat shawl
administratrix g
ypsite spook archdiocese clint clearheaded mort ghent viscoelastic
hydrost
atic injure cheerleader warmhearted broadcast bragg luger monster
sympa
thy peppery knapp gilligan trig valley gladdy irresponsible nepal
caryatid
magisterial carbone submit jesse thailand petite maximum csnet
harmony
quality lebensraum viennese ragweed extremal shard dispersion elgin
viney
ard authenticate loaves corrode artifice cryostat venial berea welfare
com
bine renegotiable too cohen appalachia sonogram asteroid spray helpmate
br
uce desecrate fictive
</BODY></HTML>

----45708503443214560846--

Re: How did this one get through? [ In reply to ]

kevin.peuhkurinen at hepcoe

Mar 12, 2004, 7:38 AM

Post #2 of 14 (1426 views)

Permalink

The use of the accented 'i' in the drug names probably wasn't taken into
consideration by the antidrug rule set. I'd almost hazard the guess
that the spammer knew that.

Also, the stock BAYES_50 score is very low. I personally have greatly
increased mine.

Michael Weber wrote:

>I am running a fairly stock 2.63 installation with Postfix, antidrug,
>bigevil, chickenpox, weeds_2 rule sets. I would have thought that a
>spam with the big-V spelled out, not even mispeled, would have been
>flagged for sure.
>
>Here's some of the headers.
>
>What did I mis-configure?
>
>Thanx!
>
>-Michael
>
>===========================
>
>Received: from fw-3.alliednational.com
> ([172.16.30.253])
> by alliednational.com; Thu, 11 Mar 2004 20:09:58 -0600
>Received: by fw-3.alliednational.com (Postfix, from userid 500)
> id 3CB647532A; Thu, 11 Mar 2004 20:09:59 -0600 (CST)
>Received: from p5087fe8a.dip.t-dialin.net (p5087FE8A.dip.t-dialin.net
>[80.135.254.138])
> by fw-3.alliednational.com (Postfix) with SMTP
> id 173D275329; Thu, 11 Mar 2004 20:09:42 -0600 (CST)
>X-Message-Info: LATVfTD89oJmpXTDc21u2JE2CLYmiUXa
>Received: from pfikryb58.worldnet.att.net ([56.238.128.250]) by
>zv2-o60.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824);
> Fri, 12 Mar 2004 03:04:34 +0100
>Received: from copefleetdemultiplexwi38 (adventitious[143.40.246.152])
> by worldnet.att.net (fmntftg77) with SMTP
> id <54399259871636198846dqa1l>
> (Authid: LouBass);
> Fri, 12 Mar 2004 06:03:34 +0400
>From: "Sophie Mcneill" <FreddieL@dsb-wol.de>
>To: "'CWl'" <cw@alliednational.com>
>Subject: Pound her all week.
>Date: Thu, 11 Mar 2004 23:03:34 -0300
>Message-ID: <615456f9hw81$5f5v6484$65b3akxs@consortdandeliondiskuq77>
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
> boundary="--45708503443214560846"
>X-Spam-Status: No, hits=2.5 required=5.0 tests=BAYES_50,HTML_MESSAGE,
> LOCAL_DRUGS_MALEDYSFUNCTION,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI
>
> autolearn=no version=2.63
>X-Spam-Level: **
>X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
> fw-3.alliednational.com
>
>----45708503443214560846
>Content-Type: text/html; charset="us-ascii"
>Content-Transfer-Encoding: quoted-printable
>
><HTML><BODY>
>Generic Cíalis (Regalís), at cheap prices. 
>Most places charge $20, we charge $5. Quite a difference. 
>Cialis is known as a Super-Víagra or Weekend-Víagra because its effect
>s start sooner and last much longer.
>Shipped worldwide. <A
>HREF="http://www.mega-health.net/cia/?niceguy"
>
>
>Your easy-to-use solution is here</A>
> Link below is for that people who dislike
>adv.....
> <A HREF="http://www.mega-health.net/off.html">.</A> -==-
> accommodate elution southbound carefree remission
>prosecu
>te honeydew five binary balky eighth prescribe dakar saliva hadley
>occipit
>al wynn future pliant boardinghouse dod parson boat shawl
>administratrix g
>ypsite spook archdiocese clint clearheaded mort ghent viscoelastic
>hydrost
>atic injure cheerleader warmhearted broadcast bragg luger monster
>sympa
>thy peppery knapp gilligan trig valley gladdy irresponsible nepal
>caryatid
> magisterial carbone submit jesse thailand petite maximum csnet
>harmony
> quality lebensraum viennese ragweed extremal shard dispersion elgin
>viney
>ard authenticate loaves corrode artifice cryostat venial berea welfare
>com
>bine renegotiable too cohen appalachia sonogram asteroid spray helpmate
>br
>uce desecrate fictive
></BODY></HTML>
>
>
>----45708503443214560846--
>
>
>
>

