Re: [SPAM:6.0] Spam coming from hotmail.
On Mon, 09 Nov 2009 15:09:18 + "rich...@buzzhost.co.uk" wrote: > > Running those through my SA gets the biggest hit for the second > example with the Indian link in the body. But that's a custom rule > kindly given to me by of one of the good people on this list. > > I'm more concerned with this: > > X-Originating-IP: [189.69.146.53] > > In Brazil yet my relay module does not seem to be biting on it. The list of country codes in the X-Spam-Relay-Countries header corresponds to the list of untrusted relays - which is taken from the received headers.
RE: [SPAM:6.0] Spam coming from hotmail.
Someone kindly showed me pastebin. Here are my samples FINALLY in proper form (my apologies for any inconvenience.): http://pastebin.com/m44e99f80 http://pastebin.com/m4a64ab62 Oh that's a good point. That is pretty funny, obviously their outgoing protection isn't too good. Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College Red Hat Certified Technician (RHCT) -Original Message- From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] Sent: Monday, November 09, 2009 9:36 AM To: users@spamassassin.apache.org Subject: Re: [SPAM:6.0] Spam coming from hotmail. On 09.11.09 09:20, Casartello, Thomas wrote: > Yeah I should have attached those instead of copying and pasting the > Outlook crap. Was pretty stupid, my apologies. no, you should have publiched them somewhere and paste a link. Sending spam to any mailing list is a bad idea, unless the mailing list recommends that. btw, it was this advertising signature what made him laugh: > > __ > > Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign > > up now. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Fighting for peace is like fucking for virginity... smime.p7s Description: S/MIME cryptographic signature
RE: [SPAM:6.0] Spam coming from hotmail.
Running those through my SA gets the biggest hit for the second example with the Indian link in the body. But that's a custom rule kindly given to me by of one of the good people on this list. I'm more concerned with this: X-Originating-IP: [189.69.146.53] In Brazil yet my relay module does not seem to be biting on it.
Re: [SPAM:6.0] Spam coming from hotmail.
On 09.11.09 09:20, Casartello, Thomas wrote: > Yeah I should have attached those instead of copying and pasting the > Outlook crap. Was pretty stupid, my apologies. no, you should have publiched them somewhere and paste a link. Sending spam to any mailing list is a bad idea, unless the mailing list recommends that. btw, it was this advertising signature what made him laugh: > > __ > > Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign > > up now. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Fighting for peace is like fucking for virginity...
RE: [SPAM:6.0] Spam coming from hotmail.
Here are two of the messages in a more proper form. Again I apologize for the
earlier message.
Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College
Red Hat Certified Technician (RHCT)
-Original Message-
From: Casartello, Thomas
Sent: Monday, November 09, 2009 9:20 AM
To: 'rich...@buzzhost.co.uk'
Cc: Spamassassin Mailing List
Subject: RE: [SPAM:6.0] Spam coming from hotmail.
Yeah I should have attached those instead of copying and pasting the Outlook
crap. Was pretty stupid, my apologies.
Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College
Red Hat Certified Technician (RHCT)
-Original Message-
From: rich...@buzzhost.co.uk [mailto:rich...@buzzhost.co.uk]
Sent: Monday, November 09, 2009 8:47 AM
Cc: Spamassassin Mailing List
Subject: Re: [SPAM:6.0] Spam coming from hotmail.
On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote:
> I’ve been getting a lot of non-scoring spam coming from hotmail over
> the last couple weeks. It’s one user that’s been complaining about it.
>
> Here’s a few samples:
{serious ascii murder commited}
I could not stop laughing at this given the context...
>
> __
> Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign
> up now.
