[spambayes-dev] Missed spam - Spam Clues: bechtel

Mark Hammond mhammond at skippinet.com.au
Sat Aug 2 13:27:31 EDT 2003


I'm pretty quick on the trigger finger - I should have looked a little
deeper first.

Outlook sees the HTML body of the message as:

<html>
<body><font color="#ffffff">math <font color="#ffffff">testifier <font
color="#ffffff">teleologically <font color="#ffffff">ideal

... lots more random hidden words deleted

<a
href="http://srd.yahoo.com/drst/military/*http://www.365pharm1.com/sh/index.
html">
<img border="0"
 src="http://srd.yahoo.com/drst/sawed/*http://www.8867v.com/file/ra.gif" >
</a>
 </p><font color="#ffffff">sayers <font color="#ffffff">hushed <font
color="#ffffff">expertise <font color="#ffffff">experiment

... more random words snipped

</html>

So they use a standard technique of hiding the words, but the interesting
thing is that the URLs don't appear in the Spam Clues.

Mark.


> -----Original Message-----
> From: spambayes-dev-bounces at python.org
> [mailto:spambayes-dev-bounces at python.org]On Behalf Of Mark Hammond
> Sent: Saturday, 2 August 2003 12:04 PM
> To: spambayes-dev at python.org
> Subject: [spambayes-dev] Missed spam - Spam Clues: bechtel
>
>
> The attached Spam ia a viagra spam.  The body of the message
> when rendered
> in Outlook shows only an image.  However, the "SpamClues"
> show no HTML, no
> references to the image, and only some "random" words in the body.
>
> Thus, this scored ham :(
>
> Mark.
>
> Spam Score: 0.00308617
>
>
> word                                spamprob         #ham  #spam
> '*H*'                               0.999958            -      -
> '*S*'                               0.00613056          -      -
> 'admit'                             0.00913224         31      0
> 'thats'                             0.0164061          17      0
> 'experiment'                        0.0229286          12      0
> 'math'                              0.0336219           8      0
> 'accused'                           0.0517088           5      0
> 'admire'                            0.0517088           5      0
> 'scale'                             0.0517088           5      0
> 'apr'                               0.0607152          24      1
> 'exceeded'                          0.063007            4      0
> 'horrid'                            0.063007            4      0
> 'husbands'                          0.063007            4      0
> 'megabyte'                          0.063007            4      0
> 'crotch'                            0.0806228           3      0
> 'hysteria'                          0.0806228           3      0
> 'merry'                             0.0806228           3      0
> 'scenery'                           0.0806228           3      0
> 'tearing'                           0.0806228           3      0
> 'adjusted'                          0.111912            2      0
> 'blake'                             0.111912            2      0
> 'bookshelf'                         0.111912            2      0
> 'excessive'                         0.111912            2      0
> 'expressions'                       0.111912            2      0
> 'expects'                           0.148988           16      2
> 'scanned'                           0.157201           15      2
> 'scanner'                           0.159255            8      1
> 'activist'                          0.182889            1      0
> 'adhere'                            0.182889            1      0
> 'bosses'                            0.182889            1      0
> 'bowl'                              0.182889            1      0
> 'text'                              0.256853           71     19
> 'ethical'                           0.267992            4      1
