You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Paolo Cravero as2594 <pc...@as2594.net> on 2004/06/09 16:26:28 UTC
X-UIDL in headers?
Hi.
I just received a spam of which I copy here a part of headers. It
slipped though a postfix+SA2.62 installation (basic SA with Bayes).
Most of the message text was in a embedded picture, and a lot of CSS.
What surprises me is the presence of X-UIDL header in a SMTP envelope.
Moreover the X-UIDL value is non-numeric! Has anyone blocked this thing?
Any special rule? (I can write my own if there's none around) Any reason
why it is there?!
Then, the MIME text/plain part contains this text:
"Your mailer do not support HTML messages. Switch to a better mailer."
I am not a native English speaker, but I feel the sentence is not
correct and a bit offensive. Is any real email client actually using it?
Or I can write a nice rule to contribute blocking this kind of spam?
Thanks,
Paolo
.......................................
Received: from smtp1.nix.paypal.com (smtp9.nix.paypal.com [219.209.76.17])
by yahoo.com (8.15.10/8.16.10) with ESMTP id i4M1AVjw010001
for <cr...@arpnet.it>; %CURRENT_DATE_TIME
Received: from notify0.nix.paypal.com (notify3.nix.paypal.com
[20.164.84.140])
by smtp2.nix.paypal.com (Postfix) with SMTP id E0B762EF10
for <cr...@arpnet.it>; %CURRENT_DATE_TIME
Received: (qmail 18808 invoked by uid 600); Wed, 09 Jun 2004 05:28:00 +0400
Message-Id: <10...@paypal.com>
X-country: US
X-language: en_US
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_00PZ_03N3399FU_03A.049Y80S0"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
From: "Blaine Carter" <lf...@yahoo.com>
To: Creighton <cr...@arpnet.it>
Subject: Get meds over night - no prescription needed
X-UIDL: fB@"!)+h"!#+""!Y$m!!
Date: Wed, 9 Jun 2004 13:29:03 +0200 (CEST)
X-Spam-Checker-Version: SpamAssassin 2.62 (2004-01-11) on antispam.xyz.it
X-Spam-Status: No, hits=3.1 required=3.5 tests=BAYES_50,FORGED_YAHOO_RCVD,
HTML_FONTCOLOR_UNKNOWN,HTML_MESSAGE,MIME_BOUND_NEXTPART autolearn=no
version=2.62
X-Spam-Level: ***
This is a multi-part message in MIME format.
------=_NextPart_000_00PZ_03N3399FU_03A.049Y80S0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_00GN_04Y3721FY_02P.585P97P0"
------=_NextPart_000_00GN_04Y3721FY_02P.585P97P0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Your mailer do not support HTML messages. Switch to a better mailer.
-----BEGIN PGP SIGNATURE-----
.......................................
--
QRPp-I #707 + www.paolocravero.tk + I QRP #476
Beacon @ 28.3219 MHz + QRPp + QRSS3 + JN35TC
Re: X-UIDL in headers?
Posted by Dimitrios <se...@altered.com>.
On Wed, 09 Jun 2004 16:26:28 +0200 "Paolo Cravero as2594" <pc...@as2594.net> wrote:
> Then, the MIME text/plain part contains this text:
> "Your mailer do not support HTML messages. Switch to a better mailer."
> I am not a native English speaker, but I feel the sentence is not
> correct and a bit offensive. Is any real email client actually using it?
> Or I can write a nice rule to contribute blocking this kind of spam?
I've seen this before in spam (and only spam). Its bad english as well.
I think it would be safe to create a rule for that.
Re: X-UIDL in headers?
Posted by Dimitrios <se...@altered.com>.
On Thu, 10 Jun 2004 23:27:43 +0100 "Nick Leverton" <nj...@leverton.org> wrote:
> They look (if I've got the ones you mean) the same size as the X-UIDL
> added by my ISP's POP3 software (and probably most people's POP3 mail) :
> X-UIDL: ~Zj"!A@$"!7a1!!/\0!!
ooopps better not use the size then :]
Re: X-UIDL in headers?
Posted by Nick Leverton <nj...@leverton.org>.
