From Ted.Harding@nessie.mcc.ac.uk Tue Apr 1 14:15:57 2003 From: Ted.Harding@nessie.mcc.ac.uk To: main@lists.alug.org.uk Subject: [Alug] Busting the Spam Buster ... Date: Tue, 01 Apr 2003 14:16:02 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6929827898975446062==" --===============6929827898975446062== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Got yet another of those performance-enhancer spams. The HTML has been confusingly fragmented (see below) no doubt to evade filters which search for keywords ... Ted. EXCERPT: ======================================================= From: Agnes McMullin Subject: Greetings SIZE AND STAMINA DO MATTER
More Than You Can Possibly Imagine!!
She is just trying to spare your feelings by telling you otherwise.

DON'T WAIT UNTIL SHE IS GONE
TO FIND OUT THAT YOU COULDN'T SATISFY HER!!!

INTRODUCING, THE FIRST ALL-IN-ONE
Male Performance Enhancer AND Penis Enlargement
[etc.] ========================================================= -------------------------------------------------------------------- E-Mail: (Ted Harding) Fax-to-email: +44 (0)870 167 1972 Date: 01-Apr-03 Time: 13:16:09 ------------------------------ XFMail ------------------------------ --===============6929827898975446062==-- From Keith.Watson@Kewill.com Tue Apr 1 15:47:21 2003 From: Keith Watson To: main@lists.alug.org.uk Subject: RE: [Alug] Busting the Spam Buster ... Date: Tue, 01 Apr 2003 15:48:02 +0000 Message-ID: <001901c2f85d$e1f545f0$79cca8c0@kst068nt4> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1546254839795576636==" --===============1546254839795576636== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit > From: Ted Harding; > > Got yet another of those performance-enhancer spams. > The HTML has been confusingly fragmented (see below) > no doubt to evade filters which search for keywords ... > > Ted. > > EXCERPT: > ======================================================= > From: Agnes McMullin > Subject: Greetings > > >
> SIZE AND STAMINA > DO MATTER
> More Than You Can Possibly > Imagine!!
> She is just trying to > spare your > feelings > by telling you > otherwise.
>
> DON'T WAIT UNTIL > SHE IS GONE
TO FIND OUT THAT YOU COULDN'T > SATISFY HER!!! >
>
> INTRODUCING, THE > FIRST ALL-IN-ONE
> Male Performance > Enhancer AND > Penis > Enlargement
> [etc.] > ========================================================= > > -------------------------------------------------------------------- > E-Mail: (Ted Harding) > Fax-to-email: +44 (0)870 167 1972 > Date: 01-Apr-03 Time: 13:16:09 > ------------------------------ XFMail ------------------------------ > That's all very well, but is what they're selling any good!!?? :o) --===============1546254839795576636==-- From Ted.Harding@nessie.mcc.ac.uk Tue Apr 1 16:17:47 2003 From: Ted.Harding@nessie.mcc.ac.uk To: main@lists.alug.org.uk Subject: RE: [linux-users] RE: [Alug] Busting the Spam Buster ... Date: Tue, 01 Apr 2003 16:18:09 +0000 Message-ID: In-Reply-To: <001901c2f85d$e1f545f0$79cca8c0@kst068nt4> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5561606629917744476==" --===============5561606629917744476== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit On 01-Apr-03 Keith Watson wrote: >> Got yet another of those performance-enhancer spams. >> The HTML has been confusingly fragmented (see below) >> no doubt to evade filters which search for keywords ... >> >> EXCERPT: >> ======================================================= >> >> >
>> SIZE AND STAMINA >> DO MATTER
>> More Than You Can Possibly >> Imagine!!
>> [etc.] >> ========================================================= > > That's all very well, but is what they're selling any good!!?? >:o) Interruptus at best, by the look of it ... Ted. -------------------------------------------------------------------- E-Mail: (Ted Harding) Fax-to-email: +44 (0)870 167 1972 Date: 01-Apr-03 Time: 16:03:01 ------------------------------ XFMail ------------------------------ --===============5561606629917744476==-- From tmh@magenta-netlogic.com Tue Apr 1 16:18:09 2003 From: Tony Hoyle To: main@lists.alug.org.uk Subject: [Alug] Re: [linux-users] Busting the Spam Buster ... Date: Tue, 01 Apr 2003 16:32:02 +0000 Message-ID: <3E89AD7F.5050507@magenta-netlogic.com> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8969948830329399338==" --===============8969948830329399338== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit (Ted Harding) wrote: > Got yet another of those performance-enhancer spams. > The HTML has been confusingly fragmented (see below) > no doubt to evade filters which search for keywords ... > > >
> SIZE AND STAMINA > DO MATTER
SA makes short work of it, though... X-Spam-Status: No, hits=3.4 tagged_above=-10000.0 required=5.0 tests=HTML_30_40, PENIS_ENLARGE2, UPPERCASE_25_50 Anything like an open relay or forged header would have pushed it over the edge into spam oblivion. Tony -- "When I am working on a problem I never think about beauty. I only think about how to solve the problem. But when I have finished, if the solution is not beautiful, I know it is wrong." -- Buckminster Fuller --===============8969948830329399338==-- From id@nooped.com Tue Apr 1 16:33:42 2003 From: iD To: main@lists.alug.org.uk Subject: Re: [Alug] Busting the Spam Buster ... Date: Tue, 01 Apr 2003 16:34:01 +0000 Message-ID: <20030401153342.GA17447@nooped.com> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4173464627549265864==" --===============4173464627549265864== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit On Tue, Apr 01, 2003 at 01:16:09PM -0000, Ted Harding wrote: > Got yet another of those performance-enhancer spams. > The HTML has been confusingly fragmented (see below) > no doubt to evade filters which search for keywords ... Looks like a growing trend, every piece of spam I've received this week has had 'mangled' HTML, full of random junk comment tags. :) -- iD, id(a)nooped.com ~~~~~~~~~~~~~~~~~~ Overload -- core meltdown sequence initiated. --===============4173464627549265864==-- From laurie@brownowl.com Tue Apr 1 17:05:09 2003 From: Laurie Brown To: main@lists.alug.org.uk Subject: Re: [Alug] Re: [linux-users] Busting the Spam Buster ... Date: Tue, 01 Apr 2003 17:06:01 +0000 Message-ID: <3E89B909.5070605@brownowl.com> In-Reply-To: <3E89AD7F.5050507@magenta-netlogic.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0251784633231298078==" --===============0251784633231298078== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Tony Hoyle wrote: > (Ted Harding) wrote: >=20 >> Got yet another of those performance-enhancer spams. >> The HTML has been confusingly fragmented (see below) >> no doubt to evade filters which search for keywords ... >> >> >> >
>> SIZE AND STAMINA >> DO MATTER
>=20 >=20 > SA makes short work of it, though... >=20 > X-Spam-Status: No, hits=3D3.4 tagged_above=3D-10000.0 required=3D5.0 > tests=3DHTML_30_40, PENIS_ENLARGE2, UPPERCASE_25_50 >=20 > Anything like an open relay or forged header would have pushed it over=20 > the edge into spam oblivion. I'm running SA with amavisd, the latest versions, and I must say, it seems a = lot less effective than it was, and a lot less flexible... Maybe I need to=20 spend more time customising, but I'm getting a lot of spam breaking through, = and can't find a way to create user-specific white/black-lists/filters any mo= re. I came back from the rugby this weekend to over 500 detected spams... Cheers, Laurie. --=20 -------------------------------------------------------------------- Laurie Brown laurie(a)brownowl.com -------------------------------------------------------------------- --===============0251784633231298078==--