websecurity@lists.webappsec.org

The Web Security Mailing List

View all threads

***SPAM*** real pleasure

W
websecurity
Thu, Mar 30, 2017 6:49 PM

Spam detection software, running on the system "webappsec", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
@@CONTACT_ADDRESS@@ for details.

Content preview:  Greetings! It's been a real pleasure to meet you yesterday,
thanks for everything! I just wanted to share with you something really interesting
http://www.kowalskamarta.pl/carve.php?2021 Best regards, websecurity [...]

Content analysis details:  (5.9 points, 5.0 required)

pts rule name              description


0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
(metalanillo[at]yahoo.es)
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see http://www.spamcop.net/bl.shtml?117.5.9.159]
0.0 SPF_HELO_FAIL          SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.net/Why?s=helo;id=xjiev.mail.ru;ip=117.5.9.159;r=webappsec]
1.2 URIBL_JP_SURBL        Contains an URL listed in the JP SURBL blocklist
[URIs: kowalskamarta.pl]
1.7 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
[URIs: kowalskamarta.pl]
0.0 HTML_MESSAGE          BODY: HTML included in message
0.8 BAYES_50              BODY: Bayes spam probability is 40 to 60%
[score: 0.5345]
0.0 T_URIBL_BLACK_OVERLAP  T_URIBL_BLACK_OVERLAP
0.8 RDNS_NONE              Delivered to internal network by a host with no rDNS

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Spam detection software, running on the system "webappsec", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see @@CONTACT_ADDRESS@@ for details. Content preview: Greetings! It's been a real pleasure to meet you yesterday, thanks for everything! I just wanted to share with you something really interesting http://www.kowalskamarta.pl/carve.php?2021 Best regards, websecurity [...] Content analysis details: (5.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (metalanillo[at]yahoo.es) 1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see <http://www.spamcop.net/bl.shtml?117.5.9.159>] 0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail) [SPF failed: Please see http://www.openspf.net/Why?s=helo;id=xjiev.mail.ru;ip=117.5.9.159;r=webappsec] 1.2 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist [URIs: kowalskamarta.pl] 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist [URIs: kowalskamarta.pl] 0.0 HTML_MESSAGE BODY: HTML included in message 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.5345] 0.0 T_URIBL_BLACK_OVERLAP T_URIBL_BLACK_OVERLAP 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS The original message was not completely plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with an editor.