Hi All,
I am having an issue with the following DRUG related spam. Does
anyone have any rules to catch this?
Environment: SA 3.0.2 with network tests and the following SARE rule sets:
70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
70_sare_evilnum0.cf
70_sare_genlsubj0.cf
70_sare_genlsubj1.cf
70_sare_genlsubj_eng.cf
70_sare_header0.cf
70_sare_header1.cf
70_sare_header_eng.cf
70_sare_html0.cf
70_sare_html1.cf
70_sare_html_eng.cf
70_sare_oem.cf
70_sare_random.cf
70_sare_specific.cf
70_sare_spoof.cf
70_sare_unsub.cf
70_sare_uri0.cf
70_sare_uri1.cf
70_sare_uri_eng.cf
72_sare_bml_post25x.cf
72_sare_redirect_post3.0.0.cf
99_FVGT_Tripwire.cf
99_sare_fraud_post25x.cf
backhair.cf
bigevil.cf
chickenpox.cf
weeds2.cf
Thanks in advance!
DN
Received: from [216.249.40.20] (HELO mx2.xxxx.xxx)
by xxx.xxxxx.xxx
with ESMTP id 8426770; Sat, 14 May 2005 13:19:47 -0300
Received: from [85.65.64.105] ([85.65.64.105]:52747 "HELO
85-65-64-105.barak-online.net") by mx2.xxxxx.xxx with SMTP
id S69776AbVENQTr (ORCPT <rfc822;[EMAIL PROTECTED]> + 12 others);
Sat, 14 May 2005 13:19:47 -0300
X-MID: <[EMAIL PROTECTED]>
Date: Sat, 14 May 2005 12:18:01 -0500
Message-Id: <[EMAIL PROTECTED]>
From: Gregory Hicks <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Re: dehorn ADVATE
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_Part_26268598_14758651.1312519906417"
X-DK-Sender: [EMAIL PROTECTED]
X-DK-Policy: Inbound, CheckSpam=Yes
X-DK-AttBlock: No attachments have reject extensions
X-DK-WList: No sender or recipients white-listed
X-SA-Version: 3.0.2 (2004-11-16) on mx2.northrock.bm
X-SA-Score: 0.9
X-SA-SysThreshold: 6.0
0.8 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.1 HTML_40_50 BODY: Message is 40% to 50% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
This is a multi-part message in MIME format.
------=_Part_26268598_14758651.1312519906417
Content-Type: multipart/alternative;
boundary="----=_Part_24709875_12152681.2407573909984"
------=_Part_24709875_12152681.2407573909984
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
------=_Part_24709875_12152681.2407573909984
Content-Type: text/html;
charset=us-ascii
Content-Transfer-Encoding: 7Bit
------=_Part_24709875_12152681.2407573909984--
------=_Part_26268598_14758651.1312519906417
Content-Type: image/gif;
name="Frccf.GIF"
Content-Transfer-Encoding: base64
Content-ID: <lrvnmnh_ywroot_rvdee>
------=_Part_26268598_14758651.1312519906417--
<HTML><HEAD>
</HEAD>
<BODY><DIV><font></font><STRONG></STRONG><FONT SIZE=1></FONT><FONT
SIZE=2></FONT>
<FONT></FONT><A
href="http://ziawahewpqs.net&pewubl0oep4l18elkzv6%2Eaeroseddicc%2Ecom/";>
<FONT SIZE=1></FONT><FONT></FONT><FONT SIZE=2></FONT><IMG
SRC="cid:lrvnmnh_ywroot_rvdee"; border="0" ALT=""></A>
</DIV><p><font></font>
<FONT size=1><FONT SIZE=2></FONT>
in a sudden nearness of relation, as the daughter of my blood foe,
and<br><font></font><FONT SIZE=2></FONT>to make a cut at me in
passing; for this reason it was soon taken<BR>and me; and that Miss
Clarissa would have hardly less satisfaction<FONT
SIZE=2></FONT><BR><font></font><FONT SIZE=1></FONT>
cuts whistles out of the trees and dances ecstatically to his
own<br><FONT></FONT><FONT SIZE=2></FONT>What can have put such a
person in your head? inquired my mother.<BR>voice failed, and I
covered my face with my hand, and broke into<FONT
SIZE=2></FONT><BR><font></font><FONT></FONT>
way, Do cats eat bats? Do cats eat bats? and sometimes, Do<br><FONT
SIZE=1></FONT><FONT SIZE=2></FONT>Terrace; Mrs. Micawber, the
children, the Orfling, and myself; and<BR>affection; I ask pardon of
that lady, in my heart.<STRONG></STRONG><BR><FONT></FONT><FONT></FONT>
allow himself off the bench to be waylaid by some tender
kinswoman<br><STRONG></STRONG><STRONG></STRONG>I do not know that ever
I heard him speak so straight to
peoples<BR><STRONG></STRONG>8l4d7o2r6u7d8h4j4q6v8w5o8f6k5g6r5v3g9a2j9d2f2s9a9k5c4m3z8q1b4w2t8y9k1a7s3z7k8h3n3q1c6t3c2v5q2i8h4f5o1f9u7t2t8k5o6v6v3i5a8l7t4d1z5t9r2t8i7m7c5m<FONT
SIZE=1></FONT>
</FONT></p>
</BODY>
</HTML>
