Another thing to consider.... Most spammers are lazy and they don't try to "beat" the system. The reason for this is that only a very small percentage of mail servers use effective filtering tools.
However, if you wanted to beat the system, it is not that difficult. For starters, the spammer needs to come from a friendly place. That's easy, they purchase some dedicated hosting for $99 a month where they have control over their own Linux box. This Linux box is 100% legit coming from a friendly place (IP that is not blacklisted). Now they inject their mail into Sendmail or something and don't forge anything, they use a real domain that they recently purchased ($15/year). They don't use HTML, just send a regular text email, pushing their product or ad. To beat the dcc checks, they make the email body cycle or change, so everybody doesn't get the same spam email. Last but not least, they peruse the SpamAssassin scores, and make sure not to obviously use bad phrases, and try to do things which help them. If you do all that... then your mail will make it through a filter. The catch here is that doing the above is time consuming and limits the spammers ability to send a large amount of email quickly. Just like how sending messages >100Kb is too much overhead for a spammer to bear. John -----Original Message----- From: Test, James [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 09, 2003 12:13 PM To: [EMAIL PROTECTED] Subject: RE: [SAtalk] Missed Spam samples I've seen this too. My guess is the spammers screw something up (forgot to paste the body of the email, etc). It doesn't seem beneficial for them to send something on purpose with no link or ad. -----Original Message----- From: David Watson [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 09, 2003 10:36 AM To: [EMAIL PROTECTED] Subject: [SAtalk] Missed Spam samples My site has been receiving some odd spam with little to no content, increasing amounts over the last fortnight (2 shown below). Is this something other people are seeing? Return-path: <[EMAIL PROTECTED]> Delivery-date: Wed, 09 Jul 2003 15:15:09 +0100 Received: from machiavelli.team17.com ([192.168.0.200]) by hell.team17.com. with esmtp (Exim 4.20) id 19aFiu-0002nK-Cz for [EMAIL PROTECTED]; Wed, 09 Jul 2003 15:15:08 +0100 Received: from 213.237.76.86.adsl.ryv.worldonline.dk ([213.237.76.86] helo=polbox.com) by machiavelli.team17.com with esmtp (Exim 4.20) id 19aFip-00059A-KJ for [EMAIL PROTECTED]; Wed, 09 Jul 2003 15:15:08 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Melva R. James" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: hey Date: Wed, 09 Jul 2003 14:19:11 +0000 MIME-Version: 1.0 User-Agent: Mozilla/5.024 (Windows; I; Windows NT 5.0; U; NT4.0; en-us) Gecko/25250101 X-Accept-Language: en Content-Type: text/html Content-Transfer-Encoding: 8bit X-Spam-Score: 0.0 (/) X-Spam-Report: 0.0/4.0 ---- Start SpamAssassin results 0.00 points, 4 required; * 0.0 -- User-Agent header indicates a non-spam MUA (Mozilla) * -0.1 -- Has a X-Accept-Language header * 0.1 -- Message only has text/html MIME parts ---- End of SpamAssassin results Status: Return-path: <[EMAIL PROTECTED]> Delivery-date: Wed, 09 Jul 2003 15:25:52 +0100 Received: from machiavelli.team17.com ([192.168.0.200]) by hell.team17.com. with esmtp (Exim 4.20) id 19aFtH-0002yM-Ex for [EMAIL PROTECTED]; Wed, 09 Jul 2003 15:25:51 +0100 Received: from [221.151.52.206] (helo=nisusa.net) by machiavelli.team17.com with esmtp (Exim 4.20) id 19aFtG-0005b3-J8 for [EMAIL PROTECTED]; Wed, 09 Jul 2003 15:25:51 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Zelma Hartley" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Lets work this out Date: Wed, 09 Jul 2003 14:27:08 +0000 MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit X-Spam-Score: 0.1 (/) X-Spam-Report: 0.1/4.0 ---- Start SpamAssassin results 0.10 points, 4 required; * 0.1 -- Message only has text/html MIME parts ---- End of SpamAssassin results Status: O ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
