[Spambayes] Missing HTML payload
Mark Hammond
mhammond at skippinet.com.au
Tue Mar 4 10:25:26 EST 2003
The following mail got past SpamBayes. Looking at the clues, it appears
that spambayes was missing the HTML body of the message (which *does* render
almost correctly in Outlook).
I instrumented the "show clues" feature to show *all* message tokens found
in the body. As you can see at the very end, the entire body was stripped.
I am guessing that we barf on:
<td><!--#rotato>
a comment which is never closed. Outlook actually shows this entire tag
(ie, literally "<!--#rotato>", then displays the rest of the HTML
correctly - ie, I guess that we treat the comment as unclosed, while Outlook
ignores it.
Any thoughts? {Please ignore the clues themselves - this is the subject of
a following mail)
Mark.
Spam Score: 0.305365
word spamprob #ham #spam
'*H*' 0.698329 - -
'*S*' 0.309059 - -
'subject:133' 0.0505618 4 0
'x-mailer:microsoft outlook express 5.50.4522.1200' 0.118157 262
79
'subject:: ' 0.143355 836 316
'from:addr:domresgube' 0.155172 1 0
'message-id:@atbsfwo.wvk' 0.155172 1 0
'subject:2120uBwJ9' 0.155172 1 0
'subject:Following' 0.155172 1 0
'url:vivapharmacy1' 0.155172 1 0
'header:Message-ID:1' 0.337892 1501 1732
'url:twelveover' 0.342142 1 1
'url:home' 0.605737 6 21
'skip:5 20' 0.67407 4 19
'url:unsubscribe' 0.693218 6 31
'header:Received:9' 0.730547 50 307
'from:no real name:2**0' 0.740359 202 1303
'url:1' 0.772286 20 154
'from:addr:yahoo.com' 0.836924 33 384
'url:images' 0.901105 15 311
'url:jpg' 0.9546 8 385
Message Stream:
Return-Path: <domresgube at yahoo.com>
Received: from mta06ps.bigpond.com ([192.168.115.5]) by
mailms7a.email.bigpond.com (Netscape Messaging Server 4.15
mailms7a Apr 29 2002 13:22:02) with ESMTP id HB4SEB02.X2J for
<mhammond at bigpond.net.au>; Mon, 3 Mar 2003 02:56:35 +1000
Received: from dampier.southern.net.au ([144.135.25.87]) by
mta06ps.bigpond.com (Netscape Messaging Server 4.15 mta06ps May
23 2002 23:53:28) with SMTP id HB4SEA00.FMS for
<mhammond at bigpond.net.au>; Mon, 3 Mar 2003 02:56:34 +1000
Received: from dampier.southern.net.au ([202.182.64.135]) by
psmam07.bigpond.com(MailRouter V3.2g 119/7122531); 03 Mar 2003 02:56:33
Received: from localhost (localhost [127.0.0.1])
by dampier.southern.net.au (Postfix) with SMTP id CD92A64280
for <mhammond at bigpond.net.au>; Mon, 3 Mar 2003 03:56:32 +1100
Received: by dampier.southern.net.au (Postfix, from userid 0)
id AB9BE5D4FE; Mon, 3 Mar 2003 03:56:32 +1100
Received: from localhost (localhost [127.0.0.1])
by dampier.southern.net.au (Postfix) with SMTP id 58AC56427F
for <mhammond at skippinet.com.au>; Mon, 3 Mar 2003 03:56:32 +1100
Received: from eyre.southern.net.au (ip10-0-0-11.unroutable [10.0.0.11])
by dampier.southern.net.au (Postfix) with ESMTP id 245445D4D4
for <mhammond at skippinet.com.au>; Mon, 3 Mar 2003 03:56:32 +1100
Received: from localhost (localhost [127.0.0.1])
by eyre.southern.net.au (Postfix) with SMTP id B39B982C
for <mhammond at skippinet.com.au>; Mon, 3 Mar 2003 03:56:37 +1100
Received: from yahoo.com (0x50c61e76.hrnxx3.adsl-dhcp.tele.dk
[80.198.30.118])
by eyre.southern.net.au (Postfix) with SMTP id 94DB5A412B
for <mhammond at skippinet.com.au>; Mon, 3 Mar 2003 03:56:26 +1100
Message-ID: <000310b0ba33$ddd62445$00384561 at atbsfwo.wvk>
