procmail
[Top] [All Lists]

Re: stuff getting through my spam filter

2006-09-09 11:49:39
Hi.

I've added some info that hopefully helps in the troubleshooting.

06Sep2006 @ 20:47 Alan Clifford thusly spake
On Wed, 6 Sep 2006, Luke Vanderfluit wrote:

LV> Hi All.
LV> 
LV> I'm sure some of you have probably been hit by this.
LV> I have a spam filter (popfile) that tags spam with 'Subject: [Spam]'
LV> 
LV> Recently some clever hackers have sent me emails that procmail puts in 
LV> my Inbox despite them having that header.

Don't ascribe magical powers to senders of junk.  What is the procmail 
recipe that you think should be picking up that header?  Why isn't it 
working?  Show it to us, together with a copy of the header as procmail 
sees it.

OK. Below I have ((1)the text as displayed in my browser when accessing through 
popfile, (2) the text as it is raw in the mbox file, (3) the text as it shows 
in my mail client (mutt))

These emails keep appearing in my Inbox despite being labelled as spam by 
popfile.
Why would that be?

Thanks for any help.

This is one of the messages as it was received by popfile:

/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Received: (qmail 35216 invoked from network); 9 Sep 2006 06:51:16 +0930
Received: from unknown (HELO fjwkyb2) (220.123.18.57)
by hurricane.mail.adnap.net.au with SMTP; 9 Sep 2006 06:51:16 +0930
From: "Dana Aguilar" <dana_aguilardn(_at_)spectrumlabs(_dot_)com>
To: luke(_at_)chipcity(_dot_)com(_dot_)au
Subject: Movement
Date: Fri, 08 Sep 2006 15:29:09 -0400
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Tranfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Explosive pick for our members.

A Massive PR Campaign is Underway for Wednesday!
MAJOR NEWS IS EXPECTED THIS WEEK GET IN EARLY!

Date: Wednesday, September 6, 2006
Company: Pingchuan Pharmaceutical Inc.
Ticker: P g c N
Current_Price: $.24 .. Get in while its low!
5-Day_Target: $1.5 - $2

Could this company be the next PFIZER??

Pingchaun Pharmaceuticals disributes its medications to over
50 percent of CHINA and has a tremendous presence via exports
to U.S.A, Russia, Japan and South-Eastern Asia. They have
partnerships with the biggest drugstores, equivalent in the US
to SAV-ON, CVS, RITE-AID, etc. With big News anticipated this
coming week we strongly advise you to get in EARLY and issue
a 10/10 A|ert.

Put this one on your Radar NOW!
\____________________________________________________________

then as it appears in my inbox (raw content):

/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From dana_aguilardn(_at_)spectrumlabs(_dot_)com  Sat Sep  9 07:00:53 2006
Return-Path: <dana_aguilardn(_at_)spectrumlabs(_dot_)com>
Received: from bench.chipcity.com.au (bench.chipcity.com.au [127.0.0.1])
        by bench.chipcity.com.au (8.13.5/8.13.5) with ESMTP id k88LUqmF025100
        for <luke(_at_)localhost>; Sat, 9 Sep 2006 07:00:53 +0930
Date: Sat, 9 Sep 2006 07:00:52 +0930
From: dana_aguilardn(_at_)spectrumlabs(_dot_)com
Message-Id: 
<200609082130(_dot_)k88LUqmF025100(_at_)bench(_dot_)chipcity(_dot_)com(_dot_)au>
Received: from 127.0.0.1 [127.0.0.1]
        by bench.chipcity.com.au with POP3 (fetchmail-6.3.2)
        for <luke(_at_)localhost> (single-drop); Sat, 09 Sep 2006 07:00:53 
+0930 (CST)
Received: (qmail 35216 invoked from network); 9 Sep 2006 06:51:16 +0930
Received: from unknown (HELO fjwkyb2) (220.123.18.57)
  by hurricane.mail.adnap.net.au with SMTP; 9 Sep 2006 06:51:16 +0930
Status: RO
Content-Length: 1371
Lines: 40

