I just received a spam of which I copy here a part of headers. It slipped though a postfix+SA2.62 installation (basic SA with Bayes).
Most of the message text was in a embedded picture, and a lot of CSS.
What surprises me is the presence of X-UIDL header in a SMTP envelope. Moreover the X-UIDL value is non-numeric! Has anyone blocked this thing? Any special rule? (I can write my own if there's none around) Any reason why it is there?!
Then, the MIME text/plain part contains this text: "Your mailer do not support HTML messages. Switch to a better mailer."
I am not a native English speaker, but I feel the sentence is not correct and a bit offensive. Is any real email client actually using it? Or I can write a nice rule to contribute blocking this kind of spam?
Thanks, Paolo
.......................................
Received: from smtp1.nix.paypal.com (smtp9.nix.paypal.com [219.209.76.17])
by yahoo.com (8.15.10/8.16.10) with ESMTP id i4M1AVjw010001
for <[EMAIL PROTECTED]>; %CURRENT_DATE_TIME
Received: from notify0.nix.paypal.com (notify3.nix.paypal.com [20.164.84.140])
by smtp2.nix.paypal.com (Postfix) with SMTP id E0B762EF10
for <[EMAIL PROTECTED]>; %CURRENT_DATE_TIME
Received: (qmail 18808 invoked by uid 600); Wed, 09 Jun 2004 05:28:00 +0400
Message-Id: <[EMAIL PROTECTED]>
X-country: US
X-language: en_US
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00PZ_03N3399FU_03A.049Y80S0"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
From: "Blaine Carter" <[EMAIL PROTECTED]>
To: Creighton <[EMAIL PROTECTED]>
Subject: Get meds over night - no prescription needed
X-UIDL: fB@"!)+h"!#+""!Y$m!!
Date: Wed, 9 Jun 2004 13:29:03 +0200 (CEST)
X-Spam-Checker-Version: SpamAssassin 2.62 (2004-01-11) on antispam.xyz.it
X-Spam-Status: No, hits=3.1 required=3.5 tests=BAYES_50,FORGED_YAHOO_RCVD,
HTML_FONTCOLOR_UNKNOWN,HTML_MESSAGE,MIME_BOUND_NEXTPART autolearn=no
version=2.62
X-Spam-Level: ***
This is a multi-part message in MIME format.
------=_NextPart_000_00PZ_03N3399FU_03A.049Y80S0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_00GN_04Y3721FY_02P.585P97P0"
------=_NextPart_000_00GN_04Y3721FY_02P.585P97P0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit
Your mailer do not support HTML messages. Switch to a better mailer.
-----BEGIN PGP SIGNATURE-----
.......................................
-- QRPp-I #707 + www.paolocravero.tk + I QRP #476 Beacon @ 28.3219 MHz + QRPp + QRSS3 + JN35TC
