Re: Lots of 419/scam and investment spams getting through suddenly

[SM <sm...@resistor.net>]

At 22:59 18-06-2009, Chip M. wrote:
>Here's a dump of the complete Countries routes of your samples
>(frequency first, then square brackets around the IP immediately
>outside your own network):
>  2 [France], Nigeria

Do you really get such emails from Nigeria? :-)

Regards,
-sm 

Re: Lots of 419/scam and investment spams getting through suddenly

[SM <sm...@resistor.net>]

At 17:26 19-06-2009, RW wrote:
>The last hop into the internal network is rarely from Nigeria, but I
>find it turns up in X-Spam-Relay-Countries in about 9% of my own spam.

Can you send me a sample of the email headers off-list?

Regards,
-sm 

Re: Lots of 419/scam and investment spams getting through suddenly

[RW <rw...@googlemail.com>]

On Fri, 19 Jun 2009 16:30:29 -0700
SM <sm...@resistor.net> wrote:

> At 15:36 19-06-2009, McDonald, Dan wrote:
> >Of course.  Don't you?  Although usually the Nigerians relay through
> >Italy, and sometimes Hong Kong.
> 
> I don't see any email of that type originating from Nigeria in terms 
> of SMTP.  Most of these emails originate from other 
> countries.  Blocking Italy or Hong Kong won't help that much because 
> of the mode of operation of these senders.

The last hop into the internal network is rarely from Nigeria, but I
find it turns up in X-Spam-Relay-Countries in about 9% of my own spam.

Re: Lots of 419/scam and investment spams getting through suddenly

[SM <sm...@resistor.net>]

At 15:36 19-06-2009, McDonald, Dan wrote:
>Of course.  Don't you?  Although usually the Nigerians relay through
>Italy, and sometimes Hong Kong.

I don't see any email of that type originating from Nigeria in terms 
of SMTP.  Most of these emails originate from other 
countries.  Blocking Italy or Hong Kong won't help that much because 
of the mode of operation of these senders.

One of the advantages of SpamAssassin is that it doesn't use one 
specific rule to detect spam.  If you rely on one specific rule only, 
it will be subverted.

Regards,
-sm 

Re: Lots of 419/scam and investment spams getting through suddenly

["McDonald, Dan" <Da...@austinenergy.com>]

On Fri, 2009-06-19 at 15:12 -0700, SM wrote:
> At 22:59 18-06-2009, Chip M. wrote:
> >Here's a dump of the complete Countries routes of your samples
> >(frequency first, then square brackets around the IP immediately
> >outside your own network):
> >  2 [France], Nigeria
> 
> Do you really get such emails from Nigeria? :-)

Of course.  Don't you?  Although usually the Nigerians relay through
Italy, and sometimes Hong Kong.

-- 
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com