Received-SPF: pass (hotmail.com: Sender is authorized to use
'toblosas...@hotmail.com' in 'mfrom' identity (mechanism
'include:spf-a.hotmail.com' matched)) receiver=mx1.wsc.ma.edu;
identity=mailfrom; envelope-from="toblosas...@hotmail.com";
helo=col0-omc3-s1.col0.hotmail.com; client-ip=65.55.34.139
Received: from col0-omc3-s1.col0.hotmail.com
(col0-omc3-s1.col0.hotmail.com [65.55.34.139])
by mx1.wsc.ma.edu (Postfix) with ESMTP id A54CB37600A
for ; Mon, 9 Nov 2009 03:52:05 -0500 (EST)
Received: from COL114-W59 ([65.55.34.136]) by
col0-omc3-s1.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 9 Nov 2009 00:49:29 -0800
Message-ID:
Content-Type: multipart/alternative;
boundary="_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_"
X-Originating-IP: [92.124.6.234]
From: oblosas towazoco
To: , ,
, ,
CC:
Subject: Afternoon
Date: Mon, 9 Nov 2009 00:49:29 -0800
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 09 Nov 2009 08:49:29.0207 (UTC)
FILETIME=[8C758870:01CA6119]
--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
How are you=2C
If i recollect correctly=2C you weren't feeling well the other week
and I t=
hought you'd want to see
http://www.google.com/reader/item/tag:google.com=
=2C2005:reader/item/bfbff5e0da68bbf1
This store is an internet store with great collections. Immediately
you'll =
know that it's a bargain!
Get better=2C
Gerek
=20
_
Hotmail: Trusted email with powerful SPAM protection.
http://clk.atdmt.com/GBL/go/177141665/direct/01/=
--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
-->
How are you=2C
If i recollect correctly=2C you weren't feeling well the other week
and I t=
hought you'd want to see http://www.google.com/reader/item/tag:g=
oogle.com=2C2005:reader/item/bfbff5e0da68bbf1">http://www.google.com/reader=
/item/tag:google.com=2C2005:reader/item/bfbff5e0da68bbf1
This store is an internet store with great collections. Immediately
you'll =
know that it's a bargain!
Get better=2C
Gerek Hotmail: Trusted
email with powerful
SPAM =
protection. http://clk.atdmt.com/GBL/go/177141665/direct/01/' ta=
rget=3D'_new'>Sign up now.
=
--_bd552ac0-b167-4ee2-926d-d8eb2b4270a0_--
Received-SPF: pass (hotmail.com: Sender is authorized to use
'jmouswenf...@hotmail.com' in 'mfrom' identity (mechanism
'include:spf-a.hotmail.com' matched)) receiver=mx2.wsc.ma.edu;
identity=mailfrom; envelope-from="jmouswenf...@hotmail.com";
helo=blu0-omc2-s12.blu0.hotmail.com; client-ip=65.55.111.87
Received: from blu0-omc2-s12.blu0.hotmail.com
(blu0-omc2-s12.blu0.hotmail.com [65.55.111.87])
by mx2.wsc.ma.edu (Postfix) with ESMTP id 530D814002
for ; Mon, 9 Nov 2009 00:27:50 -0500 (EST)
Received: from BLU139-W3 ([65.55.111.72]) by
blu0-omc2-s12.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Sun, 8 Nov 2009 21:26:48 -0800
Message-ID:
Cont
RE: [SPAM:6.0] Spam coming from hotmail.
Yeah I should have attached those instead of copying and pasting the Outlook
crap. Was pretty stupid, my apologies.
Thomas E. Casartello, Jr.
Staff Assistant - Wireless/Linux Administrator
Information Technology
Wilson 105A
Westfield State College
Red Hat Certified Technician (RHCT)
-Original Message-
From: rich...@buzzhost.co.uk [mailto:rich...@buzzhost.co.uk]
Sent: Monday, November 09, 2009 8:47 AM
Cc: Spamassassin Mailing List
Subject: Re: [SPAM:6.0] Spam coming from hotmail.
On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote:
> I’ve been getting a lot of non-scoring spam coming from hotmail over
> the last couple weeks. It’s one user that’s been complaining about it.
>
> Here’s a few samples:
{serious ascii murder commited}
I could not stop laughing at this given the context...
>
> __
> Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign
> up now.
smime.p7s
Description: S/MIME cryptographic signature
Re: [SPAM:6.0] Spam coming from hotmail.
On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote:
> I’ve been getting a lot of non-scoring spam coming from hotmail over
> the last couple weeks. It’s one user that’s been complaining about it.
>
> Here’s a few samples:
{serious ascii murder commited}
I could not stop laughing at this given the context...
>
> __
> Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign
> up now.
