[Openfirst-debug] SPAM huge news break

[Christian H. <tkz...@ao...>]

Spam detection software, running on the system "webone.timginn.com", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  ***ATTENTION ALL DAY TRADERS AND INVESTORS*** INVESTOR
  ALERT! DON'T MISS ANOTHER RUN ON IVHN!!! BREAKING NEWS CAME OUT ON
  WEDNESDAY!!! WATCH IT EXPLODE ON FRIDAY!!! [...] 

Content analysis details:   (14.8 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.3 FROM_LOCAL_NOVOWEL     From: localpart has series of non-vowel letters
 2.7 HELO_DYNAMIC_DHCP      Relay HELO'd using suspicious hostname (DHCP)
 3.4 HELO_DYNAMIC_IPADDR    Relay HELO'd using suspicious hostname (IP addr
                            1)
 3.1 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                            [74.239.37.252 listed in sbl-xbl.spamhaus.org]
 0.0 ADVANCE_FEE_1          Appears to be advance fee fraud (Nigerian 419)
 3.4 FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook