question about new spam encoding

[Matt Garretson]

Matt Garretson wrote:
> However, i did notice two things unexpected.  There's an http URL in
> the body, http://www.quick-home-loan-search.biz/, which does not
> get tokenized.
> 
> Also, an IP address from the header (200.59.68.139, in a Received: line),
> which doesn't get tagged with rcvd: or head:


More specifically, below is my (0.15.8) bogolexer output for the
message -- does it look right?

normal mode.
get_token: 1 "head:From"
get_token: 1 "head:daemon"
get_token: 1 "head:assembly.state.ny.us"
get_token: 1 "head:Wed"
get_token: 1 "head:Nov"
get_token: 1 "rtrn:hsl49.nasni.navy.mil"
get_token: 1 "head:Delivered-To"
get_token: 1 "head:vhost-harrison-org-trevor"
get_token: 1 "head:harrison.org"
get_token: 1 "rcvd:Received"
get_token: 1 "rcvd:qmail"
get_token: 1 "rcvd:invoked"
get_token: 1 "rcvd:from"
get_token: 1 "rcvd:network"
get_token: 1 "rcvd:Nov"
get_token: 1 "rcvd:Received"
get_token: 1 "rcvd:from"
get_token: 5 "200.59.68.139"
get_token: 1 "rcvd:steastwood.harrison.org"
get_token: 1 "rcvd:with"
get_token: 1 "rcvd:SMTP"
get_token: 1 "rcvd:Nov"
get_token: 2 "head:Message-ID"
get_token: 1 "from:hsl49.nasni.navy.mil"
get_token: 1 "head:Reply-To"
get_token: 1 "head:hsl49.nasni.navy.mil"
get_token: 1 "to:trevor"
get_token: 1 "to:harrison.org"
get_token: 1 "subj:Please"
get_token: 1 "subj:fill"
get_token: 1 "subj:this"
get_token: 1 "subj:out"
get_token: 1 "subj:and"
get_token: 1 "subj:return"
get_token: 2 "head:Date"
get_token: 2 "head:MIME-Version"
get_token: 1 "head:Content-Type"
get_token: 1 "head:multipart"
get_token: 1 "head:alternative"
get_token: 1 "head:Status"
get_token: 1 "head:Content-Length"
get_token: 1 "head:Lines"
get_token: 1 "head:Content-Type"
get_token: 1 "head:text"
get_token: 1 "head:html"
get_token: 1 "head:Content-Transfer-Encoding"
get_token: 1 "head:quoted-printable"
get_token: 1 "nbsp"
get_token: 1 "Refinance"
get_token: 1 "today"
get_token: 1 "low"
get_token: 1 "Save"
get_token: 1 "thousands"
get_token: 1 "nbsp"
get_token: 1 "dollars"
get_token: 1 "buy"
get_token: 1 "the"
get_token: 1 "home"
get_token: 1 "your"
get_token: 1 "dreams!"
get_token: 1 "Apply"
get_token: 1 "today!"
get_token: 1 "only"
get_token: 1 "takes"
get_token: 1 "minutes"
get_token: 1 "nbsp"
get_token: 1 "href"
get_token: 1 "CLICK"
get_token: 1 "HERE"
get_token: 1 "Thanks"
get_token: 1 "Jennifer"
get_token: 1 "Santos"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "size"
get_token: 1 "removed"
get_token: 1 "please"
get_token: 1 "href"
get_token: 1 "click"
get_token: 1 "here"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "nbsp"
get_token: 1 "zapjv"
get_token: 1 "cdjyssfsrulgmmxlgggcnri"
98 tokens read.


I'd expect www.quick-home-loan-search.biz to show up somewhere in there.

-Matt