Spam Sample #1
This is a genuine spam email with the identifying items removed. This is what it looks like when it is received
by your PC after it has been analyzed by our server's anti-spam software. It is automatically moved to your trash or to a specified
directory for you to review periodically. Most importantly, it stays out of your INBOX!
Normally, you won't see all of the spam scoring item lines, as they are part of the email's header and not displayed on
most email programs by default.
To: <Undisclosed.Recipients>
From: "xxx" <xxx@xxx.com>
Subject: SPAM (66.60): Penis enlargement without surgery! As Seen on TV!
Date: Sat, 11 Jan 2003 10:48:14 -2000
Reply-To: xxx@xxx.com
X-Spam-Status: Yes, hits=66.6 required=5.0
X-Spam-Report: 66.60 hits, 5 required;
* 4.0 -- Invalid Date: header (timezone does not exist)
* 0.9 -- From: ends in numbers
* 0.6 -- To: has a malformed address
* 2.1 -- BODY: Information on getting a larger penis or breasts (2)
* 1.4 -- BODY: As seen on national TV!
* 0.8 -- BODY: Contains word 'guarantee' in all-caps
* 0.5 -- BODY: Spam is 100% natural?!
* 0.4 -- BODY: Asks you to click below (in caps)
* 0.3 -- BODY: Asks you to click below
* 1.9 -- BODY: Spam phrases score is 21 to 34 (high)
[score: 23]
* 0.3 -- BODY: 3 WHOLE LINES OF YELLING DETECTED
* 0.2 -- BODY: 2 WHOLE LINES OF YELLING DETECTED
* 0.2 -- BODY: A WHOLE LINE OF YELLING DETECTED
* 50.0 -- URI: Spam Site: xxx.com
* 2.4 -- Date: is 24 to 48 hours after Received: date
* 0.2 -- message body is 50-75% uppercase
* 0.4 -- Subject has many exclamations
IN THE NEWS 2002
THE FIRST ALL-IN-ONE
Male Performance Enhancer AND Penis Enlargement
WITH THE TRADEMARKED SWEDISH INGREDIENT CRETIN-MAKER.
http://www.xxx.com/xxx/
CLICK HERE TO FIND OUT HOW TO RECEIVE YOUR FREE 1
MONTH SUPPY WITH THIS INTRODUCTORY OFFER!!
<< snip >> The rest of this long idiotic message has been removed.
Spam Sample # 2
Reply-To: <xxx@xxx.com>
From: <xxx@xxx.com>
To: <xxx>
Subject: SPAM (23.20): Amateur XXX CAMS LIVE - NO CREDIT CARD OK!
Date: Fri, 10 Jan 2003 22:53:15 +0200
X-Priority: 1 (High)
X-Spam-Status: Yes, hits=23.2 required=5.0
X-Spam-Report: 23.20 hits, 5 required;
* 2.6 -- Subject contains lots of white space
* 2.4 -- MiME-Version header (oddly capitalized)
* 1.3 -- From: does not include a real name
* 1.0 -- Bulk email software fingerprint (eGroups) found in headers
* 0.9 -- From: ends in numbers
* 0.4 -- Sent with 'X-Priority' set to high
* 0.4 -- Sent with 'X-Msmail-Priority' set to high
* 1.3 -- BODY: Incorporates a tracking ID number
* 0.4 -- BODY: Eliminate Bad Credit
* 0.4 -- BODY: Possible porn - Hot, Nasty, Wild, Young
* 0.3 -- BODY: Asks you to click below
* 1.4 -- BODY: Spam phrases score is 08 to 13 (medium)
[score: 12]
* 0.3 -- BODY: FONT Size +2 and up or 3 and up
* 0.3 -- BODY: HTML font face is not a commonly used face
* 0.3 -- BODY: 3 WHOLE LINES OF YELLING DETECTED
* 0.3 -- BODY: HTML font color is red
* 0.3 -- BODY: Message is 50-70% HTML tags
* 0.2 -- BODY: 2 WHOLE LINES OF YELLING DETECTED
* 0.2 -- BODY: A WHOLE LINE OF YELLING DETECTED
* 0.2 -- BODY: HTML font color is blue
* 0.2 -- BODY: HTML font face is not a word
* 1.4 -- RAW: Message text disguised using base-64 encoding
* 0.4 -- RAW: MIME section missing boundary
* 1.3 -- URI: Uses a dotted-decimal IP address in URL
* 0.7 -- URI: URL of page called "remove"
* 1.1 -- Subject contains a unique ID
* 0.3 -- Date: is 3 to 6 hours before Received: date
* 0.5 -- Message has X-MSMail-Priority, but no X-MimeOLE
* 1.1 -- Message looks like Outlook, but isn't
* 1.3 -- message body is 25-50% uppercase
ENTER HERE
VIRGIN TEENS LIVE !!!
XXX-RATED AMATEUR HOME-CAMS !!!
ENTER HERE
NO CREDIT CARD NEEDED !!!!
<< snip >> The rest of this porn message has been removed.
