[SURBL-Discuss] Possible warning to users. Santa phish.
Chris Santerre
csanterre at MerchantsOverseas.com
Tue Nov 16 16:35:24 CET 2004
I just got a spam that hit 2 SURBL domains. Advert for "Send your kids an
email from santa!" How nice of spammers to not only tkae your $10, but
harvest your children's email account and name as well. I'll be drafting up
a warning to my users shortly. Others may want to do the same. Spread the
love :)
Content preview: Commercial Announcement
======================================= Get a Letter From Santa! Go
here to get started:
http://kelepouri113.com/ssnbpsq.php?oioWAHTwnlp94ooMSG_bcfchahj.3284859ioWAH
Twnlp94oo22SJWMerchantsOverseas.comioWAHTwnlp94oo1027163931&f=493&i=1908
[...]
Content analysis details: (5.2 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.7 EXCUSE_6 BODY: Claims you can be removed from the list
0.8 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.2 HTML_90_100 BODY: Message is 90% to 100% HTML
0.6 MY_ALT RAW: Empty ALT uri
0.5 MY_NO_QU RAW: Q without a U
0.4 MY_OBFU_LONG RAW: One long word!
2.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: kelepouri113.com equalispecialvecto.com]
--Chris (Santa don't need this crap right now!)
More information about the Discuss
mailing list