Re: How did this one get through? [ In reply to ]

dbfunk at engineering

Mar 12, 2004, 2:00 PM

Post #3 of 14 (1422 views)

Permalink

On Fri, 12 Mar 2004, Michael Weber wrote:

> I am running a fairly stock 2.63 installation with Postfix, antidrug,
> bigevil, chickenpox, weeds_2 rule sets. I would have thought that a
> spam with the big-V spelled out, not even mispeled, would have been
> flagged for sure.
>
> Here's some of the headers.
>
> What did I mis-configure?
>
> Thanx!
>
> -Michael
>
> ===========================
>
> Received: from fw-3.alliednational.com
> ([172.16.30.253])
> by alliednational.com; Thu, 11 Mar 2004 20:09:58 -0600
> Received: by fw-3.alliednational.com (Postfix, from userid 500)
> id 3CB647532A; Thu, 11 Mar 2004 20:09:59 -0600 (CST)
> Received: from p5087fe8a.dip.t-dialin.net (p5087FE8A.dip.t-dialin.net
> [80.135.254.138])
> by fw-3.alliednational.com (Postfix) with SMTP
> id 173D275329; Thu, 11 Mar 2004 20:09:42 -0600 (CST)
[snip..]

Strong suggestion, enable network tests. That sending IP
address hit 9 different DNSBLs that I know of.

If you're going to use custom rulesets, consider creating your
own version of BigEvil. I use Chris's BigEvil, but have my own too
(quicker updates that way).

That 'www.mega-health.net' uri has been appearing in spam for over a week
now. (I know because that's when I added it to my rule).

--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{

RE: How did this one get through? [ In reply to ]

csanterre at MerchantsOverseas

Mar 15, 2004, 8:36 AM

Post #4 of 14 (1420 views)

Permalink

> -----Original Message-----
> From: David B Funk [mailto:dbfunk@engineering.uiowa.edu]
> Sent: Friday, March 12, 2004 4:01 PM
> To: Michael Weber
> Cc: spamassassin-users@incubator.apache.org
> Subject: Re: How did this one get through?
>
>
> On Fri, 12 Mar 2004, Michael Weber wrote:
>
> > I am running a fairly stock 2.63 installation with Postfix,
> antidrug,
> > bigevil, chickenpox, weeds_2 rule sets. I would have thought that a
> > spam with the big-V spelled out, not even mispeled, would have been
> > flagged for sure.
> >
> > Here's some of the headers.
> >
> > What did I mis-configure?
> >
> > Thanx!
> >
> > -Michael
> >
> > ===========================
> >
> > Received: from fw-3.alliednational.com
> > ([172.16.30.253])
> > by alliednational.com; Thu, 11 Mar 2004 20:09:58 -0600
> > Received: by fw-3.alliednational.com (Postfix, from userid 500)
> > id 3CB647532A; Thu, 11 Mar 2004 20:09:59 -0600 (CST)
> > Received: from p5087fe8a.dip.t-dialin.net
> (p5087FE8A.dip.t-dialin.net
> > [80.135.254.138])
> > by fw-3.alliednational.com (Postfix) with SMTP
> > id 173D275329; Thu, 11 Mar 2004 20:09:42 -0600 (CST)
> [snip..]
>
> Strong suggestion, enable network tests. That sending IP
> address hit 9 different DNSBLs that I know of.
>
> If you're going to use custom rulesets, consider creating your
> own version of BigEvil. I use Chris's BigEvil, but have my own too
> (quicker updates that way).
>
> That 'www.mega-health.net' uri has been appearing in spam for
> over a week
> now. (I know because that's when I added it to my rule).
>

Yeah I've had that in my list for a long time to add. I'm sorry to everyone
for not updating Bigevil sooner. I've been working on it, but Soooooo many
domains were submited that it got crazy. I'm going to finish the list I have
left today, and test overnight. I'm sorry but I just can't accept domain
lists more then 15 per person. Somone giving me lists they have collected
for a month of 100s of domains is to costly to try to do. Many of the
domains aren't live anymore. *sigh* But I have to check them all. Its not in
my nature to just blow off a submitted list. So I tried :)

So it the attempt to remain fresh, please limit Bigevil submisions to no
more then 15 domains. Thanks!!!

