Re: Ultimate Spam

2007-01-30 Thread Matthias Schmidt
Am/On Mon, 29 Jan 2007 13:01:14 -0800 schrieb/wrote Richard Hart:

(1) Does any hosting service or ISP offer you the capability to bounce
spam? I know many offer excellent SPAM sequestering tools, even deleting
offending messages so you never have to see them.

I don't, I mark identified Spam, becuase of the risk to bounce a legal
message.
but I do bounce mails coming from ips listed in rbls or which have bad
headers, viruses etc.


(2) What is the best way to deal with the relatively recent phenomenon
of GIF spam.

on the client side it gets identified by SpamSieve on the Server
FuzzyOCR is the way to go.

All the best

Matthias

---
Admilon Consulting GmbH
http://www.admilon.com
Tel. +81-736-56-3905
---




Re: Ultimate Spam

2007-01-30 Thread Alan Harper
I am using Spam Assassin on my ISP as well as Spam Sieve on my laptop.
Spam Assassin is not very aggressive (it flags spam correctly nearly
100% of the time, but lets about 50% of the spam thru). The advantage of
using Spam Assassin is that it reduces the amount of spam I have to
download when traveling by 50% (I download and review it by hand only
when I have a high-speed connection).

Spam Sieve is really good, but it has consistently failed to recognized
joe jobs--where a spammer is using a return address at my domain, and
there are automatic replies to that address from the intended addressee.
I have special filters which seem to do a good job rejecting that source
of unwanted email.

To deal with .gif email I have a rule in PowerMail:

If Spam Rating is high

Move message into folder Spam
Don't notify new message
Don't show in Recent Mail
 = Move attachments to trash =
Don't index message content
Don't apply subsequent filters to this message

The only problem with this is that PowerMail has a bug/feature lack that
once you have said Don't index message content, there is no way to
later index the message if you identify the email as legitimate. (Other
than resetting the index, which I do every few months).

Please don't ever bounce spam--it only adds to the frustrations of us
Joes who have been Jobbed.

A

On Mon, 29 Jan 2007 13:01:14 -0800 Richard Hart said:

(1) Does any hosting service or ISP offer you the capability to bounce
spam? I know many offer excellent SPAM sequestering tools, even deleting
offending messages so you never have to see them.

But what I'd like to do is have my mail server bounce messages from
specific IP addresses. For this service, I would switch mail service
providers in a heartbeat.

(2) What is the best way to deal with the relatively recent phenomenon
of GIF spam. You know the ones. The Subject and body are random text.
The attachment is a graphic containing the spam pitch. I haven't been
able to derive a common identifier for them in the headers, and they are
not easy to define in a spam rule. 

Richard Hart









Re: Ultimate Spam

2007-01-30 Thread Richard Hart
By this do you mean that, if you have been spoofed as the return
address, you will receive the bounce warnings from the mailer daemon?

Richard Hart

Alan wrote:

Please don't ever bounce spam--it only adds to the 
frustrations of us Joes who have been Jobbed.




Re(2): Ultimate Spam

2007-01-30 Thread Alan Harper
I mean that I receive about 10 messages like this per day, and they are
serving no-one a useful purpose because I didn't send them because the
return address was spoofed:

The original message was received at Tue, 30 Jan 2007 22:00:07 +0100
from mx01.rrz.uni-hamburg.de [134.100.32.180]

   - The following addresses had permanent fatal errors -
[EMAIL PROTECTED]
(reason: 550 5.1.1 [EMAIL PROTECTED]... User unknown)
(expanded from: [EMAIL PROTECTED])

   - Transcript of session follows -
... while talking to [192.168.100.1]:
 DATA
 550 5.1.1 [EMAIL PROTECTED]... User unknown
550 5.1.1 [EMAIL PROTECTED]... User unknown
 503 5.0.0 Need RCPT (recipient)
Final-Recipient: RFC822; [EMAIL PROTECTED]
X-Actual-Recipient: RFC822; [EMAIL PROTECTED]
Action: failed
Status: 5.1.1
Remote-MTA: DNS; [192.168.100.1]
Diagnostic-Code: SMTP; 550 5.1.1 [EMAIL PROTECTED]...
User unknown
Last-Attempt-Date: Tue, 30 Jan 2007 22:00:10 +0100

I think that is what you are saying also.

Alan

=

On Tue, 30 Jan 2007 10:14:07 -0800 Richard Hart said:

By this do you mean that, if you have been spoofed as the return
address, you will receive the bounce warnings from the mailer daemon?

Richard Hart

Alan wrote:

Please don't ever bounce spam--it only adds to the 
frustrations of us Joes who have been Jobbed.









Ultimate Spam

2007-01-29 Thread Richard Hart
(1) Does any hosting service or ISP offer you the capability to bounce
spam? I know many offer excellent SPAM sequestering tools, even deleting
offending messages so you never have to see them.

But what I'd like to do is have my mail server bounce messages from
specific IP addresses. For this service, I would switch mail service
providers in a heartbeat.

(2) What is the best way to deal with the relatively recent phenomenon
of GIF spam. You know the ones. The Subject and body are random text.
The attachment is a graphic containing the spam pitch. I haven't been
able to derive a common identifier for them in the headers, and they are
not easy to define in a spam rule. 

Richard Hart




Re: Ultimate Spam

2007-01-29 Thread Wayne Brissette
(2) What is the best way to deal with the relatively recent phenomenon
of GIF spam. You know the ones. The Subject and body are random text.
The attachment is a graphic containing the spam pitch. I haven't been
able to derive a common identifier for them in the headers, and they are
not easy to define in a spam rule. 

SpamSieve seems to be catching about 99.9% of these for me. If you're not using 
that product, I would suggest you look at it. 

Wayne




Re: Ultimate Spam

2007-01-29 Thread Geoff Roynon
On Mon, 29 Jan 2007 13:01:14 -0800 Richard Hart said:

(1) Does any hosting service or ISP offer you the capability to bounce
spam? I know many offer excellent SPAM sequestering tools, even deleting
offending messages so you never have to see them.

But what I'd like to do is have my mail server bounce messages from
specific IP addresses. For this service, I would switch mail service
providers in a heartbeat.

(2) What is the best way to deal with the relatively recent phenomenon
of GIF spam. You know the ones. The Subject and body are random text.
The attachment is a graphic containing the spam pitch. I haven't been
able to derive a common identifier for them in the headers, and they are
not easy to define in a spam rule. 

Richard Hart


I filter GIF and JPG spam before it reaches the Spamsieve filter so they
don't pollute the Spamsieve corpus.

In my filters, my first filter is called Spam-gif and has two conditions:

From is not in address book
Attachment ends with .gif

The Actions consist of:

Move message into folder Spam
Set label to Priority 4


I check my Spam folder once a day and delete the obvious spam after
reporting it to SpamCop.

Geoff

-- 
Using PowerMail 5.5 (SpamSieve 2.4.4) on a G5 dual 1.8MHz, 3 GB RAM,
under MacOSX 10.4.8




Re: Ultimate Spam

2007-01-29 Thread Justin Beek

Have you looked at:
http://www.hendricom.com/services.htm

from these dudes who make:
http://www.emailcrx.com/Welcome.html




On Jan 29, 2007, at 3:01 PM, Richard Hart wrote:


(1) Does any hosting service or ISP offer you the capability to bounce
spam? I know many offer excellent SPAM sequestering tools, even  
deleting

offending messages so you never have to see them.

But what I'd like to do is have my mail server bounce messages from
specific IP addresses. For this service, I would switch mail service
providers in a heartbeat.

(2) What is the best way to deal with the relatively recent phenomenon
of GIF spam. You know the ones. The Subject and body are random text.
The attachment is a graphic containing the spam pitch. I haven't been
able to derive a common identifier for them in the headers, and  
they are

not easy to define in a spam rule.

Richard Hart










Re: Ultimate Spam

2007-01-29 Thread Tim Hodgson
On Mon, Jan 29, 2007 at 10:16 pm +, Geoff Roynon wrote:

I filter GIF and JPG spam before it reaches the Spamsieve filter so they
don't pollute the Spamsieve corpus.

In my filters, my first filter is called Spam-gif and has two conditions:

I really don't think it's neccesary to do anything so complicated! I'm
using POPfile, which works in a broadly similar way to SpamSieve, and I
let that do the work. Its accuracy is currently 99.63%, and it was last
reset 16 months ago. I can't remember when a gif spam last got through.
I'm sure SpamSieve will cope just as well.
-- 
TimH

PowerMail 5.5.2 (build 4475) | OS X 10.4.8 | PowerBook FW/500 | 640MB RAM