Re: HELO_DYNAMIC_IPADDR2 HELO_DYNAMIC_SPLIT_IP hitting ham

2012-12-10 Thread Kevin A. McGrail
On 12/9/2012 10:17 AM, Matus UHLAR - fantomas wrote: On 02.12.12 14:29, Niamh Holding wrote: Subject: HELO_DYNAMIC_IPADDR2 HELO_DYNAMIC_SPLIT_IP hitting ham X-Spam-Report: * 3.6 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr * 2) * 3.5

Re: HELO_DYNAMIC_IPADDR2 HELO_DYNAMIC_SPLIT_IP hitting ham

2012-12-10 Thread Niamh Holding
Hello Kevin, Monday, December 10, 2012, 2:25:06 PM, you wrote: KAM Can you open a bug please? Me, or Matus? -- Best regards, Niamhmailto:ni...@fullbore.co.uk pgpvFow5oZY1p.pgp Description: PGP signature

Re: MMORPG phishing attacks from yahoo accounts?

2012-12-10 Thread RW
On Mon, 10 Dec 2012 08:13:35 +1300 Jason Haar wrote: Hi there We've been getting hit with waves of MMORPG spam claiming to be Diablo and Runescape account management emails. The thing that concerns me is that Yahoo seems to associate the spammer's initial IP through a Received header

Re: HELO_DYNAMIC_IPADDR2 HELO_DYNAMIC_SPLIT_IP hitting ham

2012-12-10 Thread Kevin A. McGrail
On 12/10/2012 9:37 AM, Niamh Holding wrote: Hello Kevin, Monday, December 10, 2012, 2:25:06 PM, you wrote: KAM Can you open a bug please? Me, or Matus? Doesn't matter really. Whomever has the sample?

Re: HELO_DYNAMIC_IPADDR2 HELO_DYNAMIC_SPLIT_IP hitting ham

2012-12-10 Thread Niamh Holding
Hello Kevin, Monday, December 10, 2012, 2:39:39 PM, you wrote: KAM Doesn't matter really. Whomever has the sample? Done and 2 samples attached to the report. -- Best regards, Niamhmailto:ni...@fullbore.co.uk pgpoRWzvixnYZ.pgp Description: PGP signature

Re: Scoring Yahoo mail from certain continents/countries ?

2012-12-10 Thread Frederic De Mees
From: John Hardin jhar...@impsec.org ...so what rules *are* they hitting? Hello John, I have pasted a recent issue on pastebin: http://pastebin.com/74aAZPw9 , score 0.5 Its origin is unfortunately in the US, not Africa. But if I change Received: from [173.245.64.9] by

new (?) Google Translate trick using URL Shorteners

2012-12-10 Thread Chip M.
There's a new (to me), overly clever campaign combining Google Translate with a URL shortener. It's fairly low volume, but most are sailing thru SA. It's such a goofy pattern it feels like it's worthy of an Extinction level score. :) These started yesterday (Dec 9) at around 2am Eastern US

Re: Scoring Yahoo mail from certain continents/countries ?

2012-12-10 Thread RW
On Mon, 10 Dec 2012 21:34:47 +0100 Frederic De Mees wrote: From: John Hardin jhar...@impsec.org ...so what rules *are* they hitting? Hello John, I have pasted a recent issue on pastebin: http://pastebin.com/74aAZPw9 , score 0.5 Its origin is unfortunately in the US, not Africa.

Re: Scoring Yahoo mail from certain continents/countries ?

2012-12-10 Thread John Hardin
On Mon, 10 Dec 2012, Frederic De Mees wrote: From: John Hardin jhar...@impsec.org ...so what rules *are* they hitting? Hello John, I have pasted a recent issue on pastebin: http://pastebin.com/74aAZPw9 , score 0.5 Thanks. That is pretty thin to work with... Its origin is unfortunately

Re: new (?) Google Translate trick using URL Shorteners

2012-12-10 Thread John Hardin
On Mon, 10 Dec 2012, Chip M. wrote: John H: I'll send you a couple of raw corpses so you can wave your RE magic wand. :) Sanka, but until samples start showing up in the masscheck corpus don't expect much good from SA... -- John Hardin KA7OHZ