You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by qqqq <qq...@usermail.com> on 2006/09/21 23:29:10 UTC
70_sare_spoof.cf False Pos - Bank of America
Looks like they are no longer using:
Received =~ /\.bankofamerica\.com/i
Return-Path: <bi...@billpay.bankofamerica.com>
X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on san.MUNGED.com
X-Spam-Status: Yes, score=5.3 required=5.2 tests=DNS_FROM_RFC_WHOIS=0.879,
HTML_MESSAGE=0.001,MIME_HTML_ONLY=0.001,NO_REAL_NAME=0.55,
SARE_FORGED_BANKOFA=3,SARE_HELO_EQ_CUST=0.122,X_MAILER_SPAM=0.72
autolearn=disabled version=3.1.4
X-Spam-Report:
* 0.1 SARE_HELO_EQ_CUST SARE_HELO_EQ_CUST
* 0.7 X_MAILER_SPAM X-Mailer: header is bulk email fingerprint
* 0.6 NO_REAL_NAME From: does not include a real name
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.9 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org
* 3.0 SARE_FORGED_BANKOFA SARE_FORGED_BANKOFA
Received: from gateway.MUNGED.com (mailgateway.MUNGED.com [216.x.x.x])
by imap.MUNGED.com (8.13.2/8.13.2) with ESMTP id k8LCS66W000351
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 06:28:06 -0600
X-ASG-Debug-ID: 1158841685-73ed03500000-213ZTq
X-Barracuda-URL: http://216.150.205.179:8000/cgi-bin/mark.cgi
X-Barracuda-Connect: outbd-pstfx.customercenter.net[208.235.248.20]
X-Barracuda-Start-Time: 1158841685
Received: from outbd-pstfx.customercenter.net (outbd-pstfx.customercenter.net [208.235.248.20])
by gateway.MUNGED.com (Spam Firewall) with ESMTP id E7C9529B429
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 06:28:05 -0600 (MDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by outbd-pstfx.customercenter.net (Postfix) with ESMTP id 5145D214279
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:27:17 -0400 (EDT)
X-Virus-Scanned: ClamAV 0.88.3/1918/Thu Sep 21 02:58:53 2006 on imap.MUNGED.com
X-Virus-Scanned: by amavisd-new at customercenter.net
Received: from prod-mail.customercenter.net (elpemh04.nc.customercenter.net [10.30.26.54])
by outbd-pstfx.customercenter.net (Postfix) with ESMTP id B0513214253
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:27:16 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by prod-mail.customercenter.net (Postfix) with ESMTP id 3E8DD2680F3
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:28:04 -0400 (EDT)
X-Virus-Scanned: by amavisd-new at customercenter.net
Received: from elpgts03.nc.checkfree.com (elpgts03.nc.checkfree.com [10.30.44.143])
by prod-mail.customercenter.net (Postfix) with ESMTP id B86BD2680F1
for <qq...@MUNGED.com>; Thu, 21 Sep 2006 08:28:03 -0400 (EDT)
Message-ID: <15...@ewaexe01.nc.checkfree.com>
Date: Thu, 21 Sep 2006 08:28:03 -0400 (EDT)
From: billpay@billpay.bankofamerica.com
Reply-To: billpay.reply@billpay.bankofamerica.com
To: qqqq@MUNGED.com
X-ASG-Orig-Subj: You have a new bill from Bank of America Credit Card
Subject: POTENTIAL SPAM You have a new bill from Bank of America Credit Card
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Priority: 2 (Normal)
X-Mailer: cdasend
Re: 70_sare_spoof.cf False Pos - Bank of America
Posted by Loren Wilton <lw...@earthlink.net>.
"Legit" in this particular instance is open to interpretation. :-(
The mail isn't from BofA. The mail is from CheckFree Inc.
Which is a legit banking company, but it isn't BofA.
So they are lying in the From address about who they are. In that sense,
the mail is a spoof.
On the other hand, it doubtless relates to some transaction on a BofA
account, and in that sense is somewhat legit. And they probably used the
BofA in the From so Joe Average would "know" that it was a legit mail, and
not from some company he never heard of.
Sigh.
Loren
----- Original Message -----
From: "qqqq" <qq...@usermail.com>
To: "Kelson Vibber" <ke...@speed.net>; "SpamAssassin Users"
<us...@spamassassin.apache.org>
Sent: Thursday, September 21, 2006 7:40 PM
Subject: Re: 70_sare_spoof.cf False Pos - Bank of America
>> *sigh* Assuming this really is legit... I hate it when prime phishing
>> targets decide to make things easier for the phishers by making their
>> own mail look suspicious, thereby training users to ignore warning signs.
>>
>> My "favorite" (and I use that term loosely) is Symantec -- a computer
>> security company -- which sends things like upgrade offers through
>> bluehornet.com.
>>
>
> Yea..it's legit. I checked the links and it was certainly them and the
> numbers in the emailing matched my info.
>
> B
Re: 70_sare_spoof.cf False Pos - Bank of America
Posted by qqqq <qq...@usermail.com>.
> *sigh* Assuming this really is legit... I hate it when prime phishing
> targets decide to make things easier for the phishers by making their
> own mail look suspicious, thereby training users to ignore warning signs.
>
> My "favorite" (and I use that term loosely) is Symantec -- a computer
> security company -- which sends things like upgrade offers through
> bluehornet.com.
>
Yea..it's legit. I checked the links and it was certainly them and the
numbers in the emailing matched my info.
B
Re: 70_sare_spoof.cf False Pos - Bank of America
Posted by Kelson Vibber <ke...@speed.net>.
qqqq wrote:
> Looks like they are no longer using:
> Received =~ /\.bankofamerica\.com/i
<snip>
> Received: from outbd-pstfx.customercenter.net (outbd-pstfx.customercenter.net [208.235.248.20])
*sigh* Assuming this really is legit... I hate it when prime phishing
targets decide to make things easier for the phishers by making their
own mail look suspicious, thereby training users to ignore warning signs.
My "favorite" (and I use that term loosely) is Symantec -- a computer
security company -- which sends things like upgrade offers through
bluehornet.com.
--
Kelson Vibber
SpeedGate Communications <www.speed.net>