ello all,
attached are three samples. i get at least one (usually two or three)
of these a day. i have reported LOTS of these. after about two
or three weeks of reporting these however, along with all the other
spam i report, i gave up reporting because they kept arriving and
they kept changing enough that i kept receiving them anyway.
reporting one of them, and then checking it works correctly. that
is, it's reported correctly and then checking marks it as spam.
it looks like someone has identified a good way to mutate email
though so that it gets through razor2. for this i might have to
use one of those bayesian filters (e.g., ESR's bogofilter). i
hesitate to use that for a real email server though, two filters.
i hope this helps cloudmark figure out how to fix this particular
mutating email problem.
note: i reported 1.txt for testing. i have not reported 2.txt or
3.txt. as i said though, i reported weeks worth of this until i
gave up and decided to keep the samples instead for reporting
to this list.
tiger
--
Gerald Timothy Quimpo tiger*quimpo*org gquimpo*sni-inc.com tiger*sni*ph
Veritas liberabit vos.
>From [EMAIL PROTECTED] Sat Oct 5 14:02:07 2002
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: from localhost (localhost.localdomain [127.0.0.1]) by
mail.quimpo.org (Postfix) with ESMTP id 4BA40849D for <tiger@localhost>;
Sat, 5 Oct 2002 14:02:07 -0400 (EDT)
Received: from sni-inc.com [63.209.232.148] by localhost with POP3
(fetchmail-5.9.11) for tiger@localhost (single-drop); Sat, 05 Oct 2002
14:02:07 -0400 (EDT)
Received: (from root@localhost) by ns2.sni.ph (8.11.6/8.11.6) id
g95Hwmw34094 for [EMAIL PROTECTED]; Sat, 5 Oct 2002 13:58:48 -0400 (EDT)
Received: from ns.sni.ph (ns.sni.ph [202.57.48.9]) by ns2.sni.ph
(8.11.6/8.11.6) with ESMTP id g95HwjH33935 for <[EMAIL PROTECTED]>; Sat, 5
Oct 2002 13:58:45 -0400 (EDT)
From: [EMAIL PROTECTED]
Received: (from root@localhost) by ns.sni.ph (8.11.6/8.11.6) id
g95I1DN03609 for [EMAIL PROTECTED]; Sun, 6 Oct 2002 02:01:13 +0800 (PHT)
Received: from localhost (localhost [127.0.0.1]) by ns.sni.ph
(8.11.6/8.11.6) with ESMTP id g95I1Aq03524 for <tiger@localhost>; Sun, 6
Oct 2002 02:01:10 +0800 (PHT)
Received: from cdo.weblinq.com by localhost with POP3 (fetchmail-5.3.0) for
tiger@localhost (single-drop); Sun, 06 Oct 2002 02:01:10 +0800 (PHT)
Received: from yahoo.com (customer.iplannetworks.net [200.69.218.121] (may
be forged)) by cdo.weblinq.com (8.12.5/8.12.5) with SMTP id g95Hb6YC002267
for <[EMAIL PROTECTED]>; Sun, 6 Oct 2002 01:37:09 +0800 (PHT)
Received: from [107.77.3.1] by da001d2020.loxi.pianstvu.net with local; 06
Oct 2002 13:30:02 -0500
Reply-To: <[EMAIL PROTECTED]>
Message-ID: <031a42b61b7d$5281e7e5$0da10cd8@ihsuae>
To: [EMAIL PROTECTED]
Subject: ** You are -Approved-!
Date: Sun, 06 Oct 2002 17:00:06 -0900
MiME-Version: 1.0
X-scanner: scanned by SNI 1.0.10 - (http://www.sni.ph)
Content-Type: multipart/mixed; boundary="----=_NextPart_000_00B4_03A08A4D.D8583B01"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: MIME-tools 5.503 (Entity 5.501)
Importance: Normal
X-scanner: scanned by SNI 1.0.12.3 - (http://www.sni-inc.com)
X-UIDL: =,6"!Mhj!!QKc!!gNY!!
