New spam/phising

[Jason Staudenmayer <ja...@adventureaquarium.com>]

I'm starting to see a lot of bluebottle email come through. They are
scoring either right under my limit or really low. Anyone else see this?
SpamAssassin version 2.63
RH 8
Qmail + qmail-scanner

Here's the header:

Microsoft Mail Internet Headers Version 2.0
Received: from mail2.adventureaquarium.com ([10.0.0.2]) by
MAIL-I.adventureaquarium.com with Microsoft SMTPSVC(5.0.2195.6713);
	 Mon, 5 Dec 2005 20:30:11 -0500
Received: (qmail 11352 invoked by uid 511); 6 Dec 2005 01:30:23 -0000
Received: from  by mail2.adventureaquarium.com by uid 508 with
qmail-scanner-1.20 
 (fileformat: ???. spamassassin: 2.63.
Clear:RC:0(209.144.225.73):SA:0(0.8/7.5):. 
 Processed in 3.207068 secs); 06 Dec 2005 01:30:23 -0000
X-Qmail-Scanner-Mail-From:  via mail2.adventureaquarium.com
X-Qmail-Scanner: 1.20 (Clear:RC:0(209.144.225.73):SA:0(0.8/7.5):.
Processed in 3.207068 secs)
Received: from unknown (HELO fe4.bluebottle.com) (209.144.225.73)
  by mail2.adventureaquarium.com with SMTP; 6 Dec 2005 01:30:19 -0000
Received: from fe0.bluebottle.com (fe0.bluebottle.com [209.144.225.92])
	by fe4.bluebottle.com (8.13.4/8.13.4) with ESMTP id
jB67U6qM030862
	for <xx...@adventureaquarium.com>; Tue, 6 Dec 2005
01:30:07 -0600
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	(authenticated bits=0)
	by fe0.bluebottle.com (8.13.4/8.13.4) with ESMTP id
jB62U4Hf010705
	for <xx...@adventureaquarium.com>; Mon, 5 Dec 2005
20:30:19 -0600
Date: Mon, 5 Dec 2005 20:30:04 -0600
Message-Id: <20...@fe0.bluebottle.com>
From: alerts@bluebottle.com
To: xxxxxxxxxxxx@adventureaquarium.com
Subject: RE: hi, ive a new mail address
Content-Type: text/plain; charset=us-ascii
X-Bluebottle-Request: <b3df34448d77a539e2b9008edf8366bb>
X-Bluebottle-Address: <al...@bluebottle.com>
X-Bluebottle-Subject: hi, ive a new mail address
X-Qmail-Scanner-1.20: added fake MIME-Version header
MIME-Version: 1.0
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on 
	mail2.adventureaquarium.com
X-Spam-Level: 
X-Spam-Status: No, hits=0.8 required=7.5 tests=BAYES_01,NO_REAL_NAME 
	autolearn=no version=2.63
Return-Path: <>
X-OriginalArrivalTime: 06 Dec 2005 01:30:11.0981 (UTC)
FILETIME=[99F683D0:01C5FA04]

Re: New spam/phising

[Loren Wilton <lw...@earthlink.net>]

Haven't see those like that.  But that subject line is a standard header for
the recent run of Sober viruses.  So I assume that is probably a virus.

        Loren