22 Jul
2004
22 Jul
'04
5:20 a.m.
Spam detection software, running on the system "lips.borg.umn.edu", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Looking for HYDR0COD0NE? Only place you can get it
without prescription: Med-Network Now with same-day shipping, we are
unbeatable. Under-priced deals on other products like PHENTERMlNE too.
[...]
Content analysis details: (15.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FORGED_RCVD_HELO Received: contains a forged HELO
0.4 LINES_OF_YELLING BODY: A WHOLE LINE OF YELLING DETECTED
1.2 HTML_40_50 BODY: Message is 40% to 50% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[210.128.71.174 listed in dnsbl.sorbs.net]
1.8 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[210.128.71.174 listed in combined.njabl.org]
1.3 URIBL_SBL Contains a URL listed in the SBL blocklist
[URIs: mypillsforme.com]
2.0 URIBL_WS_SURBL Contains a URL listed in the WS SURBL blocklist
[URIs: mypillsforme.com]
1.0 URIBL_OB_SURBL Contains a URL listed in the OB SURBL blocklist
[URIs: mypillsforme.com]
3.3 URIBL_SC_SURBL Contains a URL listed in the SC SURBL blocklist
[URIs: mypillsforme.com]
1.6 MSGID_DOLLARS Message-Id has pattern used in spam
0.5 DRUGS_DIET_OBFU Obfuscated reference to a diet drug
0.1 DRUGS_DIET Refers to a diet drug
0.4 DRUGS_PAIN Refers to a pain relief drug
0.7 DRUGS_DIET_PAIN Refers to both a diet drug and a pain drug
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
-- Attached file included as plaintext by Ecartis --
-- Desc: original message before SpamAssassin
Received: from tvol.it (FM-90171081440019008(a)f63-pc174.cty-net.ne.jp [210.128.71.174])
by lips.borg.umn.edu (8.12.11/8.12.11) with SMTP id i6MAKSxW039898;
Thu, 22 Jul 2004 05:20:30 -0500 (CDT)
(envelope-from hollingsworth_vy(a)cibwr.freeserve.co.uk)
Message-ID: <d6c301c46fdf$9f5e7da8$949d6ce8(a)tvol.it>
From: "Aubrey P. Hollingsworth" <hollingsworth_vy(a)cibwr.freeserve.co.uk>
To: mba(a)thebarn.com
Subject: Re: Billing info needed for order
Date: Thu, 22 Jul 2004 11:28:44 +0000
MIME-Version: 1.0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
<html>
Looking for HYDR0COD0NE?<p>
Only place you can get it <b>without prescription</b>: <a
href="http://hdwqhgbtolxfr.Mypillsforme.com/?x8=k7m256">Med-Ne…
Now with same-day shipping, we are unbeatable.<p>
Under-priced deals on other products like PHENTERMlNE too.<p>
<a href="http://rxidgvphsbdwg.Mypillsforme.com/?x8=k7m256">DEALS WONT LAST
- VISIT US NOW!</a>
</html>