================================================================================ 220 gandalf.merlins.org ESMTP Exim 4.04 #33 Sat, 04 May 2002 23:07:58 -0700 - mm1 mail from: merlin@gandalf 250 OK rcpt to: merlin@gandalf 250 Accepted data 354 Enter message, ending with "." on a line by itself teest setest . 451-Heuristics guessed that this message was spam: 451-hits=6.1 required=1.0 trigger=6.0, so it is temporarilty rejected. 451 Admins may whitelist this and it may be accepted when you resubmit it. ==> /var/log/exim/mainlog <== 2002-05-04 23:19:22 174FMb-0007CK-00 Writing suspected spam to /var/spool/exim/SAtempreject//E174FMb-0007CK-00@gandalf.merlins.org 2002-05-04 23:19:22 174FMb-0007CK-00 temporarily rejected by local_scan(): Heuristics guessed that this message was spam:\nhits=6.1 required=1.0 trigger=6.0, so it is temporarilty rejected.\nAdmins may whitelist this and it may be accepted when you resubmit it. ================================================================================ mail from: merlin@gandalf 250 OK rcpt to: merlin@gandalf 250 Accepted data 354 Enter message, ending with "." on a line by itself From: merlin@gandalf To: merlin@gandalf Subject: $$$ Make Money Fast $$$ !!! viagra 100% GARANTEE AMAZING FULL REFUND This is not spam . 550-Heuristics guessed that this message was spam: 550 hits=14.8 required=1.0 trigger=12.0 ==> /var/log/exim/rejectlog <== 2002-05-04 23:32:23 174FYd-0007J3-00 rejected by local_scan(): Heuristics guessed that this message was spam:\nhits=14.8 required=1.0 trigger=12.0 Envelope-from: Envelope-to: P Received: from localhost ([127.0.0.1]:34488 ident=root) by gandalf.merlins.org with smtp (Exim 4.04 #34 (Debian)) id 174FYd-0007J3-00 for ; Sat, 04 May 2002 23:31:50 -0700 F From: merlin@gandalf T To: merlin@gandalf Subject: $$$ Make Money Fast $$$ !!! I Message-Id: Date: Sat, 04 May 2002 23:31:50 -0700 X-Spam-Status: Yes, hits=14.8 required=1.0 tests=FROM_MALFORMED,NO_REAL_NAME,PLING,PLING_PLING,TO_MALFORMED,FREE_MONEY,CASHCASHCASH,FULL_REFUND,VIAGRA,AMAZING,THIS_AINT_SPAM,EXCUSE_15,FROM_AND_TO_SAME version=2.20 X-Spam-Flag: YES X-Spam-Level: ************** X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id: SpamAssassin.pm,v 1.77 2002/04/06 19:28:30 hughescr Exp $) X-Spam-Report: 14.8 hits, 1 required; * 2.2 -- From: has a malformed address * 0.6 -- From: does not include a real name * 0.5 -- Subject has an exclamation mark * 0.4 -- Subject has lots of exclamation marks * 0.3 -- To: has a malformed address * 1.0 -- BODY: Free money! * 0.2 -- BODY: Contains at least 3 dollar signs in a row * 2.8 -- BODY: Offers a full refund * 2.4 -- BODY: Plugs Viagra * 1.6 -- BODY: Contains word 'AMAZING' in all-caps * 1.5 -- BODY: Claims "This is not spam" * 0.4 -- BODY: Claims to be legitimate email * 0.9 -- From and To the same address ================================================================================ mail from: merlin@gandalf 250 OK rcpt to: merlin@gandalf 250 Accepted data 354 Enter message, ending with "." on a line by itself From: merlin@gandalf To: merlin@gandalf Subject: $$$ Make Money Fast $$$ !!! X-Disable-SA: yes viagra 100% GARANTEE AMAZING FULL REFUND This is not spam . 