You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Andersen <js...@pen.homeip.net> on 2007/08/07 11:18:12 UTC
Number spam
Ok, what is this stuff.
All it contains is 6 digit numbers. What's up with that stuff?
--
_____________________________________
John Andersen
Re: Number spam
Posted by SM <sm...@resistor.net>.
At 02:18 07-08-2007, John Andersen wrote:
>All it contains is 6 digit numbers. What's up with that stuff?
Address verification.
Test for missing message-id and "QUALCOMM Windows Eudora Version
7.1.0.9" as the X-Mailer.
Regards,
-sm
Re: Number spam (grey listing)
Posted by Dave Mifsud <da...@um.edu.mt>.
On 07/08/07 11:18, John Andersen wrote:
> Ok, what is this stuff.
> All it contains is 6 digit numbers. What's up with that stuff?
>
my guess is: just to break grey listing...
seems the real stuff was a mailshot of "ecards" a few hours later
dave
--
Dave Mifsud
Systems Engineer
Computing Services Centre
University of Malta
CSC Tel: (+356) 2340 3004 CSC Fax: (+356) 21 343 397
Re: Number spam
Posted by Chaitu <cc...@corp.untd.com>.
I agree......Is there any other reason U can see?
--
Chaitu
"Linux means productivity and fun. NT means 'Not Today'."
On Tue, 2007-08-07 at 13:46 +0300, Henrik Krohns wrote:
> On Tue, Aug 07, 2007 at 04:13:03PM +0530, Chaitu wrote:
> > Bayesian Poisoning......
>
> ...is a myth.
Re: Number spam
Posted by Henrik Krohns <he...@hege.li>.
On Mon, Aug 13, 2007 at 03:49:38PM +0200, Matus UHLAR - fantomas wrote:
> > On Tue, Aug 07, 2007 at 04:13:03PM +0530, Chaitu wrote:
> > > Bayesian Poisoning......
>
> On 07.08.07 13:46, Henrik Krohns wrote:
> > ...is a myth.
>
> do spammers care if it's a myth?
why should we care if they care? it's their time to waste. my bayes works
just fine.
Re: Number spam
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> On Tue, Aug 07, 2007 at 04:13:03PM +0530, Chaitu wrote:
> > Bayesian Poisoning......
On 07.08.07 13:46, Henrik Krohns wrote:
> ...is a myth.
do spammers care if it's a myth?
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux IS user friendly, it's just selective who its friends are...
Re: Number spam
Posted by Henrik Krohns <he...@hege.li>.
On Tue, Aug 07, 2007 at 04:13:03PM +0530, Chaitu wrote:
> Bayesian Poisoning......
...is a myth.
Re: Number spam
Posted by Chaitu <cc...@corp.untd.com>.
Bayesian Poisoning......
Chaitu
"The Heart of the Cosmos is DUALITY...A balance of Antitheses, the cycle
of Life and Death."
On Tue, 2007-08-07 at 01:18 -0800, John Andersen wrote:
> Ok, what is this stuff.
> All it contains is 6 digit numbers. What's up with that stuff?
Re: Number spam (paranoid guess)
Posted by Yet Another Ninja <sa...@alexb.ch>.
On 8/7/2007 4:34 PM, Henrik Krohns wrote:
> On Tue, Aug 07, 2007 at 02:52:25PM +0100, UxBoD wrote:
>> This appears to work okay :-
>>
>> header __LOCAL_PROBE1 subject =~ /[0-9]{4,6}/i
>> body __LOCAL_PROBE2 /([a-z|0-9]{8})/i
>> describe LOCAL_PROBE1 Daft Number Probe
>> meta LOCAL_PROBE1 (__LOCAL_PROBE1 + __LOCAL_PROBE2 > 1)
>> score LOCAL_PROBE1 3
>
> Looks like nice FP generator for busy sites. PROBE2 is certain to hit almost
> anything and then just wait for a few digits in subject.. :)
>
header __LOCAL_PROBE1 Subject =~ /^\d{4,6}$/
body __LOCAL_PROBE2 /^[a-f0-9]{8}$/i
meta LOCAL_PROBE (__LOCAL_PROBE1 && __LOCAL_PROBE2)
score LOCAL_PROBE 3.0
should be safer
Re: Number spam (paranoid guess)
Posted by UxBoD <ux...@splatnix.net>.
Yes I know :( has been pointed out to me so has been revised :-
header __LOCAL_DIG1 subject =~ /^\d[0-9]{4,6}$/
body __LOCAL_DIG2 /^([a-f|0-9]{8})$/i
describe LOCAL_DIG1 Daft Number Scam
meta LOCAL_DIG1 __LOCAL_DIG1 && __LOCAL_DIG2
score LOCAL_DIG1 3
Regards,
--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod@sip.splatnix.net
----- Original Message -----
From: "Henrik Krohns" <he...@hege.li>
To: users@spamassassin.apache.org
Sent: Tuesday, August 7, 2007 3:34:49 PM (GMT) Europe/London
Subject: Re: Number spam (paranoid guess)
On Tue, Aug 07, 2007 at 02:52:25PM +0100, UxBoD wrote:
> This appears to work okay :-
>
> header __LOCAL_PROBE1 subject =~ /[0-9]{4,6}/i
> body __LOCAL_PROBE2 /([a-z|0-9]{8})/i
> describe LOCAL_PROBE1 Daft Number Probe
> meta LOCAL_PROBE1 (__LOCAL_PROBE1 + __LOCAL_PROBE2 > 1)
> score LOCAL_PROBE1 3
Looks like nice FP generator for busy sites. PROBE2 is certain to hit almost
anything and then just wait for a few digits in subject.. :)
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
Re: Number spam (paranoid guess)
Posted by Henrik Krohns <he...@hege.li>.
On Tue, Aug 07, 2007 at 02:52:25PM +0100, UxBoD wrote:
> This appears to work okay :-
>
> header __LOCAL_PROBE1 subject =~ /[0-9]{4,6}/i
> body __LOCAL_PROBE2 /([a-z|0-9]{8})/i
> describe LOCAL_PROBE1 Daft Number Probe
> meta LOCAL_PROBE1 (__LOCAL_PROBE1 + __LOCAL_PROBE2 > 1)
> score LOCAL_PROBE1 3
Looks like nice FP generator for busy sites. PROBE2 is certain to hit almost
anything and then just wait for a few digits in subject.. :)
Re: Number spam (paranoid guess)
Posted by UxBoD <ux...@splatnix.net>.
This appears to work okay :-
header __LOCAL_PROBE1 subject =~ /[0-9]{4,6}/i
body __LOCAL_PROBE2 /([a-z|0-9]{8})/i
describe LOCAL_PROBE1 Daft Number Probe
meta LOCAL_PROBE1 (__LOCAL_PROBE1 + __LOCAL_PROBE2 > 1)
score LOCAL_PROBE1 3
Regards,
--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod@sip.splatnix.net
----- Original Message -----
From: "Greg Skouby" <gs...@sitesnow.com>
To: users@spamassassin.apache.org
Sent: Tuesday, August 7, 2007 2:14:44 PM (GMT) Europe/London
Subject: Re: Number spam (paranoid guess)
On Tue, Aug 07, 2007 at 12:14:31PM +0200, Chr. v. Stuckrad wrote:
>
> My most paranoid guess is:
>
> - Cause: we have summer vacation time ...
>
> So LOTS of people are on holidays.
> If you use E-Mails with totally useless content which goes
> through all filters for a short time, you can trigger LOTS
> of vacation-Messages!
>
Wouldn't that require the "from" info not being forged? I have gotten a couple of these and they are definately of the forged sender variety.
--Greg
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
Re: Number spam (paranoid guess)
Posted by Greg Skouby <gs...@sitesnow.com>.
On Tue, Aug 07, 2007 at 12:14:31PM +0200, Chr. v. Stuckrad wrote:
>
> My most paranoid guess is:
>
> - Cause: we have summer vacation time ...
>
> So LOTS of people are on holidays.
> If you use E-Mails with totally useless content which goes
> through all filters for a short time, you can trigger LOTS
> of vacation-Messages!
>
Wouldn't that require the "from" info not being forged? I have gotten a couple of these and they are definately of the forged sender variety.
--Greg
Re: Number spam (paranoid guess)
Posted by "Chr. v. Stuckrad" <st...@mi.fu-berlin.de>.
On Tue, 07 Aug 2007, John Andersen wrote:
> Ok, what is this stuff.
> All it contains is 6 digit numbers. What's up with that stuff?
My most paranoid guess is:
- Cause: we have summer vacation time ...
So LOTS of people are on holidays.
If you use E-Mails with totally useless content which goes
through all filters for a short time, you can trigger LOTS
of vacation-Messages!
Then (1) you will have to know, 'who answered' and if you
ar not only a a spammer, but also a 'more criminal mind',
you (2) might even find the typical vacation messages like
"I'm away to china for two weeks, try later ..."!
So you know somebody is *away* and you can safely steal
from the flat, impersonate the owner of the addresse etc...
That's paranoid, I know, but criminals are not always dumb :-)
And lazy anyway, and on the internet too :-)
Stucki (who never has vacation [messages:-])