1 Sep
2004
1 Sep
'04
2:32 p.m.
Spam detection software, running on the system "lips.borg.umn.edu", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: US Doctors FILL and SHIP Directly to Your
DOORSTEP...vff8md1te3 IPFMKPJ. TFFUTIDXHUX. HVGOGG. KNLEVKLGJD.
sq7utbcswu. m56fmx34jk. kkwses3zfp. a5ohrs3eoi.r94t4q37mq.
mfpc272rhg.s5isn2db06. sieh8g1unw. fir7vf2dmt. ygkskj2qyt. dy69q61dza.
cfsfiq3vqa. sgghel1l41. 44x72x3qmw. io1ubz3rro. fm92ke2eg0.
YEBRUCKRTAQOBESIISLBW out. [...]
Content analysis details: (21.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 FORGED_RCVD_HELO Received: contains a forged HELO
0.5 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
0.1 HTML_30_40 BODY: Message is 30% to 40% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
1.2 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.1 RCVD_IN_RFC_IPWHOIS RBL: Sent via a relay in ipwhois.rfc-ignorant.org
[$ has inaccurate or missing WHOIS data at the]
[RIR]
0.1 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[218.174.167.118 listed in dnsbl.sorbs.net]
1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?218.174.167.118>]
1.7 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[218.174.167.118 listed in combined.njabl.org]
0.6 URIBL_SBL Contains a URL listed in the SBL blocklist
[URIs: gorxmeds.biz]
2.0 URIBL_AB_SURBL Contains a URL listed in the AB SURBL blocklist
[URIs: gorxmeds.biz]
0.5 URIBL_WS_SURBL Contains a URL listed in the WS SURBL blocklist
[URIs: gorxmeds.biz]
2.0 URIBL_OB_SURBL Contains a URL listed in the OB SURBL blocklist
[URIs: gorxmeds.biz]
3.9 URIBL_SC_SURBL Contains a URL listed in the SC SURBL blocklist
[URIs: gorxmeds.biz]
2.4 RATWARE_ZERO_TZ Bulk email fingerprint (+0000) found
3.1 MSGID_DOLLARS Message-Id has pattern used in spam
0.2 UPPERCASE_25_50 message body is 25-50% uppercase
0.0 DRUGS_PAIN Refers to a pain relief drug
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
-- Attached file included as plaintext by Ecartis --
-- Desc: original message before SpamAssassin
Received: from grundisburgh99.freeserve.co.uk (218-174-167-118.dynamic.hinet.net
[218.174.167.118])
by lips.borg.umn.edu (8.13.1/8.13.0) with ESMTP id i81JWfDk000915
for <mba(a)thebarn.com>; Wed, 1 Sep 2004 14:32:43 -0500 (CDT)
(envelope-from harold_edwardswo(a)beeline.ru)
Date: Wed, 01 Sep 2004 19:31:25 +0000
To: mba(a)thebarn.com
MIME-Version: 1.0
Message-ID: <513e01c4905a$6993d4e0$7c08a058@vkfvvd>
From: "Harold Edwards" <harold_edwardswo(a)beeline.ru>
Subject: =?ISO-8859-1?b?SHlkcm9jb2RvbmUgLSAgTk8gUHJlc2NyKmlwdGlvbiBOZWVkZWQ=?=
Content-Type: text/html
Content-Transfer-Encoding: 8bit
<html>
<body>
<a href="http://MSHHWU.CBFJ.gorxmeds.biz/?wid=100037">US
Doctors FILL and SHIP Directly to Your DOORSTEP...vff8md1te3<br>
<br><br><br><br><br><br><br><br><br>
IPFMKPJ. TFFUTIDXHUX. HVGOGG. KNLEVKLGJD. sq7utbcswu. m56fmx34jk. kkwses3zfp.
a5ohrs3eoi.r94t4q37mq. mfpc272rhg.s5isn2db06. sieh8g1unw. fir7vf2dmt. ygkskj2qyt.
dy69q61dza. cfsfiq3vqa. sgghel1l41. 44x72x3qmw. io1ubz3rro. fm92ke2eg0.
<a href="http://KSFMQOCJT.gorxmeds.biz/no-more/">YEBRUCKRTAQOBESIISLBW
out.</a>
</body>
</html>