ok, so here's what I get:
Received: from localhost by mysite.com
with SpamAssassin (version 3.1.7);
Wed, 24 Jan 2007 07:03:06 -0600
From: "CSS" <mlijghev@co.th>
To: me@mysite.com
Subject: ***SPAM*** All you favorite games
Date: Wed, 24 Jan 2007 20:05:03 -0700
Message-Id: <27F12A03C4C9013.E79BA94F3A@co.th>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on mysite.com
X-Spam-Level: *******************************
X-Spam-Status: Yes, score=31.6 required=5.0 tests=DATE_IN_FUTURE_12_24,
DCC_CHECK,DIGEST_MULTIPLE,HELO_DYNAMIC_IPADDR,HTML _FONT_BIG,
HTML_MESSAGE,MIME_HTML_ONLY,PYZOR_CHECK,RAZOR2_CF_ RANGE_51_100,
RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CF_RANGE_E8_51_10 0,RAZOR2_CHECK,
RCVD_IN_NJABL_DUL,URIBL_AB_SURBL,URIBL_JP_SURBL,UR IBL_OB_SURBL,
URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=spam version=3.1.7
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_45B7590A.A8B2BAE2"
This is a multi-part message in MIME format.
------------=_45B7590A.A8B2BAE2
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "mysite.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Only from the most noble of all casinos you could except
such a Regal gift: 300% Bonus on your First Deposit!!! Deposit 100 €/$
and Play with 400 €/$!!! And on top of that, a service at such a level
you would not find in the best Royal Families of Europe. [...]
Content analysis details: (31.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr
1)
2.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
0.0 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_FONT_BIG BODY: HTML tag for a big font size
0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
above 50%
[cf: 100]
0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.8 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
1.4 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
1.7 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[124.120.75.104 listed in combined.njabl.org]
1.1 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: royal-casinos.net]
3.3 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: royal-casinos.net]
3.4 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: royal-casinos.net]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: royal-casinos.net]
2.6 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: royal-casinos.net]
3.6 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: royal-casinos.net]
0.2 DIGEST_MULTIPLE Message hits more than one network digest check
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_45B7590A.A8B2BAE2
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path: <mlijghev@co.th>
X-Original-To: me@mysite.com
Delivered-To: me@mysite.com
Received: from ppp-124.120.75.104.revip2.asianet.co.th (ppp-124.120.75.104.revip2.asianet.co.th [124.120.75.104])
by mysite.com (Postfix) with ESMTP id 6D93728812D
for <me@mysite.com>; Wed, 24 Jan 2007 07:02:54 -0600 (CST)
From: "CSS" <mlijghev@co.th>
To: me@mysite.com
Subject: All you favorite games
Date: Wed, 24 Jan 2007 20:05:03 -0700
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0004_01C73FF2.EF359450"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: Acc/8u81fpkgH5tzTVSodtW9OyefTg==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
Message-Id: <27F12A03C4C9013.E79BA94F3A@co.th>
------=_NextPart_000_0004_01C73FF2.EF359450
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2900.2963" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY><p align=3D"center"><font face=3D"Arial, Helvetica, sans-serif"><b>
<font size=3D"+1" color=3D"#00CC00" face=3D"Courier New, Courier, mono">Only from the most noble of all<br>
casinos you could except such a Regal gift:</font><br><br>
<font size=3D"+2" color=3D"#FF0000">300% Bonus on your <font color=3D"#0000FF">First Deposit!!!</font></font><br><br>
<font style=3D"font-size:13pt" color=3D"#000000">Deposit 100 €/$ and Play with 400 €/$!!!</font><br>
And on top of that, a service at such a<br>
level you would not find in the best<br>
Royal Families of Europe.<br><br>
<a href=3D"http://royal-casinos.net"> Come and play at Royal VIP Casino!!! </a></b></font><br><br>
If you didn’t sign up click <a href=3D"http://royal-casinos.net/unsub.php">here</a>
</p>
</BODY></HTML>
------=_NextPart_000_0004_01C73FF2.EF359450--
------------=_45B7590A.A8B2BAE2--
if I click on the attachment and view that email, it shows this:
Return-Path: <mlijghev@co.th>
X-Original-To: me@mysite.com
Delivered-To: me@mysite.com
Received: from ppp-124.120.75.104.revip2.asianet.co.th (ppp-124.120.75.104.revip2.asianet.co.th [124.120.75.104])
by mysite.com (Postfix) with ESMTP id 6D93728812D
for <me@mysite.com>; Wed, 24 Jan 2007 07:02:54 -0600 (CST)
From: "CSS" <mlijghev@co.th>
To: me@mysite.com
Subject: All you favorite games
Date: Wed, 24 Jan 2007 20:05:03 -0700
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0004_01C73FF2.EF359450"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: Acc/8u81fpkgH5tzTVSodtW9OyefTg==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
Message-Id: <27F12A03C4C9013.E79BA94F3A@co.th>
------=_NextPart_000_0004_01C73FF2.EF359450
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2900.2963" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY><p align=3D"center"><font face=3D"Arial, Helvetica, sans-serif"><b>
<font size=3D"+1" color=3D"#00CC00" face=3D"Courier New, Courier, mono">Only from the most noble of all<br>
casinos you could except such a Regal gift:</font><br><br>
<font size=3D"+2" color=3D"#FF0000">300% Bonus on your <font color=3D"#0000FF">First Deposit!!!</font></font><br><br>
<font style=3D"font-size:13pt" color=3D"#000000">Deposit 100 €/$ and Play with 400 €/$!!!</font><br>
And on top of that, a service at such a<br>
level you would not find in the best<br>
Royal Families of Europe.<br><br>
<a href=3D"http://royal-casinos.net"> Come and play at Royal VIP Casino!!! </a></b></font><br><br>
If you didn’t sign up click <a href=3D"http://royal-casinos.net/unsub.php">here</a>
</p>
</BODY></HTML>
------=_NextPart_000_0004_01C73FF2.EF359450--
I forwarded both as an attachment to spamcop and the first, the one that had been altered got me the "No source IP address found, cannot proceed." error message from spamcop that I've been getting. The second parsed ok. Now, I'm thinking that having to open the email (not using a preview pane) and then opening an attached email, and then forwarding the now opened attachment of the email is a bit of a hassle. Is this working right or do I have some setting wrong?