On Thu, Jun 10, 2004 at 07:38:39AM +0100, Dimitrios wrote:
> On Wed, 9 Jun 2004 22:21:34 -0700 "Robert Menschel" <Ro...@Menschel.net> wrote:
>
> > Sorry to be the bearer of bad news, but your rule hits lots of ham here:
>
> Indeed, the rule is a bit too general, i think it should restrict the length
> of the string first, since almost all the spam ones are the same size
> (you may look at the long list of spam UIDL's i posted).
They look (if I've got the ones you mean) the same size as the X-UIDL
added by my ISP's POP3 software (and probably most people's POP3 mail) :
X-UIDL: ~Zj"!A@$"!7a1!!/\0!!
Nick
Re: X-UIDL in headers?
Posted by Dimitrios <se...@altered.com>.
On Wed, 9 Jun 2004 22:21:34 -0700 "Robert Menschel" <Ro...@Menschel.net> wrote:
> Sorry to be the bearer of bad news, but your rule hits lots of ham here:
Indeed, the rule is a bit too general, i think it should restrict the length
of the string first, since almost all the spam ones are the same size
(you may look at the long list of spam UIDL's i posted).
Re[2]: X-UIDL in headers?
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello David,
Wednesday, June 9, 2004, 11:19:39 AM, you wrote:
DBF> On Wed, 9 Jun 2004, Paolo Cravero as2594 wrote:
>> What surprises me is the presence of X-UIDL header in a SMTP envelope.
>> Moreover the X-UIDL value is non-numeric! Has anyone blocked this thing?
>> Any special rule? (I can write my own if there's none around) Any reason
>> why it is there?!
DBF> I've seen X-UIDL headers used by legimate mail-list sites, but they
DBF> were all long (10-40 character) hexidecimal numbers.
DBF> I've seen a modest amount of spam use those 'garbage' X-UIDL headers
DBF> and created this rule:
DBF> header L_BAD_UIDL X-UIDL =~ /\W\W/
DBF> describe L_BAD_UIDL Bad UIDL header
DBF> score L_BAD_UIDL 2.5
DBF> Havn't seen any FPs from it so far.
Sorry to be the bearer of bad news, but your rule hits lots of ham here:
(First numeric frequencies, followed by percentage frequencies)
OVERALL SPAM HAM S/O SCORE NAME
85107 62393 22714 0.733 0.00 0.00 (all messages)
696 21 675 0.011 0.00 2.50 L_BAD_UIDL
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
85107 62393 22714 0.733 0.00 0.00 (all messages)
100.000 73.3112 26.6888 0.733 0.00 0.00 (all messages as %)
0.818 0.0337 2.9717 0.011 0.00 2.50 L_BAD_UIDL
Sample ham hits:
# L_BAD_UIDL="!!"
# L_BAD_UIDL=""!"
# L_BAD_UIDL="@""
# L_BAD_UIDL=""!"
# L_BAD_UIDL="'#"
# L_BAD_UIDL=""!"
# L_BAD_UIDL="$@"
# L_BAD_UIDL=")!"
# L_BAD_UIDL="\""
# L_BAD_UIDL="#>"
# L_BAD_UIDL="\;"
# L_BAD_UIDL="$!"
# L_BAD_UIDL=""!"
# L_BAD_UIDL="<""
# L_BAD_UIDL="^""
# L_BAD_UIDL=";!"
Bob Menschel
Re: X-UIDL in headers?
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Wed, 9 Jun 2004, Paolo Cravero as2594 wrote:
> Hi.
> I just received a spam of which I copy here a part of headers. It
> slipped though a postfix+SA2.62 installation (basic SA with Bayes).
>
>
> Most of the message text was in a embedded picture, and a lot of CSS.
>
>
> What surprises me is the presence of X-UIDL header in a SMTP envelope.
> Moreover the X-UIDL value is non-numeric! Has anyone blocked this thing?
> Any special rule? (I can write my own if there's none around) Any reason
> why it is there?!
[snip..]
I've seen X-UIDL headers used by legimate mail-list sites, but they
were all long (10-40 character) hexidecimal numbers.
I've seen a modest amount of spam use those 'garbage' X-UIDL headers
and created this rule:
header L_BAD_UIDL X-UIDL =~ /\W\W/
describe L_BAD_UIDL Bad UIDL header
score L_BAD_UIDL 2.5
Havn't seen any FPs from it so far.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: X-UIDL in headers?
Posted by Dimitrios <se...@altered.com>.