--Chris

RE: How did this one get through? [ In reply to ]

jcrowe at midwestglove

Mar 15, 2004, 9:08 AM

Post #5 of 14 (1422 views)

Permalink

What about a online submitting form that check for active dns then sends you
the live ones?

> -----Original Message-----
> From: Chris Santerre [mailto:csanterre@MerchantsOverseas.com]
> Sent: Monday, March 15, 2004 9:37 AM
> To: 'David B Funk'; Michael Weber
> Cc: spamassassin-users@incubator.apache.org
> Subject: RE: How did this one get through?
>
> Yeah I've had that in my list for a long time to add. I'm
> sorry to everyone
> for not updating Bigevil sooner. I've been working on it, but
> Soooooo many
> domains were submited that it got crazy. I'm going to finish
> the list I have
> left today, and test overnight. I'm sorry but I just can't
> accept domain
> lists more then 15 per person. Somone giving me lists they
> have collected
> for a month of 100s of domains is to costly to try to do. Many of the
> domains aren't live anymore. *sigh* But I have to check them
> all. Its not in
> my nature to just blow off a submitted list. So I tried :)
>
> So it the attempt to remain fresh, please limit Bigevil
> submisions to no
> more then 15 domains. Thanks!!!
>
> --Chris
>
>

Re: How did this one get through? [ In reply to ]

mkettler at evi-inc

Mar 15, 2004, 9:36 AM

Post #6 of 14 (1421 views)

Permalink

At 09:38 AM 3/12/2004, Kevin Peuhkurinen wrote:
>The use of the accented 'i' in the drug names probably wasn't taken into
>consideration by the antidrug rule set. I'd almost hazard the guess that
>the spammer knew that.

Actually, the accented 'i' is taken into consideration by antidrug.cf, but
only if it's done using HTML style escaping. It's hard to tell if the
original was HTML-escaped or not, since Michael sent us a copy-paste of the
email, which is may have been re-interpreted and re-encoded by his mail
client. I suspect the spammer sent it un-escaped, as I have a couple
identical emails which seem to be un-escaped.

__DRUGS_MALEDYSFUNCTION10 catches the accented-i trick, when using HTML codes.

However, Mikes assertion was that the v-word was not mis-spelled.. That's
not true.. it is mis-spelled because they are using a character that
doesn't exist in the English language.

The Antidrug ruleset did notice that maledysfunction drugs were named in
the email, but the antidrug ruleset is somewhat conservative in it's
default scoring, so the email only gained 1.0 from antidrug. If this
bothers you, jack it up.

Theoretically, antidrug should have noticed it was obfuscated and given it
another 0.5 points, but it failed to detect that. Probably because of the
non-escaped accented-i character. I'll work on that for 0.60 of antidrug,
when I have time.

The one that I've got which is identical in it's body content (with
escaped-i regalis) got these hits here:
X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required 5,
BAYES_99 5.40, HTML_MESSAGE 0.10, LOCAL_DRUGS_MALEDYSFUNCTION 1.00,
MIME_HTML_ONLY 0.32, MIME_HTML_ONLY_MULTI 1.10,
RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71, RCVD_IN_NJABL 0.10,
RCVD_IN_NJABL_PROXY 0.50, RCVD_IN_SORBS 0.10,
RCVD_IN_SORBS_HTTP 1.10, RCVD_IN_SORBS_SOCKS 1.20)

Now, most of the points on mine come from DNSBLs, and a well-trained bayes
database, but the relay used for Michael's email is indeed listed in DSBL,
NJABL-dialup, SBL, and a couple of DNSBls not used by sa:
http://www.dnsstuff.com/tools/ip4r.ch?ip=80.135.254.138

It shouldn't be hard for Michael to tweak his antidrug scores to his
liking, do some extra bayes training, and consider enabling DNSBLs (if he
can afford the processing time on his server) by installing Net::DNS.