<U+FEFF>Message-ID: <007b01c6d37d$0ec9d980$425a45e3@@spectrumlabs.com>
From: "Dana Aguilar" <dana_aguilardn(_at_)spectrumlabs(_dot_)com>
To: luke(_at_)chipcity(_dot_)com(_dot_)au
Subject: [spam] Movement
Date: Fri, 08 Sep 2006 15:29:09 -0400
MIME-Version: 1.0
Content-Type: text/plain;
        format=flowed;
        charset="iso-8859-1";
        reply-type=original
Content-Tranfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Text-Classification: spam
X-POPFile-Link: http://127.0.0.1:8080/jump_to_message?view=80449

Explosive pick for our members.

A Massive PR Campaign is Underway for Wednesday!
MAJOR NEWS IS EXPECTED THIS WEEK GET IN EARLY! 

Date: Wednesday, September 6, 2006
Company: Pingchuan Pharmaceutical Inc.
Ticker: P  g c  N
Current_Price: $.24   ..    Get in while its low!
5-Day_Target: $1.5 - $2

Could this company be the next PFIZER??

Pingchaun Pharmaceuticals disributes its medications to over 
50 percent of CHINA and has a tremendous presence via exports 
to U.S.A, Russia, Japan and South-Eastern Asia.  They have 
partnerships with the biggest drugstores, equivalent in the US 
to SAV-ON, CVS, RITE-AID, etc.  With big News anticipated this 
coming week we strongly advise you to get in EARLY and issue 
a 10/10 A|ert.
  
Put this one on your Radar NOW!

\____________________________________________

This is how it 'renders' in my mail client (mutt):
/~~~~~~~~~~~~~~~~~~~~~
Date: Sat, 9 Sep 2006 07:00:52 +0930
From: dana_aguilardn(_at_)spectrumlabs(_dot_)com
                                                                                
                                 
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&M
essage-ID: <007b01c6d37d$0ec9d980$425a45e3@@spectrumlabs.com>
From: "Dana Aguilar" <dana_aguilardn(_at_)spectrumlabs(_dot_)com>
To: luke(_at_)chipcity(_dot_)com(_dot_)au
Subject: [spam] Movement
Date: Fri, 08 Sep 2006 15:29:09 -0400
MIME-Version: 1.0
Content-Type: text/plain;
        format=flowed;
        charset="iso-8859-1";
        reply-type=original
Content-Tranfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Text-Classification: spam
X-POPFile-Link: http://127.0.0.1:8080/jump_to_message?view=80449

Explosive pick for our members.

A Massive PR Campaign is Underway for Wednesday!
MAJOR NEWS IS EXPECTED THIS WEEK GET IN EARLY!

Date: Wednesday, September 6, 2006
Company: Pingchuan Pharmaceutical Inc.
Ticker: P  g c  N
Current_Price: $.24   ..    Get in while its low!
5-Day_Target: $1.5 - $2

Could this company be the next PFIZER??

Pingchaun Pharmaceuticals disributes its medications to over
50 percent of CHINA and has a tremendous presence via exports
to U.S.A, Russia, Japan and South-Eastern Asia.  They have
partnerships with the biggest drugstores, equivalent in the US
to SAV-ON, CVS, RITE-AID, etc.  With big News anticipated this
coming week we strongly advise you to get in EARLY and issue
a 10/10 A|ert.

Put this one on your Radar NOW!
\_____________________________________


Kind regards.
Luke.









Ironically, you message was filtered as spam by one of my old recipes - 
too high a proportion of ampersands in the message body.  Spam Assassin 
did far better and gave your message a negative score.

-- 
Alan


( Please do not email me AS WELL as replying to the list.  Please 
  address personal email to alan+1@ as lists@ is not read. A
  password autoresponder may be invoked if this email is very old. )


____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail


-- 
............._..
.|  .| |.|/.|_ .
.|__.|_|.|\.|_ .
:61 421 276 282:

____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail