Google search as spam URI - Discuss

4 Jan 2006


      This drug spam message body seems problematic, since the URI is
google, being used to search for the spammer's.   Naturally the
actual spammer domain  bluevallet.com  is blacklisted.  This
showed up  Tue, 03 Jan 2006 14:45:48 +0100
__
Proecia
Xana
Pail
VALIM from $1.21
IAGRA from $3.33
IALIS from $3.75
eridia
Abien
Soa
Levtra
=20
http://www.google.com/search?q=3Dsite:bluevallet.com
http://www.google.com/search?q=3Dsite:bluevallet.com=20
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D3>Pro<IMG =
src=3D"cid:000101c6106b$c54633bd$66c5a8c0@printingmachine">ecia</FONT></DIV>
<DIV><FONT face=3DArial size=3D3>Xana<IMG =
src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine"></FONT></DIV>
<DIV><FONT face=3DArial size=3D3>Pa<IMG =
src=3D"cid:000201c6106b$c54633bd$66c5a8c0@printingmachine">il</FONT></DIV>
<DIV><FONT face=3DArial size=3D3>VALI<IMG =
src=3D"cid:000301c6106b$c54633bd$66c5a8c0@printingmachine">M <STRONG>from =
$1.21</STRONG></FONT></DIV>
<DIV><FONT face=3DArial size=3D3><IMG =
src=3D"cid:000401c6106b$c54633bd$66c5a8c0@printingmachine">IAGRA <STRONG>from =
$3.33</STRONG></FONT></DIV>
<DIV><FONT face=3DArial size=3D3><IMG =
src=3D"cid:000501c6106b$c54633bd$66c5a8c0@printingmachine">IALIS <STRONG>from =
$3.75</STRONG></FONT></DIV>
<DIV><FONT face=3DArial size=3D3><IMG =
src=3D"cid:000601c6106b$c54633bd$66c5a8c0@printingmachine">eridia</FONT></DIV>
<DIV><FONT face=3DArial size=3D3>A<IMG =
src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">bien</FONT></DIV>
<DIV><FONT face=3DArial size=3D3>So<IMG =
src=3D"cid:000701c6106b$c54633bd$66c5a8c0@printingmachine">a</FONT></DIV>
<DIV><FONT face=3DArial size=3D3>Lev<IMG =
src=3D"cid:000801c6106b$c54633bd$66c5a8c0@printingmachine">tra</FONT></DIV>
<DIV><FONT face=3DArial size=3D3></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D3><A =
href=3D"http://www.google.com/search?q=3Dsite:bluevallet.com%22%3E<FONT =
face=3DArial =
size=3D3>http://www.google.com/search?q=3Dsite:bluevallet.com</FONT></A><=
/FONT></DIV></BODY></HTML>
R0lGODdhDQAMAOMAAP///wUTCMDEwWJrZCQwJt/h4KGmooKJg0NORQAAAAAAAAAAAAAAAAAAAAAA
AAAAACwAAAAADQAMAAAEMRBIMUggo8htiNFFp0kFMW4Hsg3HtoWb6c5SQNP27cq6xN6GF4/TQnlA
KZoAEbgUJREAOw==
R0lGODdhDgAZAOMAAP///wUCDkNBSqGgpN/f4CQhLIKAhmJgaMC/wgAAAAAAAAAAAAAAAAAAAAAA
AAAAACwAAAAADgAZAAAESxDISau9OOvNu/9gKHLCcA3CFAhERRSBOhiVYcRSXFQFgQOxg0kyOABV
AERKIkAcc5Jecvd8GowHWhX36kK/gIPACP4hAs4yhfyNAAA7
R0lGODdhDQAXAMIAAP///wANER8rLt/g4V9nar/Cw5+kpQAAACwAAAAADQAXAAADMgi63P4wykmr
vRiGt1dvHxB6zKiEplhyq4Oyi+AM8kIUjUEwtDEAA4PgxyMIAgICUZEAADs=
R0lGODdhDAAVAOMAAP///wgOEMHCwyYsLYOGh2RoaeDg4aKkpUVKSwAAAAAAAAAAAAAAAAAAAAAA
AAAAACwAAAAADAAVAAAENhDISau9OOvNu5/CcA2CRFbhRBRVQUyGSAUGVRzTgaC7hJSVQS12IbyM
F6IQg9BlDgNcRkaJAAA7
R0lGODdhBQANAIAAAP///w0KDywAAAAABQANAAACDIQfp2uJ6hqcr0pTAAA7
R0lGODdhDgANAMIAAP///xIJC6aioy8nKcPBwk1GSOHg4IiEhSwAAAAADgANAAADJwi63P4wShXE
CIPYUFcoBnB8oRB4hBdSHnO2LBwD70zLt1zn8+4rCQA7
R0lGODdhCgAVAOMAAP///xMPD6alpTAtLcTDw2tpaeHh4YmHh05LSwAAAAAAAAAAAAAAAAAAAAAA
AAAAACwAAAAACgAVAAAELRDISau9OOvNu/9AIAzBQFCBCBDmpEpC4RqTMbhVMNe39AIxV4tF8x1I
iCIgAgA7
R0lGODdhCQAVAMIAAP///wQKA2JlYaCjoN/g3yMoIgAAAAAAACwAAAAACQAVAAADJQi63P4wykmr
XWKsIRQpBPCFCgdkjaA6REAyaseYqAeK96mVcgIAOw==
__
SpamAssassin 3.0.1 did not catch this one, though the sender IP
was on the SpamCop BL (that was all it caught).
Jeff C.
--
Don't harm innocent bystanders.