> 'boxes'                             0.279197           17      5
> 'skip:c 10'                         0.308007          582    202
> 'skip:m 10'                         0.331956          235     91
> 'skip:i 10'                         0.347916          399    166
> 'reply-to:none'                     0.360174         2047    899
> 'expertise'                         0.36188             7      3
> 'skip:a 10'                         0.363178          389    173
> 'skip:t 10'                         0.374917          169     79
> 'ideal'                             0.377209           15      7
> 'header:Received:7'                 0.634866          336    456
> 'maximum'                           0.64241            12     17
> 'advertisers'                       0.643646            2      3
> 'to:no real name:2**0'              0.665129          940   1457
> 'cosmetic'                          0.762365            1      3
> 'bottles'                           0.801841            2      7
> 'credit'                            0.810985           18     61
> 'bold'                              0.844828            0      1
> 'meadowsweet'                       0.844828            0      1
> 'plead'                             0.844828            0      1
> 'pornography'                       0.844828            0      1
> 'meal'                              0.895035            2     15
> 'crave'                             0.908163            0      2
> 'from:addr:msn.com'                 0.949001            2     33
> 'africa'                            0.964391            1     27
> 'message-id:@king.southern.net.au'  0.987855            2    145
>
> Message Stream:
>
>
> Received: from localhost (localhost [127.0.0.1])
> 	by sturt.southern.net.au (Postfix) with SMTP id 6B5D8DB17
> 	for <mhammond at keypoint.com.au>; Sat,  2 Aug 2003
> 11:51:18 +1000 (EST)
> Received: by sturt.southern.net.au (Postfix, from userid 0)
> 	id 44E3E15E35; Sat,  2 Aug 2003 11:51:18 +1000 (EST)
> Received: from localhost (localhost [127.0.0.1])
> 	by sturt.southern.net.au (Postfix) with SMTP id 01EFEDBF0
> 	for <mhammond at skippinet.com.au>; Sat,  2 Aug 2003
> 11:50:33 +1000 (EST)
> Received: from king.southern.net.au (unknown [10.0.0.10])
> 	by sturt.southern.net.au (Postfix) with ESMTP id B312515F03
> 	for <mhammond at skippinet.com.au>; Sat,  2 Aug 2003
> 11:50:31 +1000 (EST)
> Received: from localhost (localhost [127.0.0.1])
> 	by king.southern.net.au (Postfix) with SMTP id 6F16293D3E
> 	for <mhammond at skippinet.com.au>; Sat,  2 Aug 2003
> 11:50:45 +1000 (EST)
> Received: from phoenix.MCD (a-66-191-biz2.mts.net [205.200.66.191])
> 	by king.southern.net.au (Postfix) with ESMTP id 396137DD27
> 	for <mhammond at skippinet.com.au>; Sat,  2 Aug 2003
> 11:50:44 +1000 (EST)
> Received: from tentatively (218.70.149.166 [218.70.149.166])
> by phoenix.MCD
> 	with SMTP (Microsoft Exchange Internet Mail Service Version
> 	5.5.2650.21) id QA1ALGRD; Fri, 1 Aug 2003 20:38:51 -0500
> Date: Sat, 2 Aug 2003 01:49:30 GMT
> From: "Doris Scott" <mham at MSN.COM>
> To: mhammond at skippinet.com.au
> Subject: bechtel
> Mime-Version: 1.0
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: 7bit
> Message-Id: <20030802015044.396137DD27 at king.southern.net.au>
> X-Spam-Status: No, hits=0.7 required=5.0
> 	tests=HTML_60_70,HTML_MESSAGE,MIME_HTML_ONLY version=2.55
> X-Spam-Level:
> X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
>
>
> math testifier teleologically ideal polymer crimes huddled
> theatrically
> crankier crosser mentality tearing bosses activist illuminated ethical
> expects advertisers scale ibex crotch boxes secant eukaryote
> 8th eugenic
> adornment admire exceeded sawfish $RANDO MIZE megalomaniac
> adduction africa
> illicitly brazenly cotoneaster crabbing teamster cosponsor
> adhere bottles
> metamathematical blake brackish archibald cribs melodiously crossers
> pocketed credit boisterous medians pork pow botanists
> expressions pottery
> illuminations sans excerpted $RANDOM IZE expendable aubrey secondarily
> borates imitates benny accused bolshoi metalwork arturo bold
> maximum scenery
> tamale hornets sayers critics crave sari expunge husbands
>
>
>
> sayers hushed expertise experiment excessive coverlets acknowledgeable
> adjusted bowers bolstering adolph humus mellow creditably
> barbour methylene
> taming teamster cosmetic scrupulosity plead midpoint meadowsweet alcoa
> scanned idyllic tearfully arcadia tektite icosahedra $RANDOM
> IZE satiety apr
> meal correlates albrecht exclamations hoppers poi megabyte
> cranking credibly
> bookshelf horrid arcadia merry sawdust adipic imaginative
> activism argonaut
> corrupting bayport hysteria text pornography counterbalance
> accolade pliancy
> hull hovels $RANDOMI ZE evinced imaginably bowl crosswise
> screamers textiles
> adjoin tallow scanner median tetrahedral blurted accessories
> postoffices
> thats acknowledger admit bluntest accrual savagers idyll
>
> Message Tokens:
>
> 185 unique tokens
>
> '$rando'
> '$random'
> '$randomi'
> '8th'
> 'accessories'
> 'accolade'
> 'accrual'
> 'accused'
> 'acknowledger'
> 'activism'
> 'activist'
> 'adduction'
> 'adhere'
> 'adipic'
> 'adjoin'
> 'adjusted'
> 'admire'
> 'admit'
> 'adolph'
> 'adornment'
> 'advertisers'
> 'africa'
> 'albrecht'
> 'alcoa'
> 'apr'
> 'arcadia'
> 'archibald'
> 'argonaut'
> 'arturo'
> 'aubrey'
> 'barbour'
> 'bayport'
> 'benny'
> 'blake'
> 'bluntest'
> 'blurted'
> 'boisterous'
> 'bold'
> 'bolshoi'
> 'bolstering'
> 'bookshelf'
> 'borates'
> 'bosses'
> 'botanists'
> 'bottles'
> 'bowers'
> 'bowl'
> 'boxes'
> 'brackish'
> 'brazenly'
> 'cc:none'
> 'content-type:text/plain'
> 'correlates'
> 'corrupting'
> 'cosmetic'
> 'cosponsor'
> 'cotoneaster'
> 'coverlets'
> 'crabbing'
> 'crankier'
> 'cranking'
> 'crave'
> 'credibly'
> 'credit'
> 'creditably'
> 'cribs'
> 'crimes'
> 'critics'
> 'crosser'
> 'crossers'
> 'crosswise'
> 'crotch'
> 'ethical'
> 'eugenic'
> 'eukaryote'
> 'evinced'
> 'exceeded'
> 'excerpted'
> 'excessive'
> 'exclamations'
> 'expects'
> 'expendable'
> 'experiment'
> 'expertise'
> 'expressions'
> 'expunge'
> 'from:addr:mham'
> 'from:addr:msn.com'
> 'from:name:doris scott'
> 'header:Date:1'
> 'header:From:1'
> 'header:Message-Id:1'
> 'header:Mime-Version:1'
> 'header:Received:7'
> 'header:Subject:1'
> 'header:To:1'
> 'hoppers'
> 'hornets'
> 'horrid'
> 'hovels'
> 'huddled'
> 'hull'
> 'humus'
> 'husbands'
> 'hushed'
> 'hysteria'
> 'ibex'
> 'icosahedra'
> 'ideal'
> 'idyll'
> 'idyllic'
> 'illicitly'
> 'illuminated'
> 'imaginably'
> 'imaginative'
> 'imitates'
> 'ize'
> 'math'
> 'maximum'
> 'meadowsweet'
> 'meal'
> 'median'
> 'medians'
> 'megabyte'
> 'megalomaniac'
> 'mellow'
> 'melodiously'
> 'mentality'
> 'merry'
> 'message-id:@king.southern.net.au'
> 'metalwork'
> 'methylene'
> 'midpoint'
> 'mize'
> 'plead'
> 'pliancy'
> 'pocketed'
> 'poi'
> 'polymer'
> 'pork'
> 'pornography'
> 'postoffices'
> 'pottery'
> 'pow'
> 'reply-to:none'
> 'sans'
> 'sari'
> 'satiety'
> 'savagers'
> 'sawdust'
> 'sawfish'
> 'sayers'
> 'scale'
> 'scanned'
> 'scanner'
> 'scenery'
> 'screamers'
> 'scrupulosity'
> 'secant'
> 'secondarily'
> 'sender:none'
> 'skip:a 10'
> 'skip:c 10'
> 'skip:i 10'
> 'skip:m 10'
> 'skip:t 10'
> 'subject:bechtel'
> 'tallow'
> 'tamale'
> 'taming'
> 'teamster'
> 'tearfully'
> 'tearing'
> 'tektite'
> 'testifier'
> 'tetrahedral'
> 'text'
> 'textiles'
> 'thats'
> 'theatrically'
> 'to:2**0'
> 'to:addr:mhammond'
> 'to:addr:skippinet.com.au'
> 'to:no real name:2**0'
> 'x-mailer:none'
>




More information about the spambayes-dev mailing list