David F. Skoll wrote > On Thu, 4 Sep 2014 11:02:27 -0700 (PDT) > George Johnson <
> georgejohnson@ > > wrote: > >> I'm getting another slew of these this morning, all with a variety of >> strange headers added apparently to foil spam filtering. All are >> getting through my spamassassin set up, which is usually nearly >> bulletproof. Typical headers are: > >> Imbrue-Gaol: 17169949.17169949 >> Manila-Cairn: 12616748.12616748 >> Atonic-Alate: 78c35d32dc879cf5ccd83e99e6458854 >> Fungus-Onus: 1716994978c35d32dc879cf5ccd83e99e6458854 >> Ernest-Phlox: 953-17169949 > > Yeah, we see tons and tons of them - about 1500 so far today with the > subject "Re: Your background may have been searched by your employer." > On our cluster, Bayes is catching them handily. About the only > SpamAssassin > rule that fires is RDNS_NONE, and most of them are passing SPF. > > Ours all come from " > shane.icmalerts@ > ". Are > yours coming from a limited set of senders? Blacklisting those > senders or domains might do the trick... > > Regards, > > David. Thanks very much. I'm getting those and similar ones from more than a dozen senders. One thing they all have in common is the same long alphanumerical string, beginning with "78c35d32dc", in one of the weird header fields. For now I'm going to catch those either with a local header rule or a procmail filter. -- View this message in context: http://spamassassin.1065346.n5.nabble.com/new-kind-of-spam-with-bizarre-custom-headers-getting-through-tp111494p111538.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
