[spambayes-dev] Missed spam - Spam Clues: bechtel

Fri Aug 1 23:57:31 EDT 2003

[Mark Hammond]
> I'm pretty quick on the trigger finger - I should have looked a little
> deeper first.
>
> Outlook sees the HTML body of the message as:
>
> <html>
> <body><font color="#ffffff">math <font color="#ffffff">testifier <font
> color="#ffffff">teleologically <font color="#ffffff">ideal
>
> ... lots more random hidden words deleted
>
> <a
>
href="http://srd.yahoo.com/drst/military/*http://www.365pharm1.com/sh/index.
> html">
> <img border="0"
>  src="http://srd.yahoo.com/drst/sawed/*http://www.8867v.com/file/ra.gif"
> > </a>
>  </p><font color="#ffffff">sayers <font color="#ffffff">hushed <font
> color="#ffffff">expertise <font color="#ffffff">experiment
>
> ... more random words snipped
>
> </html>
>
> So they use a standard technique of hiding the words, but the
> interesting thing is that the URLs don't appear in the Spam Clues.

More peculiar:  I saved your attachment into my Unsure folder, and scored it
there, with current CVS spambayes.  It found more tokens than yours found!
Including a pile of url: tokens.  Here they are:

203 unique tokens

'$rando'
'$random'
'$randomi'
'8th'
'accessories'
'accolade'
'accrual'
'accused'
'acknowledger'
'activism'
'activist'
'adduction'
'adhere'
'adipic'
'adjoin'
'adjusted'
'admire'
'admit'
'adolph'
'adornment'
'advertisers'
'africa'
'albrecht'
'alcoa'
'apr'
'arcadia'
'archibald'
'argonaut'
'arturo'
'aubrey'
'barbour'
'bayport'
'benny'
'blake'
'bluntest'
'blurted'
'boisterous'
'bold'
'bolshoi'
'bolstering'
'bookshelf'
'borates'
'bosses'
'botanists'
'bottles'
'bowers'
'bowl'
'boxes'
'brackish'
'brazenly'
'cc:none'
'content-type:text/plain'
'correlates'
'corrupting'
'cosmetic'
'cosponsor'
'cotoneaster'
'coverlets'
'crabbing'
'crankier'
'cranking'
'crave'
'credibly'
'credit'
'creditably'
'cribs'
'crimes'
'critics'
'crosser'
'crossers'
'crosswise'
'crotch'
'ethical'
'eugenic'
'eukaryote'
'evinced'
'exceeded'
'excerpted'
'excessive'
'exclamations'
'expects'
'expendable'
'experiment'
'expertise'
'expressions'
'expunge'
'from:addr:mham'
'from:addr:msn.com'
'from:name:doris scott'
'header:Date:1'
'header:From:1'
'header:Importance:1'
'header:MIME-Version:1'
'header:Message-ID:1'
'header:Subject:1'
'header:To:1'
'hoppers'
'hornets'
'horrid'
'hovels'
'huddled'
'hull'
'humus'
'husbands'
'hushed'
'hysteria'
'ibex'
'icosahedra'
'ideal'
'idyll'
'idyllic'
'illicitly'
'illuminated'
'imaginably'
'imaginative'
'imitates'
'ize'
'math'
'maximum'
'meadowsweet'
'meal'
'median'
'medians'
'megabyte'
'megalomaniac'
'mellow'
'melodiously'
'mentality'
'merry'
'message-id:@king.southern.net.au'
'metalwork'
'methylene'
'midpoint'
'mize'
'plead'
'pliancy'
'pocketed'
'poi'
'polymer'
'pork'
'pornography'
'postoffices'
'pottery'
'pow'
'proto:http'
'reply-to:none'
'sans'
'sari'
'satiety'
'savagers'
'sawdust'
'sawfish'
'sayers'
'scale'
'scanned'
'scanner'
'scenery'
'screamers'
'scrupulosity'
'secant'
'secondarily'
'sender:none'
'skip:a 10'
'skip:c 10'
'skip:i 10'
'skip:m 10'
'skip:t 10'
'subject:bechtel'
'tallow'
'tamale'
'taming'
'teamster'
'tearfully'
'tearing'
'tektite'
'testifier'
'tetrahedral'
'text'
'textiles'
'thats'
'theatrically'
'to:2**0'
'to:addr:mhammond'
'to:addr:skippinet.com.au'
'to:no real name:2**0'
'url:'
'url:*http'
'url:365pharm1'
'url:8867v'
'url:com'
'url:drst'
'url:file'
'url:gif'
'url:html'
'url:index'
'url:military'
'url:ra'
'url:sawed'
'url:sh'
'url:srd'
'url:www'
'url:yahoo'
'x-mailer:microsoft outlook cws, build 9.0.2416 (9.0.2911.0)'

The x-mailer token is night-and-day different from the one you got too, and
there are some odd differences in case (e.g., compare your

    'header:Mime-Version:1'

to the one above).  Pretty mysterious!  I'm still using Python 2.2.3 here,
and I sure hope that doesn't account for it (but can't make time to
investigate further -- sorry!).