I installed SpamAssassin (SA) and instantly developed a new pastime. Even funnier than reading spam is reading what SA has to say about it. SA is a filter daemon (or standalone program) that reads an e-mail message and analyzes it for spam, adding a couple headers to give its verdict. If it thinks the message is spam, it also puts a "***SPAM***" prefix in the Subject: and adds some structured comments to the body saying what's suspicious about the message. Those comments in the body are where the funny parts are. SA is so amusing that I've given up my two other recent pastimes: collecting Klez worms and Nigeria scams. I just /dev/null the Klez worms now.
SPAM: -------------------- Start SpamAssassin results ---------------------- SPAM: This mail is probably spam. The original message has been altered SPAM: so you can recognise or block similar unwanted mail in future. SPAM: See http://spamassassin.org/tag/ for more details. SPAM: SPAM: Content analysis details: (16.2 hits, 5 required) SPAM: Hit! (2.2 points) BODY: As seen on national TV! SPAM: Hit! (1.5 points) BODY: Asks you to click below SPAM: Hit! (0.2 points) BODY: No such thing as a free lunch (1) SPAM: Hit! (-0.1 points) BODY: Claims you can be removed from the list SPAM: Hit! (2.1 points) BODY: Talks about opting in SPAM: Hit! (3.0 points) URI: Uses a dotted-decimal IP address in URL SPAM: Hit! (0.1 points) URI: Uses non-standard port number for HTTP SPAM: Hit! (3.5 points) URI: URL of page called "remove" SPAM: Hit! (-0.8 points) BODY: JavaScript code which can easily be executed SPAM: Hit! (-0.5 points) BODY: HTML mail with non-white background SPAM: Hit! (1.8 points) BODY: Tells you to click on a URL SPAM: Hit! (3.2 points) HTML-only mail, with no text version SPAM: SPAM: -------------------- End of SpamAssassin results ---------------------
SPAM: Hit! (0.6 points) Invalid Date: header (wierd month) SPAM: Hit! (0.5 points) BODY: A WHOLE LINE OF YELLING DETECTED SPAM: Hit! (3.0 points) URI: Uses a dotted-decimal IP address in URL SPAM: Hit! (-0.8 points) BODY: Image tag with an ID code to identify you SPAM: Hit! (-0.4 points) BODY: Contains a line >=199 characters long SPAM: Hit! (1.8 points) BODY: Tells you to click on a URL SPAM: Hit! (3.2 points) HTML-only mail, with no text version SPAM: Hit! (2.0 points) Received via a relay in relays.osirusoft.com SPAM: [RBL check: found 148.167.27.64.relays.osirusoft.com., type: 127.0.0.4] SPAM: Hit! (3.0 points) DNSBL: sender is Confirmed Spam Source
SPAM: Hit! (1.0 point) From: ends in numbers SPAM: Hit! (0.5 points) Subject has an exclamation mark SPAM: Hit! (0.4 points) Subject has lots of exclamation marks SPAM: Hit! (-0.5 points) BODY: Contains 'Dear Somebody' SPAM: Hit! (2.7 points) BODY: Nigerian scam key phrase ($NN,NNN,NNN.NN) SPAM: Hit! (2.4 points) BODY: Nigerian scam key phrase SPAM: Hit! (4.3 points) BODY: Nigerian Bank or Petroleum scam, cf http://www.snopes2.com/inboxer/scams/nigeria.htm SPAM: Hit! (2.2 points) BODY: Risk free. Suuurreeee.... SPAM: Hit! (-0.4 points) BODY: Contains a line >=199 characters long
SPAM: Hit! (4.3 points) Reply-To: is empty SPAM: Hit! (2.4 points) 'Message-Id' was added by a relay (2) SPAM: Hit! (2.2 points) From: has a malformed address SPAM: Hit! (1.5 points) Message-Id is not valid, according to RFC-2822 SPAM: Hit! (1.3 points) Message-Id has no @ sign SPAM: Hit! (0.5 points) Possibly-forged 'Received:' header found SPAM: Hit! (2.1 points) BODY: FONT Size +2 and up or 3 and up SPAM: Hit! (3.2 points) HTML-only mail, with no text version
SPAM: Hit! (1.0 point) From: ends in numbers SPAM: Hit! (0.5 points) Subject has an exclamation mark SPAM: Hit! (0.4 points) Subject has lots of exclamation marks SPAM: Hit! (0.9 points) URI: Filename is just a '\#'; probably a JS trick SPAM: Hit! (-0.8 points) BODY: JavaScript code which can easily be executed SPAM: Hit! (0.0 points) BODY: Includes a URL link to send an email SPAM: Hit! (3.2 points) HTML-only mail, with no text version SPAM: Hit! (1.9 points) Subject is all capitals
SPAM: Content analysis details: (6.2 hits, 5 required) SPAM: Hit! (1.1 points) BODY: Contains a large block of hexadecimal code SPAM: Hit! (-0.6 points) BODY: Frame wanted to load outside URL SPAM: Hit! (1.8 points) No MX records for the From: domain SPAM: Hit! (1.9 points) Subject is all capitals SPAM: Hit! (2.0 points) Subject contains a unique ID number
SPAM: Content analysis details: (10.1 hits, 5 required) SPAM: Hit! (1.2 points) Valid-looking To "undisclosed-recipients" SPAM: Hit! (0.5 points) Subject has an exclamation mark SPAM: Hit! (0.4 points) Subject has lots of exclamation marks SPAM: Hit! (0.2 points) BODY: Contains at least 3 dollar signs in a row SPAM: Hit! (0.2 points) BODY: No such thing as a free lunch (1) SPAM: Hit! (2.3 points) BODY: List removal information SPAM: Hit! (1.9 points) BODY: List removal information SPAM: Hit! (1.0 point) BODY: No such thing as a free lunch (3) SPAM: Hit! (0.5 points) Forged hotmail.com 'Received:' header found SPAM: Hit! (1.9 points) Subject is all capitals
SPAM: Content analysis details: (12.6 hits, 5 required) SPAM: Hit! (2.0 points) From: contains numbers mixed in with letters SPAM: Hit! (1.0 point) From: ends in numbers SPAM: Hit! (0.6 points) From: does not include a real name SPAM: Hit! (2.7 points) BODY: Claims you can be removed from the list SPAM: Hit! (1.9 points) BODY: List removal information SPAM: Hit! (0.1 points) BODY: List removal information SPAM: Hit! (1.3 points) URI: Includes a link to a likely spammer email address SPAM: Hit! (-0.4 points) BODY: Contains a line >=199 characters long SPAM: Hit! (0.5 points) Forged hotmail.com 'Received:' header found SPAM: Hit! (1.0 point) Received via a relay in orbs.dorkslayers.com SPAM: [RBL check: found 17.98.187.210.orbs.dorkslayers.com.] SPAM: Hit! (1.9 points) Subject is all capitals
Well well well well well, I do declare. What's the most interesting piece of spam this month? Tsk, tsk. (For background info about this company, see the News Bytes column in LG #71-76.)