Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-19 Thread Daniele Duca
On 18/07/2018 17:08, Rupert Gallagher wrote: OK at a second glance I would say rejected upfront again, because its From domain is NXDOMAIN. I interpreted the From: in the .txt as being a body header, because, as you pointed out, if it was an envelope header then the email should have never

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-18 Thread Rupert Gallagher
OK at a second glance I would say rejected upfront again, because its From domain is NXDOMAIN. On Wed, Jul 18, 2018 at 14:34, Daniele Duca wrote: > On 18/07/2018 14:22, Rupert Gallagher wrote: > >> At first glance I would say rejected upfront, because the client >> 180.252.178.204 does not

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-18 Thread Daniele Duca
On 18/07/2018 14:22, Rupert Gallagher wrote: At first glance I would say rejected upfront, because the client 180.252.178.204 does not have RDNS. No need for SA. I wish I could 5xx last untrusted relays without rdns without having the company's phones melt :) Daniele

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-18 Thread Rupert Gallagher
At first glance I would say rejected upfront, because the client 180.252.178.204 does not have RDNS. No need for SA. On Wed, Jul 18, 2018 at 02:00, Chip M. wrote: > http://puffin.net/software/spam/samples/0058_extortion_numeric_domain.txt

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-18 Thread Pedro David Marco
On Wednesday, July 18, 2018, 6:58:54 AM GMT+2, Bill Cole wrote: >> 3. Pure numeric TLDs appear to be non existent (so far!) >I expect that this will hold true for a long time. Bill, do not speak loud! truth is stranger than fiction  :-( ---PedroD

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread Bill Cole
And in addition... On 17 Jul 2018, at 20:00 (-0400), Chip M. wrote: > 3. Pure numeric TLDs appear to be non existent (so far!) I expect that this will hold true for a long time. -- Bill Cole b...@scconsult.com or billc...@apache.org (AKA @grumpybozo and many *@billmail.scconsult.com

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread Bill Cole
On 17 Jul 2018, at 20:00 (-0400), Chip M. wrote: There's a new morph of the porn extortion campaign, with some interesting under-the-hood changes. The previous ones were always: - two "quoted-printable" parts (plain text, html) - "From" Outlook accounts - sent via Outlook/Hotmail/MS IPs (no

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread John Hardin
On Tue, 17 Jul 2018, John Hardin wrote: On Tue, 18 Jul 2018, Chip M. wrote: Here's the SA test stats for 13 of this new morph: FORGED_MUA_MOZILLA 1 HTML_MESSAGE 13 HTML_MIME_NO_HTML_TAG 13 LOCALPART_IN_SUBJECT 13 MIME_BASE64_TEXT9

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread John Hardin
On Tue, 18 Jul 2018, Chip M. wrote: Here's the SA test stats for 13 of this new morph: FORGED_MUA_MOZILLA 1 HTML_MESSAGE 13 HTML_MIME_NO_HTML_TAG 13 LOCALPART_IN_SUBJECT 13 MIME_BASE64_TEXT9 MIME_HTML_ONLY 13 RCVD_IN_SORBS_DUL

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread John Hardin
On Tue, 18 Jul 2018, Chip M. wrote: Here's the SA test stats for 13 of this new morph: FORGED_MUA_MOZILLA 1 HTML_MESSAGE 13 HTML_MIME_NO_HTML_TAG 13 LOCALPART_IN_SUBJECT 13 MIME_BASE64_TEXT9 MIME_HTML_ONLY 13 RCVD_IN_SORBS_DUL

spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread Chip M.
There's a new morph of the porn extortion campaign, with some interesting under-the-hood changes. The previous ones were always: - two "quoted-printable" parts (plain text, html) - "From" Outlook accounts - sent via Outlook/Hotmail/MS IPs (no other IPs in route) - passed both DKIM and SPF The