[Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and

2006-06-28 Thread Marc Catuogno








Is this Broken spamware? Ive
gotten a few of these over the past few days.











From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED] 
Sent: Wednesday, June 28, 2006
4:33 AM
To: [EMAIL PROTECTED]
Subject: [SPAM]I must apologize
for this unsolicited nature of my email. I am Mr. Lewis Musasike, General
Manager (Treasury) of Development Bank of Southern Africa.
This is an urgent and very confidential business proposition. On June 6, 2001,a
Foreign Oil consult








 
  
  I have a new email address!
  
 




You can now email me at: [EMAIL PROTECTED]



- LEWIS MUSASIKE











---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.


Re: [Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent

2006-06-28 Thread Matt




It's just an idiot trying to spam.

They are using new E-mail address announcement apps to push their
messages out, and this guy seems to just be pasting all of his content
into the subject. He could be using a program that exploits multiple
sites, and this one may not provide for adding content to the body, or
they may have redesigned their app to only allow subject customization
after finding that they were exploited, and some automatic form filling
software may be inadvertently adding this to the Subject line instead
now.

If you want to filter for this, I would filter for the body text, "I
have a new email address!" and match that to the source IP, and that
will effectively block all such announcements from btinternet.com. I
would imagine that there is very little chance of ever blocking a
legitimate announcement from them going to your server.

This shouldn't be a long-standing pattern since it clearly is totally
ineffective.

Matt





Marc Catuogno wrote:

  
  


  
  
  Is this
Broken spamware? Ive
gotten a few of these over the past few days.
  
  
  
  
  From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED]] 
  Sent: Wednesday, June
28, 2006
4:33 AM
  To:
[EMAIL PROTECTED]
  Subject: [SPAM]I must
apologize
for this unsolicited nature of my email. I am Mr. Lewis Musasike,
General
Manager (Treasury) of Development Bank of Southern
Africa.
This is an urgent and very confidential business proposition. On June
6, 2001,a
Foreign Oil consult
  
  
  
  

  

I have a new email address!

  

  
  
  You can
now email me at: [EMAIL PROTECTED]
  
  
  
- LEWIS MUSASIKE
  
  
  
  
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.




---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.

[Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and

2006-06-22 Thread Marc Catuogno








Is this from broken spamware? The whole pitch
is in the subject What a pain to filter.











From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 22, 2006 3:03
PM
To:
[EMAIL PROTECTED]
Subject: [SPAM]I must apologize
for this unsolicited nature of my email. I am Mr. Lewis Musasike, General
Manager (Treasury) of Development Bank of Southern Africa.
This is an urgent and very confidential business proposition. On June 6, 2001,a
Foreign Oil consult








 
  
  I have a new email address!
  
 




You can now email me at: [EMAIL PROTECTED]



- LEWIS MUSASIKE











---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.


Re: [Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent

2006-06-22 Thread Matt




Just some Advance Fee Fraud (Nigerian) stuff from some guy that either
is new to his software, or just made a mistake. I'm guessing the
latter, and due to a clumsy cut and paste. There is no need to filter
for this specifically since it isn't a purposeful condition, and these
guys don't individually send in massive volumes.

What you or someone else may consider filtering for would be these
address announcement E-mails. Yahoo's has been hijacked for months
now, and this one appears to have come from yet another provider of
such things. They figure it's an easy way to bulk-mail, and that
people are apprehensive to block them. I'm sure that Sniffer has rules
for this sort of thing, though possibly not this particular source.

It's funny though how there isn't a single sentence in that Subject
that isn't clich.

Matt



Marc Catuogno wrote:

  
  


  
  
  Is this from
broken spamware? The whole pitch
is in the subject What a pain to filter.
  
  
  
  
  From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED]] 
  Sent: Thursday, June
22, 2006 3:03
PM
  To:
[EMAIL PROTECTED]
  Subject: [SPAM]I must
apologize
for this unsolicited nature of my email. I am Mr. Lewis Musasike,
General
Manager (Treasury) of Development Bank of Southern
Africa.
This is an urgent and very confidential business proposition. On June
6, 2001,a
Foreign Oil consult
  
  
  
  

  

I have a new email address!

  

  
  
  You can
now email me at: [EMAIL PROTECTED]
  
  
  
- LEWIS MUSASIKE
  
  
  
  
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.




---This E-mail came from the Declude.JunkMail mailing list.  Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail".  The archives can be foundat http://www.mail-archive.com.