[Spambayes] Missing HTML payload

Mark Hammond mhammond at skippinet.com.au
Tue Mar 4 10:25:26 EST 2003


The following mail got past SpamBayes.  Looking at the clues, it appears
that spambayes was missing the HTML body of the message (which *does* render
almost correctly in Outlook).

I instrumented the "show clues" feature to show *all* message tokens found
in the body.  As you can see at the very end, the entire body was stripped.

I am guessing that we barf on:
            <td><!--#rotato>
a comment which is never closed.  Outlook actually shows this entire tag
(ie, literally "<!--#rotato>", then displays the rest of the HTML
correctly - ie, I guess that we treat the comment as unclosed, while Outlook
ignores it.

Any thoughts?  {Please ignore the clues themselves - this is the subject of
a following mail)

Mark.


Spam Score: 0.305365


word                                spamprob         #ham  #spam
'*H*'                               0.698329            -      -
'*S*'                               0.309059            -      -
'subject:133'                       0.0505618           4      0
'x-mailer:microsoft outlook express 5.50.4522.1200' 0.118157          262
79
'subject:: '                        0.143355          836    316
'from:addr:domresgube'              0.155172            1      0
'message-id:@atbsfwo.wvk'           0.155172            1      0
'subject:2120uBwJ9'                 0.155172            1      0
'subject:Following'                 0.155172            1      0
'url:vivapharmacy1'                 0.155172            1      0
'header:Message-ID:1'               0.337892         1501   1732
'url:twelveover'                    0.342142            1      1
'url:home'                          0.605737            6     21
'skip:5 20'                         0.67407             4     19
'url:unsubscribe'                   0.693218            6     31
'header:Received:9'                 0.730547           50    307
'from:no real name:2**0'            0.740359          202   1303
'url:1'                             0.772286           20    154
'from:addr:yahoo.com'               0.836924           33    384
'url:images'                        0.901105           15    311
'url:jpg'                           0.9546              8    385

Message Stream:


Return-Path: <domresgube at yahoo.com>
Received: from mta06ps.bigpond.com ([192.168.115.5]) by
          mailms7a.email.bigpond.com (Netscape Messaging Server 4.15
          mailms7a Apr 29 2002 13:22:02) with ESMTP id HB4SEB02.X2J for
          <mhammond at bigpond.net.au>; Mon, 3 Mar 2003 02:56:35 +1000
Received: from dampier.southern.net.au ([144.135.25.87]) by
          mta06ps.bigpond.com (Netscape Messaging Server 4.15 mta06ps May
          23 2002 23:53:28) with SMTP id HB4SEA00.FMS for
          <mhammond at bigpond.net.au>; Mon, 3 Mar 2003 02:56:34 +1000
Received: from dampier.southern.net.au ([202.182.64.135]) by
	psmam07.bigpond.com(MailRouter V3.2g 119/7122531); 03 Mar 2003 02:56:33
Received: from localhost (localhost [127.0.0.1])
	by dampier.southern.net.au (Postfix) with SMTP id CD92A64280
	for <mhammond at bigpond.net.au>; Mon,  3 Mar 2003 03:56:32 +1100
Received: by dampier.southern.net.au (Postfix, from userid 0)
	id AB9BE5D4FE; Mon,  3 Mar 2003 03:56:32 +1100
Received: from localhost (localhost [127.0.0.1])
	by dampier.southern.net.au (Postfix) with SMTP id 58AC56427F
	for <mhammond at skippinet.com.au>; Mon,  3 Mar 2003 03:56:32 +1100
Received: from eyre.southern.net.au (ip10-0-0-11.unroutable [10.0.0.11])
	by dampier.southern.net.au (Postfix) with ESMTP id 245445D4D4
	for <mhammond at skippinet.com.au>; Mon,  3 Mar 2003 03:56:32 +1100
Received: from localhost (localhost [127.0.0.1])
	by eyre.southern.net.au (Postfix) with SMTP id B39B982C
	for <mhammond at skippinet.com.au>; Mon,  3 Mar 2003 03:56:37 +1100
Received: from yahoo.com (0x50c61e76.hrnxx3.adsl-dhcp.tele.dk
[80.198.30.118])
	by eyre.southern.net.au (Postfix) with SMTP id 94DB5A412B
	for <mhammond at skippinet.com.au>; Mon,  3 Mar 2003 03:56:26 +1100
Message-ID: <000310b0ba33$ddd62445$00384561 at atbsfwo.wvk>
From: <domresgube at yahoo.com>
To: <mhammond at skippinet.com.au>
Subject: RE: Following up2120uBwJ9-133-12
Date: Mon, 03 Mar 2003 18:42:37 -1000
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_00D2_32D55E0B.E7046D05"
X-Priority: 3
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
Importance: Normal

