Re: New bitcoin ransom message today

2018-12-13 Thread Kevin A. McGrail
On 12/13/2018 8:10 PM, John Hardin wrote: > > Initial rules checked into my sandbox. Also, these rash of spams are the target of my KAM_CRIM rules in KAM.cf.  I've updated for the current explosive issue and open to spamples. However, many of us are not seeing these spams because of the IP

Re: New bitcoin ransom message today

2018-12-13 Thread Kevin A. McGrail
On 12/13/2018 5:55 PM, SVC: Administrator wrote: > Yeah, some of us are stuck with Outlook. Sucks but if top posting is the > worst thing that happens to me today I'm way ahead of the game. > > Used to be a plugin that worked with Outlook 2007 which would do a proper > layout but it stopped

Re: New bitcoin ransom message today

2018-12-13 Thread Pedro David Marco
BUF... this is getting beyond a joke  There are people paying to many of the BTC wallets of the scammers, hence acommodating its veracity... :-( -PedroD

RE: New bitcoin ransom message today

2018-12-13 Thread John Hardin
On Thu, 13 Dec 2018, John Hardin wrote: On Thu, 13 Dec 2018, Chip M. wrote: As requested: http://puffin.net/software/spam/samples/0061_bitcoin_splosion.txt I MUNGED the "To". It's the latest of two sent to me by an awesome volunteer. :) First thoughts: Both were base64 encoded. Both

RE: New bitcoin ransom message today

2018-12-13 Thread John Hardin
On Thu, 13 Dec 2018, Chip M. wrote: As requested: http://puffin.net/software/spam/samples/0061_bitcoin_splosion.txt I MUNGED the "To". It's the latest of two sent to me by an awesome volunteer. :) First thoughts: Both were base64 encoded. Both have "disclaimers" that they're not

Re: New bitcoin ransom message today

2018-12-13 Thread Benny Pedersen
SVC: Administrator skrev den 2018-12-13 23:55: Yeah, some of us are stuck with Outlook. oh Sucks but if top posting is the worst thing that happens to me today I'm way ahead of the game. if the computer in front could run php, i would install roundcube on it to replace outdated

RE: New bitcoin ransom message today

2018-12-13 Thread SVC: Administrator
Yeah, some of us are stuck with Outlook. Sucks but if top posting is the worst thing that happens to me today I'm way ahead of the game. Used to be a plugin that worked with Outlook 2007 which would do a proper layout but it stopped working with newer versions. But for your viewing

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Thu, 2018-12-13 at 17:08 -0500, Bill Cole wrote: > On 13 Dec 2018, at 16:24, Chris Pollock wrote: > > > On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: > > > On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > > > > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > > > > > > > On

Re: New bitcoin ransom message today

2018-12-13 Thread Benny Pedersen
Chip M. skrev den 2018-12-13 22:33: As requested: http://puffin.net/software/spam/samples/0061_bitcoin_splosion.txt I MUNGED the "To". It's the latest of two sent to me by an awesome volunteer. :) First thoughts: Both were base64 encoded. Both have "disclaimers" that they're not

Re: New bitcoin ransom message today

2018-12-13 Thread Benny Pedersen
Kevin Miller skrev den 2018-12-13 20:25: joining topposters department :=) xmax is comming to town Our police department has gotten three (that I’m aware of) so far this morning. Almost certainly phony, but the authorities won’t have the luxury of blowing it off like you can w/the

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Bill Cole
On 13 Dec 2018, at 16:24, Chris Pollock wrote: > On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: >> On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: >>> On 11 Dec 2018, at 16:37, Chris Pollock wrote: >>> On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: >>> >>> [...] >

RE: New bitcoin ransom message today

2018-12-13 Thread Chip M.
As requested: http://puffin.net/software/spam/samples/0061_bitcoin_splosion.txt I MUNGED the "To". It's the latest of two sent to me by an awesome volunteer. :) First thoughts: Both were base64 encoded. Both have "disclaimers" that they're not terrorists. :roll-eyes: John Hardin: I'll

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: > On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > > > [...] > > > > Anyway, as of today I've capped those 2 subrules at

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > [...] > > > Anyway, as of today I've capped those 2 subrules at levels which > > > leave ample space to still match the target spam.

RE: New bitcoin ransom message today

2018-12-13 Thread Kevin Miller
Our police department has gotten three (that I’m aware of) so far this morning. Almost certainly phony, but the authorities won’t have the luxury of blowing it off like you can w/the sextortion cases. ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street

New bitcoin ransom message today

2018-12-13 Thread Joseph Brennan
There is a new Bitcoin ransom spam. It threatens to blow up a bomb unless the bitcoin payment is made, so the body text is different. Subjects include: Bomb is in your building Rescue service will complicate the situation Think twice keep calm We got a group of them from 194.58.61/24 I do not