RE: How did this one get through? [ In reply to ]

Philip.Townsend at ogletreedeakins

Mar 15, 2004, 10:19 AM

Post #7 of 14 (1421 views)

Permalink

X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required 5,
BAYES_99 5.40, HTML_MESSAGE 0.10, LOCAL_DRUGS_MALEDYSFUNCTION 1.00,
MIME_HTML_ONLY 0.32, MIME_HTML_ONLY_MULTI 1.10,
RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71, RCVD_IN_NJABL 0.10,
RCVD_IN_NJABL_PROXY 0.50, RCVD_IN_SORBS 0.10,
RCVD_IN_SORBS_HTTP 1.10, RCVD_IN_SORBS_SOCKS 1.20)

How do I set MailScanner to give me the scores for each rule it finds like
in the above header? Mine would have looked something like this:
X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required 5,
BAYES_99, HTML_MESSAGE, LOCAL_DRUGS_MALEDYSFUNCTION,
MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI,
RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_NJABL,
RCVD_IN_NJABL_PROXY, RCVD_IN_SORBS,
RCVD_IN_SORBS_HTTP, RCVD_IN_SORBS_SOCKS)
Thanks.

-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Monday, March 15, 2004 11:36 AM
To: Kevin Peuhkurinen; Michael Weber
Cc: spamassassin-users@incubator.apache.org
Subject: Re: How did this one get through?

At 09:38 AM 3/12/2004, Kevin Peuhkurinen wrote:
>The use of the accented 'i' in the drug names probably wasn't taken into
>consideration by the antidrug rule set. I'd almost hazard the guess that
>the spammer knew that.

Actually, the accented 'i' is taken into consideration by antidrug.cf, but
only if it's done using HTML style escaping. It's hard to tell if the
original was HTML-escaped or not, since Michael sent us a copy-paste of the
email, which is may have been re-interpreted and re-encoded by his mail
client. I suspect the spammer sent it un-escaped, as I have a couple
identical emails which seem to be un-escaped.

__DRUGS_MALEDYSFUNCTION10 catches the accented-i trick, when using HTML
codes.

However, Mikes assertion was that the v-word was not mis-spelled.. That's
not true.. it is mis-spelled because they are using a character that
doesn't exist in the English language.

The Antidrug ruleset did notice that maledysfunction drugs were named in
the email, but the antidrug ruleset is somewhat conservative in it's
default scoring, so the email only gained 1.0 from antidrug. If this
bothers you, jack it up.

Theoretically, antidrug should have noticed it was obfuscated and given it
another 0.5 points, but it failed to detect that. Probably because of the
non-escaped accented-i character. I'll work on that for 0.60 of antidrug,
when I have time.

The one that I've got which is identical in it's body content (with
escaped-i regalis) got these hits here:
X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required 5,
BAYES_99 5.40, HTML_MESSAGE 0.10, LOCAL_DRUGS_MALEDYSFUNCTION 1.00,
MIME_HTML_ONLY 0.32, MIME_HTML_ONLY_MULTI 1.10,
RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71, RCVD_IN_NJABL 0.10,
RCVD_IN_NJABL_PROXY 0.50, RCVD_IN_SORBS 0.10,
RCVD_IN_SORBS_HTTP 1.10, RCVD_IN_SORBS_SOCKS 1.20)

Now, most of the points on mine come from DNSBLs, and a well-trained bayes
database, but the relay used for Michael's email is indeed listed in DSBL,
NJABL-dialup, SBL, and a couple of DNSBls not used by sa:
http://www.dnsstuff.com/tools/ip4r.ch?ip=80.135.254.138

It shouldn't be hard for Michael to tweak his antidrug scores to his
liking, do some extra bayes training, and consider enabling DNSBLs (if he
can afford the processing time on his server) by installing Net::DNS.

RE: How did this one get through? [ In reply to ]

andy.jezierski at stepan

Mar 15, 2004, 10:27 AM

Post #8 of 14 (1423 views)

Permalink

"Townsend, Philip W." <Philip.Townsend@ogletreedeakins.com> wrote on
03/15/2004 11:19:03 AM:

> X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required
5,
> BAYES_99 5.40, HTML_MESSAGE 0.10, LOCAL_DRUGS_MALEDYSFUNCTION
1.00,
> MIME_HTML_ONLY 0.32, MIME_HTML_ONLY_MULTI 1.10,
> RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71, RCVD_IN_NJABL
0.10,
> RCVD_IN_NJABL_PROXY 0.50, RCVD_IN_SORBS 0.10,
> RCVD_IN_SORBS_HTTP 1.10, RCVD_IN_SORBS_SOCKS 1.20)
>
> How do I set MailScanner to give me the scores for each rule it finds
like
> in the above header? Mine would have looked something like this:
> X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required
5,
> BAYES_99, HTML_MESSAGE, LOCAL_DRUGS_MALEDYSFUNCTION,
> MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI,
> RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_NJABL,
> RCVD_IN_NJABL_PROXY, RCVD_IN_SORBS,
> RCVD_IN_SORBS_HTTP, RCVD_IN_SORBS_SOCKS)
> Thanks.
>
>
[snip]

Add

Include Scores In SpamAssassin Report = yes

to your mailscanner.conf file

Re: How did this one get through? [ In reply to ]

eddy.beliveau at hec

Mar 15, 2004, 1:29 PM

Post #9 of 14 (1425 views)

Permalink

Hi!