<HTML>5cFGY1ws1bMNedOg853Pv
<div align="center">
  <table width="700" border="0" cellspacing="5" cellpadding="0">
    <tr>
      <td>
        <table width="650" border="0" cellspacing="0" cellpadding="0"
align="center">
          <tr>
            <td><!--#rotato>
              <div align="center"><font face=Arial size=6><font face=Arial
size=6><font size="3" face="Arial, Helvetica, sans-serif"><b>Did
                you know you can&nbsp;get prescription medications
prescribed
                o<font color="#000000">nline?</font></b></font></font><font
color="#ff0000" face="Arial, Helvetica, sans-serif"><br>
                No Prior Prescription Required!!<br>
                <font color=#0033CC size=4>AND GET YOUR ORDER THE NEXT
DAY!!!</font></font></font>
              </div>
              <p align=center><font face="Arial, Helvetica, sans-serif"> <a
href="http://www.twelveover.com/vivapharmacy1/home.asp"><b><font
size="3">Click
                Here Now</font></b></a><font size="3"> for more information
about
                getting your new or existing <br>
                medications prescribed online and shipped to your door
overnight!</font></font></p>
              <p align=center><font face="Arial, Helvetica,
sans-serif"><b><font size="3">TRY
                US NOW</font></b><font size="3"> and <b>JOIN THE
THOUSANDS</b>
                of satisfied Internet Pharmacy customers! </font></font></p>
            </td>
          </tr>
        </table>
        <br>
        <div align="center"><a
href="http://www.twelveover.com/vivapharmacy1/home.asp"><img
src="http://www.twelveover.com/images/1.jpg" width="641" height="239"
border="0"></a>
          <br>
          <br>
          <font face="Arial, Helvetica, sans-serif"><a
href="http://www.twelveover.com/vivapharmacy1/home.asp"><b><font
size="3">Click
          Here Now</font></b></a><font size="3"> for more
information</font></font>
          <br>
          <br>
        </div>
        <div align="center">
<table width="650" border="0" cellspacing="0" cellpadding="0">
            <tr>
              <td>
                <div align="left"><font face="Arial" size="2">One of our US
licensed
                  physicians will write you an FDA approved prescription for
free,
                  and have your order shipped overnight via a US Licensed
pharmacy
                  direct to your doorstep, fast and secure!</font> </div>
              </td>
            </tr>
          </table>
          <br>
          <table width="648" border="0" cellspacing="0" cellpadding="0">
            <tr>
              <td>
                <p>
                <p><font face="Arial, Helvetica, sans-serif" size="2">If you
wish
                  to decline to receive these offers, <a
href="http://www.twelveover.com/vivapharmacy1/unsubscribe.asp">Please
                  Click Here</a></font></p>
              </td>
            </tr>
          </table>
        </div>
      </td>
    </tr>
  </table>
  <br>
  <br>
  <br>
</div>
</BODY>
</HTML>

Rokgtbmmpuwfoitsoahkmtgpocojkuxflsixwwyuaqpkclwiphmmnygit
7692RkAi0-575sNFa4909QyBK4-

Message Tokens:

23 unique tokens

header:Importance:1
subject:Following
from:addr:yahoo.com
message-id:@atbsfwo.wvk
header:From:1
from:addr:domresgube
header:MIME-Version:1
x-mailer:microsoft outlook express 5.50.4522.1200
header:Subject:1
to:2**0
header:Received:9
subject:133
subject:2120uBwJ9
subject:
subject::
header:To:1
subject:-
from:no real name:2**0
content-type:multipart/mixed
header:Return-Path:1
header:Date:1
header:Message-ID:1
subject:


More information about the Spambayes mailing list