This drug spam message body seems problematic, since the URI is google, being used to search for the spammer's. Naturally the actual spammer domain bluevallet.com is blacklisted. This showed up Tue, 03 Jan 2006 14:45:48 +0100
__
Proecia Xana Pail VALIM from $1.21 IAGRA from $3.33 IALIS from $3.75 eridia Abien Soa Levtra =20 http://www.google.com/search?q=3Dsite:bluevallet.com http://www.google.com/search?q=3Dsite:bluevallet.com=20 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D3>Pro<IMG = src=3D"cid:000101c6106b$c54633bd$66c5a8c0@printingmachine">ecia</FONT></DIV> <DIV><FONT face=3DArial size=3D3>Xana<IMG = src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine"></FONT></DIV> <DIV><FONT face=3DArial size=3D3>Pa<IMG = src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine">il</FONT></DIV> <DIV><FONT face=3DArial size=3D3>VALI<IMG = src=3D"cid:000301c6106b$c54633bd$66c5a8c0@printingmachine">M <STRONG>from = $1.21</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000401c6106b$c54633bd$66c5a8c0@printingmachine">IAGRA <STRONG>from = $3.33</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000501c6106b$c54633bd$66c5a8c0@printingmachine">IALIS <STRONG>from = $3.75</STRONG></FONT></DIV> <DIV><FONT face=3DArial size=3D3><IMG = src=3D"cid:000601c6106b$c54633bd$66c5a8c0@printingmachine">eridia</FONT></DIV> <DIV><FONT face=3DArial size=3D3>A<IMG = src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">bien</FONT></DIV> <DIV><FONT face=3DArial size=3D3>So<IMG = src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">a</FONT></DIV> <DIV><FONT face=3DArial size=3D3>Lev<IMG = src=3D"cid:000801c6106b$c54633bd$66c5a8c0@printingmachine">tra</FONT></DIV> <DIV><FONT face=3DArial size=3D3></FONT> </DIV> <DIV><FONT face=3DArial size=3D3><A = href=3D"http://www.google.com/search?q=3Dsite:bluevallet.com%22%3E<FONT = face=3DArial = size=3D3>http://www.google.com/search?q=3Dsite:bluevallet.com</FONT></A><= /FONT></DIV></BODY></HTML> R0lGODdhDQAMAOMAAP///wUTCMDEwWJrZCQwJt/h4KGmooKJg0NORQAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADQAMAAAEMRBIMUggo8htiNFFp0kFMW4Hsg3HtoWb6c5SQNP27cq6xN6GF4/TQnlA KZoAEbgUJREAOw== R0lGODdhDgAZAOMAAP///wUCDkNBSqGgpN/f4CQhLIKAhmJgaMC/wgAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADgAZAAAESxDISau9OOvNu/9gKHLCcA3CFAhERRSBOhiVYcRSXFQFgQOxg0kyOABV AERKIkAcc5Jecvd8GowHWhX36kK/gIPACP4hAs4yhfyNAAA7 R0lGODdhDQAXAMIAAP///wANER8rLt/g4V9nar/Cw5+kpQAAACwAAAAADQAXAAADMgi63P4wykmr vRiGt1dvHxB6zKiEplhyq4Oyi+AM8kIUjUEwtDEAA4PgxyMIAgICUZEAADs= R0lGODdhDAAVAOMAAP///wgOEMHCwyYsLYOGh2RoaeDg4aKkpUVKSwAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAADAAVAAAENhDISau9OOvNu5/CcA2CRFbhRBRVQUyGSAUGVRzTgaC7hJSVQS12IbyM F6IQg9BlDgNcRkaJAAA7 R0lGODdhBQANAIAAAP///w0KDywAAAAABQANAAACDIQfp2uJ6hqcr0pTAAA7 R0lGODdhDgANAMIAAP///xIJC6aioy8nKcPBwk1GSOHg4IiEhSwAAAAADgANAAADJwi63P4wShXE CIPYUFcoBnB8oRB4hBdSHnO2LBwD70zLt1zn8+4rCQA7 R0lGODdhCgAVAOMAAP///xMPD6alpTAtLcTDw2tpaeHh4YmHh05LSwAAAAAAAAAAAAAAAAAAAAAA AAAAACwAAAAACgAVAAAELRDISau9OOvNu/9AIAzBQFCBCBDmpEpC4RqTMbhVMNe39AIxV4tF8x1I iCIgAgA7 R0lGODdhCQAVAMIAAP///wQKA2JlYaCjoN/g3yMoIgAAAAAAACwAAAAACQAVAAADJQi63P4wykmr XWKsIRQpBPCFCgdkjaA6REAyaseYqAeK96mVcgIAOw==
__
SpamAssassin 3.0.1 did not catch this one, though the sender IP was on the SpamCop BL (that was all it caught).
Jeff C. -- Don't harm innocent bystanders.