Hi Ed, On Fri, 1 Oct 2004, Ed Kasky wrote:
> I have had 13 FN's since upgrading to 3.0.0 on Sunday. This is a > substantial increase from the one or two I used to get weekly. > > I have included the text of the most recent one below. They are all > scoring betwee 3 and 4 and are all formatted pretty much like this one. <snipped> > ---------- Forwarded message ---------- > Return-Path: <[EMAIL PROTECTED]> > Received: from moxmail06.flawlessorganization.com > (moxmail-1-41.flawlessorganization.com [64.237.3.41]) > by wrenkasky.com (8.12.11/8.12.11) with ESMTP id i91CaWps022097 moxmail-1-41.flawlessorganization is a real address, so the header doesn't look like it was forged. Maybe this was sent with legitimate bulk-mailing software, whereas SpamAssassin really goes after spams with obfuscated headers and return addresses. > for <[EMAIL PROTECTED]>; Fri, 1 Oct 2004 05:36:33 -0700 > Received: from flawlessorganization.com (localhost.localdomain [127.0.0.1]) > by moxmail06.flawlessorganization.com (Postfix) with ESMTP id > 02C806710D54D > for <[EMAIL PROTECTED]>; Fri, 1 Oct 2004 05:36:15 -0700 (PDT) > MIME-Version: 1.0 > From: "Christian Singles" <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Meet quality Christians > Message-Id: <[EMAIL PROTECTED]> > Content-Type: text/plain > Content-Disposition: inline > Content-Transfer-Encoding: 7bit > Date: Fri, 1 Oct 2004 05:36:15 -0700 (PDT) > X-Spam-Status: No, score=3.7 required=6.9 tests=ALL_TRUSTED,BAYES_60, > DCC_CHECK,EVILNUMBER_A_2XX_1,EXCUSE_6,SARE_SXLIFE autolearn=no > version=3.0.0 > X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on > yoda2.wrenkasky.com > X-Spam-Level: *** > There's also not a bunch of HTML tags or weird words and phrases at the beginning, so it passes through most of the rules. The website appears to be in the USA, so perhaps this is one of the few bulk emailers who is fully CAN-SPAM compliant? Or maybe it's just the latest from the spammers... Use a CAN-SPAM compliant email to generate their lists of addresses from the remove requests. One thing that I did notice was that the domain flawlessorganization.com is literally 1 week old according to whois, created September 24, 2004. Perhaps someone could write a module that penalizes email from domains that have been created recently? This would give Bayes some time to "catch up". Again, noting below that the web links are all for the same domain as the email came from. This is perhaps the least obfuscated spam that I've ever seen (at least recently). > Are you Christian? Are you Single? We have the solution for you! At > WhereChristiansMeet, you can meet like-minded Christians that are also > single! This isn't an ONLINE dating site full of fake profiles! These are > REAL PEOPLE just like you. Click the link below and meet someone REAL today! > > Click Here: http://flawlessorganization.com/r/2307/8223547/252408859574 > -Greg