How can I have the same display with amavisd-new

thanks,
Eddy
----- Original Message -----
From: andy.jezierski@stepan.com
To: Townsend, Philip W.
Cc: spamassassin-users@incubator.apache.org
Sent: Monday, March 15, 2004 12:27 PM
Subject: RE: How did this one get through?

"Townsend, Philip W." <Philip.Townsend@ogletreedeakins.com> wrote on 03/15/2004 11:19:03 AM:

> X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required 5,
> BAYES_99 5.40, HTML_MESSAGE 0.10, LOCAL_DRUGS_MALEDYSFUNCTION 1.00,
> MIME_HTML_ONLY 0.32, MIME_HTML_ONLY_MULTI 1.10,
> RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71, RCVD_IN_NJABL 0.10,
> RCVD_IN_NJABL_PROXY 0.50, RCVD_IN_SORBS 0.10,
> RCVD_IN_SORBS_HTTP 1.10, RCVD_IN_SORBS_SOCKS 1.20)
>
> How do I set MailScanner to give me the scores for each rule it finds like
> in the above header? Mine would have looked something like this:
> X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=13.132, required 5,
> BAYES_99, HTML_MESSAGE, LOCAL_DRUGS_MALEDYSFUNCTION,
> MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI,
> RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_NJABL,
> RCVD_IN_NJABL_PROXY, RCVD_IN_SORBS,
> RCVD_IN_SORBS_HTTP, RCVD_IN_SORBS_SOCKS)
> Thanks.
>
>
[snip]

Add

Include Scores In SpamAssassin Report = yes

to your mailscanner.conf file

Re: How did this one get through? [ In reply to ]

jriley at spamfighter

Mar 15, 2004, 3:51 PM

Post #10 of 14 (1424 views)

Permalink

Subject: Re: How did this one get through?

I wish I had a dollar for everytime I've seen "how did this one get through" in the subject line of postings to this list.

-JR

Re: How did this one get through? [ In reply to ]

email at ace

Mar 16, 2004, 7:38 AM

Post #11 of 14 (1419 views)

Permalink

I wish I had a dollar for every mail posted to a mail list using HTML by
admin staff that should know better.

>*********** REPLY SEPARATOR ***********
>
>On 15/03/2004 at 4:51 PM JRiley wrote:
>Subject: Re: How did this one get through?
>
>
>I wish I had a dollar for everytime I've seen "how did this one get
>through" in the subject line of postings to this list.
>
>-JR

Re: How did this one get through? [ In reply to ]

evan at espphotography

Mar 16, 2004, 8:10 AM

Post #12 of 14 (1421 views)

Permalink

At 06:38 AM 3/16/2004, you wrote:
>I wish I had a dollar for every mail posted to a mail list using HTML by
>admin staff that should know better.

And with a 400 line copyright disclaimer. :)

Evan

Re: How did this one get through? [ In reply to ]

apthorpe+sa at cynistar

Mar 16, 2004, 8:13 AM

Post #13 of 14 (1424 views)

Permalink

On Tue, 16 Mar 2004 07:10:46 -0800 Evan Platt <evan@espphotography.com> wrote:

> At 06:38 AM 3/16/2004, you wrote:
> >I wish I had a dollar for every mail posted to a mail list using HTML by
> >admin staff that should know better.
>
> And with a 400 line copyright disclaimer. :)

Then you'd have enough money to buy some of those Nigerian barnyard
toner mortgage enlargement pills. :P

-- Bob

Re: How did this one get through? [ In reply to ]

evan at espphotography

Mar 16, 2004, 8:22 AM

Post #14 of 14 (1422 views)

Permalink

At 07:13 AM 3/16/2004, you wrote:

>Then you'd have enough money to buy some of those Nigerian barnyard
>toner mortgage enlargement pills. :P

Only if they're herbal....

Evan