From: <domresgube at yahoo.com>
To: <mhammond at skippinet.com.au>
Subject: RE: Following up2120uBwJ9-133-12
Date: Mon, 03 Mar 2003 18:42:37 -1000
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00D2_32D55E0B.E7046D05"
X-Priority: 3
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
Importance: Normal
<HTML>5cFGY1ws1bMNedOg853Pv
<div align="center">
<table width="700" border="0" cellspacing="5" cellpadding="0">
<tr>
<td>
<table width="650" border="0" cellspacing="0" cellpadding="0"
align="center">
<tr>
<td><!--#rotato>
<div align="center"><font face=Arial size=6><font face=Arial
size=6><font size="3" face="Arial, Helvetica, sans-serif"><b>Did
you know you can get prescription medications
prescribed
o<font color="#000000">nline?</font></b></font></font><font
color="#ff0000" face="Arial, Helvetica, sans-serif"><br>
No Prior Prescription Required!!<br>
<font color=#0033CC size=4>AND GET YOUR ORDER THE NEXT
DAY!!!</font></font></font>
</div>
<p align=center><font face="Arial, Helvetica, sans-serif"> <a
href="http://www.twelveover.com/vivapharmacy1/home.asp"><b><font
size="3">Click
Here Now</font></b></a><font size="3"> for more information
about
getting your new or existing <br>
medications prescribed online and shipped to your door
overnight!</font></font></p>
<p align=center><font face="Arial, Helvetica,
sans-serif"><b><font size="3">TRY
US NOW</font></b><font size="3"> and <b>JOIN THE
THOUSANDS</b>
of satisfied Internet Pharmacy customers! </font></font></p>
</td>
</tr>
</table>
<br>
<div align="center"><a
href="http://www.twelveover.com/vivapharmacy1/home.asp"><img
src="http://www.twelveover.com/images/1.jpg" width="641" height="239"
border="0"></a>
<br>
<br>
<font face="Arial, Helvetica, sans-serif"><a
href="http://www.twelveover.com/vivapharmacy1/home.asp"><b><font
size="3">Click
Here Now</font></b></a><font size="3"> for more
information</font></font>
<br>
<br>
</div>
<div align="center">
<table width="650" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
<div align="left"><font face="Arial" size="2">One of our US
licensed
physicians will write you an FDA approved prescription for
free,
and have your order shipped overnight via a US Licensed
pharmacy
direct to your doorstep, fast and secure!</font> </div>
</td>
</tr>
</table>
<br>
<table width="648" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
<p>
<p><font face="Arial, Helvetica, sans-serif" size="2">If you
wish
to decline to receive these offers, <a
href="http://www.twelveover.com/vivapharmacy1/unsubscribe.asp">Please
Click Here</a></font></p>
</td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<br>
<br>
<br>
</div>
</BODY>
</HTML>
Rokgtbmmpuwfoitsoahkmtgpocojkuxflsixwwyuaqpkclwiphmmnygit
7692RkAi0-575sNFa4909QyBK4-
Message Tokens:
23 unique tokens
header:Importance:1
subject:Following
from:addr:yahoo.com
message-id:@atbsfwo.wvk
header:From:1
from:addr:domresgube
header:MIME-Version:1
x-mailer:microsoft outlook express 5.50.4522.1200
header:Subject:1
to:2**0
header:Received:9
subject:133
subject:2120uBwJ9
subject:
subject::
header:To:1
subject:-
from:no real name:2**0
content-type:multipart/mixed
header:Return-Path:1
header:Date:1
header:Message-ID:1
subject:
More information about the Spambayes
mailing list