Re: Strange message

Yes. The headers match the one I just got. It claims to have been sent
by sfpug.

elein

On Wednesday 22 January 2003 12:06, David Alban wrote:
> Greetings!
>
> Did anyone else get a message like the following? [spamassassin
> stuff added by my procmail]
>
> From sfpug-owner+M147(at)postgresql(dot)org Wed Jan 22 09:25:20 2003
> Return-Path: <sfpug-owner+M147(at)postgresql(dot)org>
> Received: from hitchcock.mail.mindspring.net
> (hitchcock.mail.mindspring.net [207.69.200.23]) by new.gerasimov.net
> (8.11.2/8.8.7) with ESMTP id h0MEPJA06448 for <alban(at)gerasimov(dot)net>; Wed,
> 22 Jan 2003 09:25:19 -0500 Received: from walker.mail.atl.earthlink.net
> ([207.69.200.227])
> by hitchcock.mail.mindspring.net with smtp (Exim 3.33 #1)
> id 18bLod-0003hG-00
> for alban(at)gerasimov(dot)net; Wed, 22 Jan 2003 09:25:19 -0500
> X-MindSpring-Loop: extasia(at)mindspring(dot)com
> Received: from relay2.pgsql.com ([64.49.215.143])
> by walker.mail.atl.earthlink.net (Earthlink Mail Service) with
> ESMTP id 18BlOZ6Na3Nl3s70 for <extasia(at)mindspring(dot)com>; Wed, 22 Jan 2003
> 09:25:41 -0500 (EST) Received: from postgresql.org (postgresql.org
> [64.49.215.8])
> by relay2.pgsql.com (Postfix) with ESMTP
> id 7B945EE0520; Wed, 22 Jan 2003 09:25:06 -0500 (EST)
> Received: from localhost (postgresql.org [64.49.215.8])
> by postgresql.org (Postfix) with ESMTP
> id A64A047610B; Wed, 22 Jan 2003 09:24:58 -0500 (EST)
> Received: from michael (TC210-202-86-185.adsl.pl.apol.com.tw
> [210.202.86.185]) by postgresql.org (Postfix) with SMTP
> id 9C552476026; Wed, 22 Jan 2003 09:24:52 -0500 (EST)
> Received: from iris
> by yahoo.com with SMTP id NLvUdJhbHh4R0Uy8iQJTRFGXZu;
> Wed, 22 Jan 2003 22:24:36 +0800
> Message-ID: <XeKdd(at)pavo(dot)seed(dot)net(dot)tw>
> From: <A4>p<AA><E1>@postgresql.org
> To: <A9><C9><AF><F8>@postgresql.org
> Subject: *****SPAM***** [sfpug] ?s?~????....
> MIME-Version: 1.0
> X-Mailer: LzYCJ0vT7y5xXml0rxSl81l
> X-Priority: 3
> X-MSMail-Priority: Normal
> Date: Wed, 22 Jan 2003 09:24:52 -0500 (EST)
> X-Virus-Scanned: by AMaViS new-20020517
> Content-Transfer-Encoding: 7bit
> Content-Type: text/plain
> Precedence: bulk
> Sender: sfpug-owner(at)postgresql(dot)org
> X-Spam-Status: Yes, hits=13.9 required=5.0
> tests=NO_REAL_NAME,FRONTPAGE,BIG_FONT,BASE64_ENC_TEXT,
> CHARSET_FARAWAY_HEADERS,CTYPE_JUST_HTML
> version=2.31
> X-Spam-Flag: YES
> X-Spam-Level: *************
> X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v
> 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $) X-Spam-Prev-Content-Type:
> text/html; charset="big5"
> X-Spam-Prev-Content-Transfer-Encoding: base64
>
> SPAM: -------------------- Start SpamAssassin results
> ---------------------- SPAM: This mail is probably spam. The original
> message has been altered SPAM: so you can recognise or block similar
> unwanted mail in future. SPAM: See http://spamassassin.org/tag/ for more
> details.
> SPAM:
> SPAM: Content analysis details: (13.9 hits, 5 required)
> SPAM: NO_REAL_NAME (0.5 points) From: does not include a real name
> SPAM: FRONTPAGE (4.4 points) BODY: Frontpage used to create the
> message SPAM: BIG_FONT (2.1 points) BODY: FONT Size +2 and up or
> 3 and up SPAM: BASE64_ENC_TEXT (2.1 points) Message text disguised
> using base-64 encoding SPAM: CHARSET_FARAWAY_HEADERS (3.1 points) A
> foreign language charset used in headers SPAM: CTYPE_JUST_HTML (1.7
> points) HTML-only mail, with no text version SPAM:
> SPAM: -------------------- End of SpamAssassin results
> ---------------------
>
> PGh0bWw+DQoNCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1M
> YW5ndWFnZSIgY29udGVudD0iemgtdHciPg0KPG1ldGEgaHR0cC1lcXVpdj0i
> Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9Ymln
> NSI+DQo8bWV0YSBuYW1lPSJHRU5FUkFUT1IiIGNvbnRlbnQ9Ik1pY3Jvc29m
> dCBGcm9udFBhZ2UgNC4wIj4NCjxtZXRhIG5hbWU9IlByb2dJZCIgY29udGVu
> dD0iRnJvbnRQYWdlLkVkaXRvci5Eb2N1bWVudCI+DQo8dGl0bGU+ptGqQqTN
> qNO1uadBPC90aXRsZT4NCjwvaGVhZD4NCg0KPGJvZHk+DQoNCjxwPqFAPC9w
> Pg0KPHA+ptGqQqTNqNO1uadBLi4uLjwvcD4NCjxwPjxiPjxmb250IHNpemU9
> IjciIGZhY2U9IrzQt6LF6SIgY29sb3I9IiNGRjAwMDAiPjxhIGhyZWY9Imh0
> dHA6Ly9uZXd5ZWFyLndlbGNvbWVVLnRvIiB0YXJnZXQ9Il9ibGFuayI+q/Sm
> raZ+s+GhSTwvYT48L2ZvbnQ+PC9iPjwvcD4NCg0KPC9ib2R5Pg0KDQo8L2h0
> bWw+
>
> The above, decoded, is the following html (I replaced the angle
> brackets with square brackets, and represented unprintable characters
> as three digit octal numbers preceded each by a backslash):
>
> [html]\015
> \015
> [head]\015
> [meta http-equiv="Content-Language" content="zh-tw"]\015
> [meta http-equiv="Content-Type" content="text/html; charset=big5"]\015
> [meta name="GENERATOR" content="Microsoft FrontPage 4.0"]\015
> [meta name="ProgId" content="FrontPage.Editor.Document"]\015
> [title]\246\321\252B\244\315\250\323\265\271\247A[/title]\015
> [/head]\015
> \015
> [body]\015
> \015
> [p]\241(at)[/p]\015
> [p]\246\321\252B\244\315\250\323\265\271\247A....[/p]\015
> [p][b][font size="7" face="\274\320\267\242\305\351" color="#FF0000"][a
> href="http://newyear.welcomeU.to"
> target="_blank"]\253\364\246\255\246~\263\341\241I[/a][/font][/b][/p]\015
> \015
> [/body]\015
> \015
>
> David

--
----------------------------------------------------------------------------------------
elein(at)varlena(dot)com Database Consulting www.varlena.com
I have always depended on the [QA] of strangers.