I'm getting another slew of these this morning, all with a variety of strange
headers added apparently to foil spam filtering. All are getting through my
spamassassin set up, which is usually nearly bulletproof. Typical headers
are:
Imbrue-Gaol: 17169949.17169949
Manila-Cairn: 12616748.12616748
Atonic-Alate: 78c35d32dc879cf5ccd83e99e6458854
Fungus-Onus: 1716994978c35d32dc879cf5ccd83e99e6458854
Ernest-Phlox: 953-17169949
I have Bayes, Uribl-black, Spamcop, Pyzor, Razor, etc., enabled. Here is
one of the headers with my addresses redacted:
From: Shane Murphy <shane.icmale...@backgroundchecktruth.club>
Subject: Re: Your background may have been searched by your
employer.
Date: September 4, 2014 11:13:35 AM MDT
To: George Johnson <>
Return-Path: <shane.icmale...@backgroundchecktruth.club>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
sanacacio.net
X-Spam-Level: **
X-Spam-Status: No, score=2.2 required=4.3 tests=BAYES_20,
RCVD_IN_BRBL_LASTEXT, RDNS_NONE,SPF_HELO_PASS,SPF_PASS autolearn=no
version=3.3.1
X-Spam-Asn: AS6939 64.187.96.0/19
X-Original-To:
Delivered-To:
Received: from backgroundchecktruth.club (unknown
[64.187.117.226]) by
sanacacio.net (Postfix) with ESMTP id 2F3EE62E5CB0 for
<georgejohn...@talaya.net>; Thu, 4 Sep 2014 11:15:21 -0600 (MDT)
Imbrue-Gaol: 17169949.17169949
Manila-Cairn: 12616748.12616748
Mime-Version: 1.0
Atonic-Alate: 78c35d32dc879cf5ccd83e99e6458854
Fungus-Onus: 1716994978c35d32dc879cf5ccd83e99e6458854
Ernest-Phlox: 953-17169949
Message-Id:
<0.12616748-78c35d32dc879cf5ccd83e99e6458854-17169949...@backgroundchecktruth.club>
Content-Type: text/plain
Is anyone else seeing these get through? Any advice would be appreciated.
George Johnson wrote
> This morning a flood of spam started getting through my SpamAssassin
> filter. What the emails all have in common are bizarre headers like these:
>
> Brazil-Ichth: 8337271
> Mime-Version: 1.0
> Bayley-Smith: 5083158-78c35d32dc879cf5ccd83e99e6458854
> Content-Type: text/plain
> Donica-Mis: 5083158.8337271
> Message-Id:
> <0.0.5083158508315878c35d32dc879cf5ccd83e99e645885...@lowhomewarrantychoice.club>
>
> Piolet-Seral: 5083158.10
> Roarer-Royce: 8337271
>
> and these:
>
> Inkless-Retro: 3118962
> Content-Type: text/plain
> Featly-Unbd: 78c35d32dc879cf5ccd83e99e64588543118962
> Expose-Taft: 3118962.1584541
> Epistle-Main: 3118962.78c35d32dc879cf5ccd83e99e6458854
> Caroled-Jhvh: 78c35d32dc879cf5ccd83e99e6458854
> Alibi-Fete: 15845411584541
>
> This seems to be flummoxing SpamAssassin, or at least my setup.
--
View this message in context:
http://spamassassin.1065346.n5.nabble.com/new-kind-of-spam-with-bizarre-custom-headers-getting-through-tp111494p111533.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
