Re: Obfuscating advanced fee scams with html attachements?

2011-03-28 Thread Ned Slider
On 28/03/11 23:44, Daniel McDonald wrote: I just got a spam that scored relatively low (mostly due to DNSWL_MED). But it also contained an html attachment that would have scored significantly more had it been part of the main message. I put it at http://pastebin.com/vXF0vGVS When I run the com

Re: Obfuscating advanced fee scams with html attachements?

2011-03-28 Thread darxus
On 03/28, Daniel McDonald wrote: >I just got a spam that scored relatively low (mostly due to DNSWL_MED). Was that because you don't have trusted_networks properly configured? What was the IP address that got looked up in DNSWL? >I put it at [1]http://pastebin.com/vXF0vGVS Was it 216.82

Re: Obfuscating advanced fee scams with html attachements?

2011-03-28 Thread John Hardin
On Mon, 28 Mar 2011, David B Funk wrote: A while back I tried creating some rules that explicitly looked for messages with that perverted mime labeling but they FP'ed all over the place as there are multiple ham sources that make the same faux-pas. There are several subrules in that vein in m

Re: Obfuscating advanced fee scams with html attachements?

2011-03-28 Thread David B Funk
On Mon, 28 Mar 2011, Daniel McDonald wrote: I just got a spam that scored relatively low (mostly due to DNSWL_MED). But it also contained an html attachment that would have scored significantly more had it been part of the main message. I put it at http://pastebin.com/vXF0vGVS When I run the

Obfuscating advanced fee scams with html attachements?

2011-03-28 Thread Daniel McDonald
I just got a spam that scored relatively low (mostly due to DNSWL_MED). But it also contained an html attachment that would have scored significantly more had it been part of the main message. I put it at http://pastebin.com/vXF0vGVS When I run the complete message, I only get a few hits, mostly

Re: fake URL's in mail

2011-03-28 Thread Adam Katz
On 03/25/2011 04:59 AM, Matus UHLAR - fantomas wrote: > Are there REALLY that MANY massmailers that can not post > valid URL's? Something is rotten in the state od Denmark... Yes. Here is an example of ham in this category (obfuscated from an opt-in newsletter I received a few days ago): > .. yo