Re: "Your mailbox has exceeded..."

2011-09-30 Thread John Hardin
On Fri, 30 Sep 2011, jdow wrote: On 2011/09/30 10:04, John Hardin wrote: On Fri, 30 Sep 2011, Ned Slider wrote: > On 30/09/11 01:41, jida...@jidanni.org wrote: > > Sure a lot of "Your mailbox has exceeded" spam these days. I'll use > > > > body J_MAILBOX_FULL /^Your mailbox has exceeded/

new technique: borked zip attachment w/malware

2011-09-30 Thread Chip M.
There's an interesting new zip attachment obfuscation that uses an encoded EMPTY filename. I've seen barely a trickle, but so far, all have had VERY low SA scores ("1.1" with generally unremarkable test hits). I'm still waiting for permission from the recipient to publish a complete sample. Here'

Re: "Your mailbox has exceeded..."

2011-09-30 Thread John Hardin
On Fri, 30 Sep 2011, Axb wrote: On 2011-09-30 21:17, John Hardin wrote: On Fri, 30 Sep 2011, David F. Skoll wrote: > APER is also fairly useful: > http://code.google.com/p/anti-phishing-email-reply/ > It lists known phishing reply addresses and URLs. (It's reactive, > though, > so like

Re: "Your mailbox has exceeded..."

2011-09-30 Thread jdow
On 2011/09/30 10:04, John Hardin wrote: On Fri, 30 Sep 2011, Ned Slider wrote: On 30/09/11 01:41, jida...@jidanni.org wrote: Sure a lot of "Your mailbox has exceeded" spam these days. I'll use body J_MAILBOX_FULL /^Your mailbox has exceeded/ score J_MAILBOX_FULL ... myself for now. I've se

Re: "Your mailbox has exceeded..."

2011-09-30 Thread Axb
On 2011-09-30 21:17, John Hardin wrote: On Fri, 30 Sep 2011, David F. Skoll wrote: APER is also fairly useful: http://code.google.com/p/anti-phishing-email-reply/ It lists known phishing reply addresses and URLs. (It's reactive, though, so like a virus scanner, it can only protect against threa

Re: "Your mailbox has exceeded..."

2011-09-30 Thread Daniel McDonald
On 9/30/11 2:21 PM, "David F. Skoll" wrote: > On Fri, 30 Sep 2011 12:17:42 -0700 (PDT) > John Hardin wrote: > >> There'd need to be a plugin that would extract from, reply-to, and >> embedded email addresses, plus someone to host a DNS domain for >> checking them. Has anybody already done an

Re: "Your mailbox has exceeded..."

2011-09-30 Thread David F. Skoll
On Fri, 30 Sep 2011 12:17:42 -0700 (PDT) John Hardin wrote: > There'd need to be a plugin that would extract from, reply-to, and > embedded email addresses, plus someone to host a DNS domain for > checking them. Has anybody already done any ADDRBL work? Our (commercial) system has code for this

Re: "Your mailbox has exceeded..."

2011-09-30 Thread John Hardin
On Fri, 30 Sep 2011, David F. Skoll wrote: APER is also fairly useful: http://code.google.com/p/anti-phishing-email-reply/ It lists known phishing reply addresses and URLs. (It's reactive, though, so like a virus scanner, it can only protect against threats someone has already reported.) So i

Re: "Your mailbox has exceeded..."

2011-09-30 Thread Ned Slider
On 30/09/11 18:04, John Hardin wrote: On Fri, 30 Sep 2011, Ned Slider wrote: On 30/09/11 01:41, jida...@jidanni.org wrote: Sure a lot of "Your mailbox has exceeded" spam these days. I'll use body J_MAILBOX_FULL /^Your mailbox has exceeded/ score J_MAILBOX_FULL ... myself for now. I've seen

Re: "Your mailbox has exceeded..."

2011-09-30 Thread John Hardin
On Fri, 30 Sep 2011, Adam Katz wrote: On 30/09/11 01:41, jida...@jidanni.org wrote: Sure a lot of "Your mailbox has exceeded" spam these days. Phish rises this time of year ;-) On 09/30/2011 09:31 AM, Ned Slider wrote: I've seen a few of these, but probably not enough examples to have Bayes

Re: "Your mailbox has exceeded..."

2011-09-30 Thread David F. Skoll
On Fri, 30 Sep 2011 10:07:16 -0700 Adam Katz wrote: > Right, phish thrives on low volume so it can stay under the radar. > Bayes is not good at catching such things. We catch many phishing attempts using Bayes. However, our Bayes corpus is rather large... about 770,000 spam and 909,000 ham mess

Re: "Your mailbox has exceeded..."

2011-09-30 Thread Adam Katz
> On 30/09/11 01:41, jida...@jidanni.org wrote: >> Sure a lot of "Your mailbox has exceeded" spam these days. Phish rises this time of year ;-) On 09/30/2011 09:31 AM, Ned Slider wrote: > I've seen a few of these, but probably not enough examples to have > Bayes reliably catch them yet - the firs

Re: "Your mailbox has exceeded..."

2011-09-30 Thread John Hardin
On Fri, 30 Sep 2011, Ned Slider wrote: On 30/09/11 01:41, jida...@jidanni.org wrote: Sure a lot of "Your mailbox has exceeded" spam these days. I'll use body J_MAILBOX_FULL /^Your mailbox has exceeded/ score J_MAILBOX_FULL ... myself for now. I've seen a few of these, but probably not e

Re: "Your mailbox has exceeded..."

2011-09-30 Thread Ned Slider
On 30/09/11 01:41, jida...@jidanni.org wrote: Sure a lot of "Your mailbox has exceeded" spam these days. I'll use body J_MAILBOX_FULL /^Your mailbox has exceeded/ score J_MAILBOX_FULL ... myself for now. I've seen a few of these, but probably not enough examples to have Bayes reliably catch