Re: new kind of spam with bizarre custom headers getting through

On Thu, 4 Sep 2014, George Johnson wrote: I'm getting another slew of these this morning, all with a variety of strange headers added apparently to foil spam filtering. All are getting through my spamassassin set up, which is usually nearly bulletproof. Typical headers are: Imbrue-Gaol:

Re: new kind of spam with bizarre custom headers getting through

Regards, > -sm Thanks. So far the ever-changing headers have been eluding Bayes. But I added some rbls to Postfix and that has stanched the flow. -- View this message in context: http://spamassassin.1065346.n5.nabble.com/new-kind-of-spam-with-bizarre-custom-headers-getting-through-tp111494p111585.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: new kind of spam with bizarre custom headers getting through

On Fri, 5 Sep 2014, SM wrote: At 11:02 04-09-2014, George Johnson wrote: I'm getting another slew of these this morning, all with a variety of strange headers added apparently to foil spam filtering. All are getting through my spamassassin set up, which is usually nearly bulletproof. Typical h

Re: new kind of spam with bizarre custom headers getting through

Hi George, At 11:02 04-09-2014, George Johnson wrote: I'm getting another slew of these this morning, all with a variety of strange headers added apparently to foil spam filtering. All are getting through my spamassassin set up, which is usually nearly bulletproof. Typical headers are: I

Re: new kind of spam with bizarre custom headers getting through

w I'm going to catch those either with a local header rule or a procmail filter. -- View this message in context: http://spamassassin.1065346.n5.nabble.com/new-kind-of-spam-with-bizarre-custom-headers-getting-through-tp111494p111538.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: new kind of spam with bizarre custom headers getting through

On Thu, 4 Sep 2014 11:02:27 -0700 (PDT) George Johnson wrote: > I'm getting another slew of these this morning, all with a variety of > strange headers added apparently to foil spam filtering. All are > getting through my spamassassin set up, which is usually nearly > bulletproof. Typical headers

Re: new kind of spam with bizarre custom headers getting through

Epistle-Main: 3118962.78c35d32dc879cf5ccd83e99e6458854 > Caroled-Jhvh: 78c35d32dc879cf5ccd83e99e6458854 > Alibi-Fete: 15845411584541 > > This seems to be flummoxing SpamAssassin, or at least my setup. -- View this message in context: http://spamassassin.1065346.n5.nabble.c

Re: new kind of spam (apparently from mailer daemon)

On Tue, 27 Apr 2010, John Hardin wrote: On Tue, 27 Apr 2010, Lucio Chiappetti wrote: On Mon, 26 Apr 2010, Joseph Brennan wrote: > > empty and there was a single attachment "transcript.zip". > Very old-school, using pif and scr file extensions and the name with > a lot of spaces in it

Re: new kind of spam (apparently from mailer daemon)

On Tue, 27 Apr 2010, Lucio Chiappetti wrote: On Mon, 26 Apr 2010, Joseph Brennan wrote: > empty and there was a single attachment "transcript.zip". Very old-school, using pif and scr file extensions and the name with a lot of spaces in it (actually more spaces than I show here). After

Re: new kind of spam (apparently from mailer daemon)

On Mon, 26 Apr 2010, Joseph Brennan wrote: empty and there was a single attachment "transcript.zip". Very old-school, using pif and scr file extensions and the name with a lot of spaces in it (actually more spaces than I show here). After posting, I found that a few other passed through, an

Re: new kind of spam (apparently from mailer daemon)

Lucio Chiappetti wrote: The subject was "Delivery reports about your e-mail", the apparent originator was From: "MAILER-DAEMON" , the body was empty and there was a single attachment "transcript.zip". Here, yesterday, 93 of 102 came from hosts in Spamhaus Zen and were rejected for that reas

Re: new kind of spam (apparently from mailer daemon)

On Mon, 26 Apr 2010, Lucio Chiappetti wrote: My question is : is it ok to feed it into the sa-learn crontab we use for spam which escapes spamassassin, or the way it is forged will cause problems (e.g. filtering legitimate mailer daemon reports ?) If that worries you, then train some legitima

Re: new kind of spam (apparently from mailer daemon)

ssassin list" Sent: Monday, April 26, 2010 4:27 PM Subject: new kind of spam (apparently from mailer daemon) I have just found a new kind of spam which went through our spamassassin (actually it got a "banned" notification - we quarantine spam and virus but let banned be delivered