250 OK id=174GK6-0007lh-00 2002-05-05 00:20:54 174GK6-0007lh-00 SA check skipped due to expansion to false ================================================================================ mail from: merlin@gandalf 250 OK rcpt to: merlin@gandalf 250 Accepted data 354 Enter message, ending with "." on a line by itself From: merlin@gandalf To: merlin@gandalf Subject: $$$ Make Money Fast $$$ !!! viagra 100% GARANTEE AMAZING FULL REFUND This is not spam NO QUESTIONS ASKED /money making Dear Friend e-mail marketing one time mailing International Executive Guild If you did not opt in . 250 OK id=174Fb5-0007J3-00 ==> /var/log/exim/mainlog <== 2002-05-04 23:35:46 174Fb5-0007J3-00 Writing suspected spam to /var/spool/exim/SAdevnull//134566388_E174Fb5-0007J3-00@gandalf.merlins.org 2002-05-04 23:35:46 174Fb5-0007J3-00 <= merlin@gandalf H=localhost [127.0.0.1]:34488 I=[127.0.0.1]:25 U=root P=smtp S=1970 T="$$$ Make Money Fast $$$ !!!" from for 2002-05-04 23:35:46 174Fb5-0007J3-00 => blackhole Message is spam (score: hits=20.9 required=1.0 trigger=20.0) and is being fed to the bit bucket (please don't feed it too much, it might get fat) 2002-05-04 23:35:46 174Fb5-0007J3-00 Completed ==> /var/log/exim/rejectlog <== 2002-05-04 23:35:46 174Fb5-0007J3-00 local_scan SA silently tossed message: hits=20.9 required=1.0 trigger=20.0 P Received: from localhost ([127.0.0.1]:34488 ident=root) by gandalf.merlins.org with smtp (Exim 4.04 #34 (Debian)) id 174Fb5-0007J3-00 for ; Sat, 04 May 2002 23:34:19 -0700 F From: merlin@gandalf T To: merlin@gandalf Subject: $$$ Make Money Fast $$$ !!! I Message-Id: Date: Sat, 04 May 2002 23:34:19 -0700 X-Spam-Status: Yes, hits=20.9 required=1.0 tests=FROM_MALFORMED,NO_REAL_NAME,PLING,PLING_PLING,TO_MALFORMED,FREE_MONEY,CASHCASHCASH,NO_QS_ASKED,DEAR_SOMEBODY,FULL_REFUND,MONEY_MAKING,VIAGRA,DEAR_FRIEND,AMAZING,THIS_AINT_SPAM,EXCUSE_2,INTL_EXEC_GUILD,EMAIL_MARKETING,EXCUSE_15,FROM_AND_TO_SAME version=2.20 X-Spam-Flag: YES X-Spam-Level: ******************** X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id: SpamAssassin.pm,v 1.77 2002/04/06 19:28:30 hughescr Exp $) X-Spam-Report: 20.9 hits, 1 required; * 2.2 -- From: has a malformed address * 0.6 -- From: does not include a real name * 0.5 -- Subject has an exclamation mark * 0.4 -- Subject has lots of exclamation marks * 0.3 -- To: has a malformed address * 1.0 -- BODY: Free money! * 0.2 -- BODY: Contains at least 3 dollar signs in a row * -0.8 -- BODY: Doesn't ask any questions * -0.5 -- BODY: Contains 'Dear Somebody' * 2.8 -- BODY: Offers a full refund * 2.5 -- BODY: Discusses money making * 2.4 -- BODY: Plugs Viagra * 2.1 -- BODY: How dear can you be if you don't know my name? * 1.6 -- BODY: Contains word 'AMAZING' in all-caps * 1.5 -- BODY: Claims "This is not spam" * 1.3 -- BODY: Claims you actually asked for this SPAM * 0.8 -- BODY: Well known SPAM senders * 0.7 -- BODY: Talks about email marketing * 0.4 -- BODY: Claims to be legitimate email * 0.9 -- From and To the same address ================================================================================