Status:
X-Evolution-Source: pop://tiger@localhost/inbox
------=_NextPart_000_00B4_03A08A4D.D8583B01
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
<html>
<body>
<font color="ffffff">wheel</font>
<p>Your home refinance loan is approved!<br></p><br>
<p>To get your approved amount <a href="http://cbulkhost.com/idc/";>go
here</a>.</p>
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>
<p>To be excluded from further notices <a
href="http://cbulkhost.com/idc/remove.html";>go
here</a>.</p>
<font color="ffffff">wheel</font>
</body>
<font color="ffffff">1gate
</html>
2507itXl1-436OQPw8143oYmk0-749bNeD1469WDYc5-514OVBQl48
------=_NextPart_000_00B4_03A08A4D.D8583B01--
>From [EMAIL PROTECTED] Fri Oct 4 00:23:14 2002
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: from localhost (localhost.localdomain [127.0.0.1]) by
mail.quimpo.org (Postfix) with ESMTP id BCF988B09 for <tiger@localhost>;
Fri, 4 Oct 2002 00:23:14 -0400 (EDT)
Received: from sni-inc.com [63.209.232.148] by localhost with POP3
(fetchmail-5.9.11) for tiger@localhost (single-drop); Fri, 04 Oct 2002
00:23:14 -0400 (EDT)
Received: (from root@localhost) by ns2.sni.ph (8.11.6/8.11.6) id
g943wh161124 for [EMAIL PROTECTED]; Thu, 3 Oct 2002 23:58:43 -0400 (EDT)
Received: from ns.sni.ph (ns.sni.ph [202.57.48.9]) by ns2.sni.ph
(8.11.6/8.11.6) with ESMTP id g943wd260942 for <[EMAIL PROTECTED]>; Thu, 3
Oct 2002 23:58:40 -0400 (EDT)
From: [EMAIL PROTECTED]
Received: (from root@localhost) by ns.sni.ph (8.11.6/8.11.6) id
g9441CI12699 for [EMAIL PROTECTED]; Fri, 4 Oct 2002 12:01:12 +0800 (PHT)
Received: from localhost (localhost [127.0.0.1]) by ns.sni.ph
(8.11.6/8.11.6) with ESMTP id g9441Al12626 for <tiger@localhost>; Fri, 4
Oct 2002 12:01:10 +0800 (PHT)
Received: from cdo.weblinq.com by localhost with POP3 (fetchmail-5.3.0) for
tiger@localhost (single-drop); Fri, 04 Oct 2002 12:01:10 +0800 (PHT)
Received: from lycos.com ([218.11.168.182]) by cdo.weblinq.com
(8.12.5/8.12.5) with SMTP id g943ZGYC018398 for <[EMAIL PROTECTED]>;
Fri, 4 Oct 2002 11:35:26 +0800 (PHT)
Received: from [81.1.110.3] by rly-xl05.dohuya.com with esmtp; Fri, 04 Oct
2002 18:30:25 -0300
Received: from unknown (HELO asy100.as122.sol-superunderline.com)
(51.122.71.93) by a231242.upc-a.zhello.nl with esmtp; 04 Oct 2002 15:29:51
+0900
Received: from 131.34.182.27 ([131.34.182.27]) by mx.loxsystems.net with
esmtp; 05 Oct 2002 00:29:17 -0500
Received: from [42.210.138.200] by rly-xw05.oxyeli.com with SMTP; 04 Oct
2002 19:28:43 -0400
Reply-To: <[EMAIL PROTECTED]>
Message-ID: <000e28a86e7b$6275b0e5$2cc13db1@sgwjou>
To: [EMAIL PROTECTED]
Subject: ** You are approved. **
Date: Sat, 05 Oct 2002 02:22:43 -1100
MiME-Version: 1.0
X-scanner: scanned by SNI 1.0.10 - (http://www.sni.ph)
Content-Type: multipart/mixed; boundary="----=_NextPart_000_00B3_82B21B3B.E5484D64"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Internet Mail Service (5.5.2650.21)
Importance: Normal
X-scanner: scanned by SNI 1.0.12.3 - (http://www.sni-inc.com)
X-UIDL: +2^!!]7~!!ojn"!?fb"!