Re: new kind of spam (apparently from mailer daemon)

On Mon, Apr 26, 2010 at 4:27 AM, Lucio Chiappetti wrote: > I have just found a new kind of spam which went through our spamassassin > (actually it got a "banned" notification - we quarantine spam and virus but > let banned be delivered). > > The subject was "Deli

new kind of spam (apparently from mailer daemon)

I have just found a new kind of spam which went through our spamassassin (actually it got a "banned" notification - we quarantine spam and virus but let banned be delivered). The subject was "Delivery reports about your e-mail", the apparent originator was From: "MAIL

Re: New kind of spam part 2

On 01.04.09 09:52, Arthur Kerpician wrote: > I don't know why but these tests are not running on my spamassassin 3.1.0: > RCVD_IN_BL_SPAMCOP_NET > RCVD_IN_XBL Didn't you disable rbl lookups? Can you upgrade to 3.2.5 or at least do you keep rules up-to-date using sa-update? > Yesterday I configure

Re: New kind of spam part 2

Chris wrote: Scored as this on my home box: pts rule name description -- -- 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see

Re: New kind of spam part 2

On Tue, 2009-03-31 at 16:54 -0600, LuKreme wrote: > On 31-Mar-2009, at 16:49, Chris wrote: > > 1.0 BAYES_50 BODY: Bayesian spam probability is 40 to > > 60% > >[score: 0.5000] > > > you score 1.0 for Bayes_50?? > Yes why? Here is how I've been scoring

Re: New kind of spam part 2

On Tue, 2009-03-31 at 16:52 -0600, LuKreme wrote: > On 31-Mar-2009, at 16:49, Chris wrote: > > 5.0 BOTNET Relay might be a spambot or virusbot > > [botnet0.8,ip=145.94.91.39,rdns=z091039.tnw- > > s.tudelft.nl,maildomain=patrimonioediciones.com,client,ipinhostname] > > Is that a cu

Re: New kind of spam part 2

On 31-Mar-2009, at 16:49, Chris wrote: 1.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.5000] you score 1.0 for Bayes_50?? -- I find Windows of absolutely no technical interest... Mac OS X is a rock -solid system that's bea

Re: New kind of spam part 2

On 31-Mar-2009, at 16:49, Chris wrote: 5.0 BOTNET Relay might be a spambot or virusbot [botnet0.8,ip=145.94.91.39,rdns=z091039.tnw- s.tudelft.nl,maildomain=patrimonioediciones.com,client,ipinhostname] Is that a custom rule? -- I find Windows of absolutely no technical interes

Re: New kind of spam part 2

On 31-Mar-2009, at 14:43, Roger Marquis wrote: IME Bayes' DB need to be populated carefully, inspecting every line of every message, decoding or removing base64 text attachments, and removing all bitmaps before running sa-learn. Depending on quantity to make up for quality leaves a big back

Re: New kind of spam part 2

On Tue, 2009-03-31 at 19:43 +0300, Arthur Kerpician wrote: > Hi, > I've been following the latest messages on this list regarding new types > of spam but, unfortunately, couldn't find the answer for the kind i'm > dealing with. The raw mesage can be found here: > http://www.bluechip.ro/spam.txt

Re: New kind of spam part 2

On Tue, 2009-03-31 at 13:43 -0700, Roger Marquis wrote: > Has Bayes ever decoded images? For that you typically need to run the > FuzzyOCR plugin (and edit FuzzyOCR.words for your site). No... That's not what Bayes is, it doesn't read images. > Karsten Bräckelmann wrote: > > Indeed, your Bayes

Re: Ratware Boundary (was: New kind of spam part 2)

On Tue, 2009-03-31 at 14:07 -0600, LuKreme wrote: > On 31-Mar-2009, at 13:22, Karsten Bräckelmann wrote: > > > On Tue, 2009-03-31 at 19:42 +0200, Karsten Bräckelmann wrote: > >> X-Spam-Report: > >>* 0.1 KB_RATWARE_OUTLOOK_16 KB_RATWARE_OUTLOOK_16 > >>* 3.0 KB_RATWARE_BOUNDARY KB_

Re: Ratware Boundary (was: New kind of spam part 2)

