Re: debbie-dealz / frosty-saver / got-hyrda / aero-dog spam

> I've somehow made it onto spam list that isn't being
> picked up by RBLs or by bayes. All messages have a url
> that looks like this (where X's are all digits):
>
> http://aero-dog.com/1-23-28276-45381XXXXXXX.html
>
> All messages are originating from 206.131.x.x and I have
> been submitting them to spamcop. A sample message is
> here: http://bubba.org/spam/newspam1.txt
>
> Any suggestions for detecting this? My bayes has been
> pretty much spot on for months, so this has me puzzled.
>
> Thanks,
> Brian

Result here

Content analysis details: (12.7 points, 5.0 required)

 pts rule name description

---- ---------------------- --------------------------------------------------
 1.6 SUBJ_ILLEGAL_CHARS     Subject: has too many raw illegal characters
 2.0 BAYES_80               BODY: Bayesian spam probability is 80 to 95%
                            [score: 0.9391]
 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
                            above 50%
                            [cf:  91]
 0.5 RAZOR2_CHECK           Listed in Razor2 (
http://razor.sf.net/)
 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                            [cf:  91]
 2.2 DCC_CHECK              Listed in DCC (
http://rhyolite.com/anti-spam/dcc/)
 1.5 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: frosty-saver.com]
 2.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: frosty-saver.com]
 1.0 DIGEST_MULTIPLE        Message hits more than one network digest check