On Wed, 09 Jun 2004 16:26:28 +0200 "Paolo Cravero as2594" <pc...@as2594.net> wrote:
> What surprises me is the presence of X-UIDL header in a SMTP envelope.
> Moreover the X-UIDL value is non-numeric! Has anyone blocked this thing?
> Any special rule? (I can write my own if there's none around) Any reason
> why it is there?!
I did a little 'grep' on my database of 17,000 spam emails and i got a
large number of emails with X-UIDL in their header.
The interesting thing is, they are all similar!! Which means they are
all generated with the same spam software.
In addition, all the X-UIDL spam have that stupid message about
"Your mailer do not support..."
Here are some examples:
18477:X-UIDL: fB@"!)+h"!#+""!Y$m!!
18568:X-UIDL: fB@"!)+h"!#+""!Y$m!!
18751:X-UIDL: fB@"!)+h"!#+""!Y$m!!
18801:X-UIDL: fB@"!)+h"!#+""!Y$m!!
19069:X-UIDL: fB@"!)+h"!#+""!Y$m!!
19217:X-UIDL: fB@"!)+h"!#+""!Y$m!!
19229:X-UIDL: fB@"!)+h"!#+""!Y$m!!
1938:X-UIDL: 10293217_192832.222
1994:X-UIDL: 10293217_192832.222
1996:X-UIDL: 10293217_192832.222
2136:X-UIDL: 10293217_192832.222
2222:X-UIDL: 10293217_192832.222
228:tx-UIDL: U0VISEBBTFRFUkVELkNPTQ==
2604:X-UIDL: 77777777888888887777777788888888
2654:X-UIDL: 10293217_192832.222
2804:X-UIDL: 10293217_192832.222
3111:X-UIDL: 10293217_192832.222
3351:X-UIDL: 10293217_192832.222
3355:X-UIDL: 10293217_192832.222
3389:X-UIDL: 10293217_192832.222
3544:X-UIDL: ]B7"!-?A!!I;h"!YHk!!
3545:X-UIDL: K)_"!~1]"!X"%"!38~!!
3546:X-UIDL: @]P"!@_=!!XcO"!"4i!!
3547:X-UIDL: P_M"!'Ab!!Sj""!9)>!!
3548:X-UIDL: hQ_"!Flf"!&Gk"!]>="!
3549:X-UIDL: gEO!!_P\"!OYZ"!I<]!!
3550:X-UIDL: `AY!!(n+!!0MS"!nen"!
3551:X-UIDL: eXp"!?T-"!Mg%#!4@B!!
3552:X-UIDL: [QW!!>Tg!!QIF"!lcc!!
3553:X-UIDL: o9b!!Q:H!!b(m!!E9""!
3554:X-UIDL: oQ>!!a3S!!b&\!!7m^"!
3555:X-UIDL: 1EB!!X$Q"!458"!=?c"!
Re: X-UIDL in headers?
Posted by Fred <sp...@freddyt.com>.
Paolo Cravero as2594 wrote:
> Hi.
> I just received a spam of which I copy here a part of headers. It
> slipped though a postfix+SA2.62 installation (basic SA with Bayes).
>
> What surprises me is the presence of X-UIDL header in a SMTP envelope.
> Moreover the X-UIDL value is non-numeric! Has anyone blocked this
> thing? Any special rule? (I can write my own if there's none around)
> Any reason why it is there?!
Hello,
In the cases where I have seen X-UIDL, it's placed by the receiving server
not the sending server. In my case it's used by my web e-mail system to
identify a mail message with a unique string. It's normally the Message-ID
before the @ sign for me, but I'm sure everyone does things their own way.
I've seen the X-UIDL being funny characters like you show, but I never tried
a rule for it.
Re: X-UIDL in headers?
Posted by Evan Platt <ev...@espphotography.com>.
At 07:26 AM 6/9/2004, you wrote:
>Then, the MIME text/plain part contains this text:
>"Your mailer do not support HTML messages. Switch to a better mailer."
>
>I am not a native English speaker, but I feel the sentence is not correct
>and a bit offensive. Is any real email client actually using it? Or I can
>write a nice rule to contribute blocking this kind of spam?
No, the sentence is is not correct. It SHOULD say "You are smart enough to
disable HTML Please turn it on so my webbig and tracking image will confirm
your e-mail address is valid. And switch to a Microsoft e-mail client while
you're at it too."