On 31-Mar-2009, at 13:22, Karsten Bräckelmann wrote: On Tue, 2009-03-31 at 19:42 +0200, Karsten Bräckelmann wrote: X-Spam-Report: * 0.1 KB_RATWARE_OUTLOOK_16 KB_RATWARE_OUTLOOK_16 * 3.0 KB_RATWARE_BOUNDARY KB_RATWARE_BOUNDARY Since I've been poked off-list already... Hey, I w

Ratware Boundary (was: New kind of spam part 2)

On Tue, 2009-03-31 at 19:42 +0200, Karsten Bräckelmann wrote: > X-Spam-Report: > * 0.1 KB_RATWARE_OUTLOOK_16 KB_RATWARE_OUTLOOK_16 > * 3.0 KB_RATWARE_BOUNDARY KB_RATWARE_BOUNDARY Since I've been poked off-list already... Hey, I was hoping for some more requests, but that was qui

Re: New kind of spam part 2

On 31-Mar-2009, at 10:43, Arthur Kerpician wrote: http://www.bluechip.ro/spam.txt Are you using an RBL? zen would have blocked this. 0.000 0 769852 0 non-token data: nspam 0.000 0 121176 0 non-token data: nham These numbers need to be relativel

Re: New kind of spam part 2

On Tue, 2009-03-31 at 19:43 +0300, Arthur Kerpician wrote: > Hi, > I've been following the latest messages on this list regarding new types > of spam but, unfortunately, couldn't find the answer for the kind i'm > dealing with. The raw mesage can be found here: > http://www.bluechip.ro/spam.txt

RE: New kind of spam part 2

On Tue, 31 Mar 2009, Jason Bertoch wrote: -Original Message- From: Arthur Kerpician [mailto:art...@bluechip.ro] Sent: Tuesday, March 31, 2009 12:43 PM To: users@spamassassin.apache.org Subject: New kind of spam part 2 Hi, I've been following the latest messages on this list rega

RE: New kind of spam part 2

> -Original Message- > From: Arthur Kerpician [mailto:art...@bluechip.ro] > Sent: Tuesday, March 31, 2009 12:43 PM > To: users@spamassassin.apache.org > Subject: New kind of spam part 2 > > Hi, > I've been following the latest messages on this list regard

Re: New kind of spam part 2

On Tue, March 31, 2009 18:43, Arthur Kerpician wrote: > http://www.bluechip.ro/spam.txt autolearn=ham :/ -- http://localhost/ 100% uptime and 100% mirrored :)

Re: New kind of spam part 2

On Tue, 31 Mar 2009, Arthur Kerpician wrote: This type of spam has always 3 parts: plain text, html and a PNG attachment containing viagra & stuff. I tried to figure out for 2 weeks now how to block these messages with no success. Any ideas? Is image spam gaining popularity again? Arthur,

New kind of spam part 2

Hi, I've been following the latest messages on this list regarding new types of spam but, unfortunately, couldn't find the answer for the kind i'm dealing with. The raw mesage can be found here: http://www.bluechip.ro/spam.txt This type of spam has always 3 parts: plain text, html and a PNG at

Re: New kind of spam

From: Arvid Ephraim Picciani Date: Tue, 31 Mar 2009 12:33:49 +0200 > What do you mean "its impossible to train bayes"? i was assuming the random text at the end is what couses my bayes db to behave randomly. Random text that occurs only in spam rapidly becomes a spam si

Re: New kind of spam

On Tue, March 31, 2009 12:33, Arvid Ephraim Picciani wrote: > what exactly is the point of learning > specific messages when the next one will be different anyway. for bayes its still count to learn, not just spam, the more learned tokens, then bayes works better, try get it learn with equal ham/

Re: New kind of spam

What do you mean "its impossible to train bayes"? i was assuming the random text at the end is what couses my bayes db to behave randomly. Bayes really can be trained to deal with this message. For example, I get BAYES_95: well i get 00 After I learn this message the probability increase

Re: New kind of spam

From: Arvid Ephraim Picciani Date: Wed, 25 Mar 2009 16:59:58 +0100 http://codepad.org/W53onqK9 i gave on this kind of spam. its impossible to train bayes and changing to fast to make custom rules. ... What do you mean "its impossible to train bayes"? Bayes really can b

