Just a short followup:
http://atriks.com/email_deployment.htm

Argh. No wonder none of the DNS blacklists are triggering.

have you got sample spam?   Also, what addrs are being hit -- user addresses, or
nonexistent/scraped/guaranteed-spam addrs?  They could always be doing legit
opt-in, and the users signed up, you never know ;)

Given that webpage, I think an SBL listing would be in the offing if they *are*
spamming.  There's only so much help 'Distributed delivery' can provide.  But
their web presence looks quite clean-cut, which makes me wonder if they're not
spammers, just a large-scale sender with bad bounce handling or similar.

I'm only counting spams sent to my work e-mail address.
The only way they could be getting that is web scraping (and lord
knows it's all over the place with all the public mailing lists with
web archives I'm on).

I'm attaching a couple of sample spams.

Created attachment 1617 [details]
10 sample spams delivered via "Atriks Professional Email Deployment Service"
(NOTE: .tar.gz)

Note also the 2nd Received: headers, e.g.
Received: by 1.2.3.4 with Atriks Professional Email Deployment Service

This stuff really arrives from all over the place. SBLing them
would be .. um .. hard.

Bah. They just changed the X-Mailer. Last four mails:

X-Mailer: Atriks Professional Email Deployment Service (Version ES16.5.2)
X-Mailer: Atriks Professional Email Deployment Service (Version ES17.5.2)
X-Mailer: Atriks Professional Email Deployment Server (Version ES18.7.1)
X-Mailer: Atriks Professional Email Deployment Server (Version ES19.7.1)

This seems like a lost cause. They changed the signature again a 
few days ago.

- X-Mailer: SMTP (Version ES12.9.0)
  (score 3.6)

- X-Mailer: SMTP (Version ES00.9.0)
  (score 4.1)

- X-Mailer: SMTP (Version ES18.9.0)
  (score 4.3)

One could possibly filter on the version bit to catch all three
signatures, but something about these changes is just a bit too 
timely -- I wouldn't be surprised if these guys are monitoring SA 
development closely so that they can send spam that ducks under 
the 5.0 line.

I'm thinking exactly the same thing.  Hi Atriks people!

Have there been any changes in the formatting?  In particular, the
QUOTED-PRINTABLE (in all caps) in the Content-Transfer-Encoding line,
and img/href references to

http://t.wwwanswers.com/track
http://t.sendmails.com/track
http://t.mailnotice.com/track

may still be usable signatures.

The Message-ID and Errors-To addresses seem identifiable as well.

They have an SBL listing:

http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12495

'Update: less than 24 hours after they promised to quit spamming if we removed
their SBL listing, they have now started spamming from China. Listing re-enabled
until they really stop.'

They aren't likely to stop. See their web page about their email services
http://atriks.com/email_deployment.htm

I wonder how many of the "over 60,000 individuals throughout the world who act
as sending agents for the Atriks Distributed Email Delivery System" know that
their machines are being used. It doesn't seem like something practical to set
up in any legal, consensual way.

Another quote: "When messages are available, each agent machine can receive up
to 100 emails to deliver. For example, with 20,000 agents sending 100 emails
each, the Atriks Distributed Email Delivery System can deliver 2 Million emails
in one quick shot."

I wonder, though, if their New Hampshire company location leaves them vulnerable
to the new federal antispam law?

Recommend wontfix -> close on this one.

Would

header   T_ATRIKS X-Mailer =~ /Atriks Professional Email Deployment/
describe T_ATRIKS Sigmata of Atriks proxy farm
score    T_ATRIKS 0.5

be reasonable for testing?

AFAICT, Atriks is black hat; you'll lose nothing legitimate by dropping their
traffic on sight.

I would love to be able to drop their traffic on sight.

However, each time we've mentioned a reasonable signature, they've
changed it in 24--72 hours. They're well aware of SA. 

"/Atriks Professional Email Deployment/" won't catch a single spam today;
they use more or less random X-Mailers now.

Hence my recommendation: resolve this bug as wontfix and close it.

following recommendation of originator to close as WONTFIX

fwiw, I think they're in the SBL these days.

They indeed are, but that only helps if you've hacked in the HOSTED_*
patch from bug 1375. 

Their multi-level marketing scheme of delivery via lusers that get
paid 1 cent an hour to let atriks spam through them (and more cash
to get them to sign up their friends) makes RBLing their sender IPs
damn near impossible.