I noticed that the [EMAIL PROTECTED] filter got tripped without the @LINKED filter. Please download a more recent copy from my site. This obviously shouldn't be happening.
Matt
Kami Razvan wrote:
Hi;
We just got the following: - a Phishing attempt.
Actually quite interesting.. I clicked on the link to see where it goes. It goes to the actual Visa site but a small window pops up and asks for your visa and various other info for verification.
If only they could use their talents elsewhere..
=================================
Received: from 81.15.163.193 [81.15.163.193] by foroosh.com
(SMTPD32-8.04) id A74D28C01E2; Fri, 05 Dec 2003 14:06:53 -0500
Date: Fri, 05 Dec 2003 22:15:45 -0500
From: Visa International Service <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
Reply-To: Visa International Service <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
Organization: Visa International Service
X-Priority: 3 (Normal)
To: xxxxxxxxxxxxxxxxxxxx <mailto:[EMAIL PROTECTED]>
Subject: [53~]Visa Security Update
Mime-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Message-Id: <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
X-IMAIL-SPAM-DNSBL: (SPAMCOP,42729954,127.0.0.2)
X-IMAIL-SPAM-VALHELO: (42729954)
X-IMAIL-SPAM-VALFROM: (42729954)
X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8004000f].
X-RBL-Warning: HELOBOGUS: Domain 81.15.163.193 has no MX or A records.
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: COUNTRY: Message failed COUNTRY test (line 172, weight 1)
X-RBL-Warning: FILTER-HEADER-XMAIL: Message failed FILTER-HEADER-XMAIL test (line 46, weight 35)
X-RBL-Warning: FILTER-MAILFROM: Message failed FILTER-MAILFROM test (line 49, weight 5)
X-RBL-Warning: FILTER-SPAM-HTML: Message failed FILTER-SPAM-HTML test (line 146, weight 10)
X-RBL-Warning: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>: Message failed [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> test (line 385, weight 0)
X-Declude-Sender: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> [81.15.163.193]
X-Declude-Spoolname: Dd74d028c01e2d4e2.SMD
X-Note: This E-mail was scanned & filtered by Declude [1.77] for SPAM & virus.
X-Weight: 53
X-Note: Sent from Reverse DNS: 163-193.promontel.net.pl
X-Hello: 81.15.163.193
X-Spam-Tests-Failed: BADHEADERS, HELOBOGUS, IPNOTINMX, COUNTRY, FILTER-HEADER-XMAIL, FILTER-MAILFROM, FILTER-SPAM-HTML, [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>, WEIGHT20s, WEIGHT20r
X-Note: Recipient(s): xxxxxxxxxxxxxxxxxx
X-Country-Chain: POLAND->destination
X-RCPT-TO: <xxxxxxxxxxxxxxxxxxxx <mailto:[EMAIL PROTECTED]>
Status: U
X-UIDL: 331472220
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