Re: New kind of spam

On Mon, 2009-03-30 at 19:26 +0200, Benny Pedersen wrote: > On Wed, March 25, 2009 17:59, Arvid Ephraim Picciani wrote: > > http://codepad.org/W53onqK9 > > > and changing to fast to make custom rules. > > use rules that catch on non fqdn would be a pointer > I have a rule I wrote a few months ago

Re: New kind of spam

On Wed, March 25, 2009 17:59, Arvid Ephraim Picciani wrote: > http://codepad.org/W53onqK9 listed in ZEN, and helo with non fqdn helo > i gave on this kind of spam. its impossible to train bayes no its not > and changing to fast to make custom rules. use rules that catch on non fqdn would be a

Re: New kind of spam

http://codepad.org/W53onqK9 i gave on this kind of spam. its impossible to train bayes and changing to fast to make custom rules. matching senders doesnt work either becouse those are sent using live.com, gmail, sourceforge, etc

Re: New kind of spam

Jack Raats wrote: Today I received two messages with a kinds of new(?) spam. The messages, html ones, contained the word viagra made by colouring cells in a table. The message also contained a link to a blog (live.com). The rest of the message contained a text to mislead the bayes filtering.

Re: New kind of spam

On Thu, 26 Mar 2009, Kenneth Porter wrote: On Thursday, March 26, 2009 8:10 AM -0700 John Hardin wrote: That too is unusual enough to be a good spam sign. There are also existing rules for high image-to-text ratios. I wonder if tag-to-text ratio is a good spam sign? Another possible adv

Re: New kind of spam

On Thursday, March 26, 2009 8:10 AM -0700 John Hardin wrote: That too is unusual enough to be a good spam sign. There are also existing rules for high image-to-text ratios. I wonder if tag-to-text ratio is a good spam sign? Another possible advantage of having a tag-parsing plugin.

Re: New kind of spam

On Thu, 26 Mar 2009, haman...@t-online.de wrote: John Hardin wrote: If 3.2.x does indeed implement multiline rawbody matches, then we'll be able to have a robust rule for this - e.g. an HTML email with a table that has more than 30 columns and more than 5 rows. That will be difficult to obfu

Re: New kind of spam

On Wed, March 25, 2009 17:03, Arvid Ephraim Picciani wrote: > http://codepad.org/W53onqK9 > > i gave on this kind of spam. its impossible to train bayes and > changing > to fast to make custom rules. matching senders doesnt work either > becouse those are sent using live.com, gmail, sourceforge,

Re: New kind of spam

On Wed, 25 Mar 2009, LuKreme wrote: On 25-Mar-2009, at 19:29, John Hardin wrote: If 3.2.x does indeed implement multiline rawbody matches, then we'll be able to have a robust rule for this - e.g. an HTML email with a table that has more than 30 columns and more than 5 rows. That will be diffic

RE: New kind of spam

haman...@t-online.de wrote: > by the time the detection is ready, you will get the entire message > as ASCII art inside a or individual letters as ascii art, > making up a table with one cell for each letter, or the same pattern > made up of without a table > > In the long run we will render

Re: New kind of spam

John Hardin wrote: > > exactly. they'll just change the html in the next wave. this spam isnt > new, yet the SA list is once again full of threads about exactly that > recent wave, becouse old rules dont match. If 3.2.x does indeed implement multiline rawbody matches, then we'll be able to ha

Re: New kind of spam

On 25-Mar-2009, at 19:29, John Hardin wrote: If 3.2.x does indeed implement multiline rawbody matches, then we'll be able to have a robust rule for this - e.g. an HTML email with a table that has more than 30 columns and more than 5 rows. That will be difficult to obfuscate. More than 30 c

Re: New kind of spam

On Wed, 25 Mar 2009, Arvid Ephraim Picciani wrote: John Hardin wrote: It would be somewhat more robust if SA offered multiline rawbody matching, but try this: thanks for your effords. unfortunatly spammers read this list and they'll adapt too quickly to make any use of custom rules It'

Re: New kind of spam

John Hardin wrote: It would be somewhat more robust if SA offered multiline rawbody matching, but try this: thanks for your effords. unfortunatly spammers read this list and they'll adapt too quickly to make any use of custom rules It's also fairly specific to the HTML in the sample messag