Status:
X-Evolution-Source: pop://tiger@localhost/inbox
------=_NextPart_000_00B3_82B21B3B.E5484D64
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
<html>
<body>
<font color="ffffff">kiwi</font>
<p>Your home refinance loan is approved!<br></p><br>
<p>To get your approved amount <a href="http://www.2getfreequotes.com/";>go
here</a>.</p>
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>
<p>To be excluded from further notices <a
href="http://www.2getfreequotes.com/remove.html";>go
here</a>.</p>
<font color="ffffff">kiwi</font>
</body>
<font color="ffffff">1gate
</html>
2577DVkG2-430ggxM6419Rhnw2-023wDCp7394nHfk8-192kkwT2139Vtkr4-031HIyC4765fWCg9-6l74
------=_NextPart_000_00B3_82B21B3B.E5484D64--
>From [EMAIL PROTECTED] Wed Oct 2 08:15:49 2002
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: by mail.quimpo.org (Postfix, from userid 509) id 2789F8A8C; Wed,
2 Oct 2002 08:15:49 -0400 (EDT)
Received: from mc2-f5.law16.hotmail.com ([65.54.237.12]) by
mc2-s7.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Wed, 2 Oct
2002 03:41:16 -0700
Received: from yahoo.com ([217.125.44.21]) by mc2-f5.law16.hotmail.com with
Microsoft SMTPSVC(5.0.2195.5600); Wed, 2 Oct 2002 03:29:20 -0700
Received: from unknown (HELO mta85.snfc21.pibi.net) (41.7.52.183) by
a231242.upc-a.zhello.nl with asmtp; Wed, 02 Oct 2002 11:31:54 +0900
Received: from unknown (96.91.151.85) by rly-xw05.oxyeli.com with QMQP;
Wed, 02 Oct 2002 20:26:28 -1000
Received: from sparc.zubilam.net ([152.110.198.251]) by
rly-xl04.mx.aolmd.com with asmtp; Wed, 02 Oct 2002 10:21:02 +0500
Received: from [52.131.16.20] by pet.vosni.net with local; Wed, 02 Oct 2002
15:15:36 +0100
Received: from unknown (HELO a231242.upc-a.zhello.nl) (181.30.61.21) by
symail.kustanai.co.kr with SMTP; 02 Oct 2002 16:10:10 +0900
Reply-To: <[EMAIL PROTECTED]>
Message-ID: <011e62d76c2a$3145d6a5$7ab45bb6@ssbnbi>
From: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: ** Approved.
Date: Thu, 03 Oct 2002 04:25:28 -0300
MiME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_00C1_25C60D3A.D2365C51"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
Importance: Normal
X-OriginalArrivalTime: 02 Oct 2002 10:29:22.0366 (UTC)
FILETIME=[92B3C5E0:01C269FE]
X-gotmail-version: 0.7.3
X-gotmail-folder: Junk Mail
X-gotmail-user: tvcarrol
Status:
X-Evolution-Source: pop://tiger@localhost/inbox
------=_NextPart_000_00C1_25C60D3A.D2365C51
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
<html>
<body>
<font color="ffffff">Hand</font>
<p>Your home refinance loan is approved!<br></p><br>
<p>To get your approved amount <a href="http://cbulkhost.com/idc/";>go
here</a>.</p>
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>
<p>To be excluded from further notices <a
href="http://cbulkhost.com/idc/remove.html";>go
here</a>.</p>
<font color="ffffff">Hand</font>
</body>
<font color="ffffff">1gate
</html>
55l2
------=_NextPart_000_00C1_25C60D3A.D2365C51--