Re: New kind of spam

On 25-Mar-2009, at 10:36, John Hardin wrote: # spaces.live.com URI rule posted to SA list a while ago, good for metas uri URI_SPACES_LIVE /spaces\.live\.com/ score URI_SPACES_LIVE 0.50 describe URI_SPACES_LIVE contains link to spaces.live.com I just searched 500,000 ham messages a

Re: New kind of spam

On Wed, 25 Mar 2009, John Hardin wrote: meta HTML_GRID_OBFU_LIVE (HTML_MESSAGE && URI_SPACES_LIVE && __GRID_OBFU_1 && __GRID_OBFU_2 && __GRID_OBFU_3 && __GRID_OBFU_4) Whoopise! I just remembered "tflags multiple" - this could probably be improved by having the meta require the __GRID_OBF

Re: New kind of spam

On Wed, 25 Mar 2009, Arvid Ephraim Picciani wrote: http://codepad.org/W53onqK9 i gave on this kind of spam. its impossible to train bayes and changing to fast to make custom rules. matching senders doesnt work either becouse those are sent using live.com, gmail, sourceforge, etc It would b

RE: New kind of spam

ender immediately and destroy all copies of it. -Original Message- From: Arvid Ephraim Picciani [mailto:a...@ibcsolutions.de] Sent: 25 March 2009 16:03 To: users@spamassassin.apache.org Subject: Re: New kind of spam http://codepad.org/W53onqK9 i gave on this kind of spam. its impossible to

Re: New kind of spam

http://codepad.org/W53onqK9 i gave on this kind of spam. its impossible to train bayes and changing to fast to make custom rules. matching senders doesnt work either becouse those are sent using live.com, gmail, sourceforge, etc

Re: New kind of spam

On Wed, 25 Mar 2009, Jack Raats wrote: How to stop these messages? By disallowing html messages??? It may be simple to detect the HTML that's setting up the grid. Please post a complete sample to pastebin. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@im

Re: New kind of spam

On Wed, March 25, 2009 06:42, Jack Raats wrote: > Today I received two messages with a kinds of new(?) spam. old spam continue > The messages, html ones, contained the word viagra made by colouring > cells in a table. sorry this is old > The message also contained a link to a blog (live.com).

New kind of spam

Today I received two messages with a kinds of new(?) spam. The messages, html ones, contained the word viagra made by colouring cells in a table. The message also contained a link to a blog (live.com). The rest of the message contained a text to mislead the bayes filtering. How to stop these m

Re: a new kind of spam (with images)

wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor te

Re: a new kind of spam (with images)

From: "Spamassassin List" <[EMAIL PROTECTED]> Spamassassin List wrote: Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has

Re: a new kind of spam (with images)

From: "Spamassassin List" <[EMAIL PROTECTED]> Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token

Re: a new kind of spam (with images)

Spamassassin List wrote: Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing

Re: a new kind of spam (with images)

On Mon, 21 Aug 2006, Spamassassin List wrote: > > Have a look at FuzzyOCR > > http://wiki.apache.org/spamassassin/FuzzyOcrPlugin > > > > Works very well for me - I'm using it in conjuction with ImageInfo and > > since I'm using them those image spams get through VERY rarely > > They will also bl

Re: a new kind of spam (with images)

decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Spamassassin List wrote: Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has

Re: a new kind of spam (with images)

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Spamassassin List wrote: >> Stephane Bentebba wrote: >>> hi all, >>> >>> i am more or less happy with my spamassassin configuration >>> works good for one year >>> but i have problem with a new kind

Re: a new kind of spam (with images)

riginal Message- From: Stephane Bentebba [mailto:[EMAIL PROTECTED] Sent: 21 August 2006 14:32 To: users@spamassassin.apache.org Subject: a new kind of spam (with images) hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kin

Re: a new kind of spam (with images)

Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing the only thing which

Re: a new kind of spam (with images)

Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing the only thing which

Re: a new kind of spam (with images)

ssage- From: Stephane Bentebba [mailto:[EMAIL PROTECTED]] Sent: 21 August 2006 14:32 To: users@spamassassin.apache.org Subject: a new kind of spam (with images) hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam w

RE: a new kind of spam (with images)

Works for me. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Stephane Bentebba [mailto:[EMAIL PROTECTED] > Sent: 21 August 2006 14:32 > To: users@spamassassin.apache.org > Subject: a new kind of spam (with

a new kind of spam (with images)

hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing the only thing which remain the same is the image