Re: pill image spam learns to walk

2010-01-12 Thread Matus UHLAR - fantomas
Ted Mittelstaedt wrote on Mon, 11 Jan 2010 15:27:07 -0800: It simply means that sites WITHOUT a PTR are still fully compliant mailers. Kai Schaetzl wrote: This has nothing to do with RFC-compliance, but with policy, well accepted policy. On 11.01.10 20:42, Ted Mittelstaedt wrote: Policy

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Matus UHLAR - fantomas
On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og javascript decopding engine. -- Matus UHLAR - fantomas, uh...@fantomas.sk ;

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Per Jessen
Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. It's plain spam - personally I don't want clamav to deal with spam. clamav does have some

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og javascript decopding

Re: pill image spam learns to walk

2010-01-12 Thread Mike Cardwell
On 12/01/2010 06:28, Chip M. wrote: Presently it renders them as plain text. I'm fully aware of the potential problems with it. Ideally I'd like to be able to render those parts as HTML, but I need to be 100% sure that I've stripped out anything dangerous (including embedded remote content by

Re: pill image spam learns to walk

2010-01-12 Thread Henrik K
On Tue, Jan 12, 2010 at 10:15:32AM +, Mike Cardwell wrote: On 12/01/2010 06:28, Chip M. wrote: Presently it renders them as plain text. I'm fully aware of the potential problems with it. Ideally I'd like to be able to render those parts as HTML, but I need to be 100% sure that I've

Re: pill image spam learns to walk

2010-01-12 Thread Kai Schaetzl
Ted, sorry, but your case is lost (since long, look around) and I won't bite in such an off-topic discussion here. Please stop telling others that refusing to accept mail from non-rDNS machines is incorrect. If you *prefer* to handle this at SA level, that's your choice and you can tell that.

Re: Compiling error on Snapshots from svn.spamassassin.org

2010-01-12 Thread Justin Mason
hi -- is this still occurring with latest snapshots? If so, could you open a ticket at our bugzilla? On Tue, Jan 5, 2010 at 21:00, David Bayle david.ba...@zerospam.ca wrote: Hy, Our setup is: - Ubuntu 8.04 ( 2.6.26 ) - Trying to setup snapshots from

Re: Compiling error on Snapshots from svn.spamassassin.org

2010-01-12 Thread Mark Martinec
On Tuesday January 12 2010 11:54:55 Justin Mason wrote: hi -- is this still occurring with latest snapshots? If so, could you open a ticket at our bugzilla? On Tue, Jan 5, 2010 at 21:00, David Bayle david.ba...@zerospam.ca wrote: - Trying to setup snapshots from

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Per Jessen
Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og

Re: [SPAM:9.6] Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Tue, 12 Jan 2010 12:15:41 +0100 Per Jessen p...@computer.org wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of

[no subject]

2010-01-12 Thread postmaster....@gmail.com
unsubscribe

Re: Fake mailing list spam

2010-01-12 Thread Joseph Brennan
Report the abuse to Google and reject any mail from @listserv.bounces.google.com Trademark violation? http://www.lsoft.com/corporate/trademark.asp I thought this was faked the first time I saw it. Joseph Brennan Columbia University Information Technology

Faked _From_ field using our domain - how to filter/score?

2010-01-12 Thread Callum Millard
I'm sure there's a straight forward way of doing this, but after several of hours searching, I can't find it. The problem is spam with a faked 'From:' field. Spammers are sending e-mails to our domain with the 'From:' field set to a valid e-mail address from our domain. Here's an edited

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread John Hardin
On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? I'm just interested in the kind of java-script(?) munging that

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Tue, 12 Jan 2010 10:56:09 -0800 (PST) John Hardin jhar...@impsec.org wrote: On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae

Re: Faked _From_ field using our domain - how to filter/score?

2010-01-12 Thread Kai Schaetzl
Callum Millard wrote on Tue, 12 Jan 2010 18:17:44 +: Postfix Postfix? Easy. smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access hash:/etc/mail/allow_recipients, reject_non_fqdn_sender, reject_unknown_sender_domain, check_sender_access

[OT] spamalyser, was Re: pill image spam learns to walk

2010-01-12 Thread Mike Cardwell
On 12/01/2010 10:24, Henrik K wrote: Presently it renders them as plain text. I'm fully aware of the potential problems with it. Ideally I'd like to be able to render those parts as HTML, but I need to be 100% sure that I've stripped out anything dangerous (including embedded remote content

Re: [sa] Faked _From_ field using our domain - how to filter/score?

2010-01-12 Thread Charles Gregory
On Tue, 12 Jan 2010, Callum Millard wrote: : The problem is spam with a faked 'From:' field. Spammers are sending : e-mails to our domain with the 'From:' field set to a valid e-mail : address from our domain. Key question: Can your users send mail 'From' their internal addresses via ANY

Re: Faked _From_ field using our domain - how to filter/score?

2010-01-12 Thread René Berber
Callum Millard wrote: [snip] The problem is spam with a faked 'From:' field. Spammers are sending e-mails to our domain with the 'From:' field set to a valid e-mail address from our domain.[snip] SPF was designed just for that, not only to prevent others from accepting fake messages that

Re: [sa] Faked _From_ field using our domain - how to filter/score?

2010-01-12 Thread John Hardin
On Tue, 12 Jan 2010, Charles Gregory wrote: On Tue, 12 Jan 2010, Callum Millard wrote: : The problem is spam with a faked 'From:' field. Spammers are sending : e-mails to our domain with the 'From:' field set to a valid e-mail : address from our domain. Unfortunately, if you permit use of

Re: [OT] spamalyser, was pill image spam learns to walk

2010-01-12 Thread Kai Schaetzl
Mike Cardwell wrote on Tue, 12 Jan 2010 20:22:44 +: It handles remote content like images and CSS fine tip: I would not handle remote content at all as this may lead to account verification. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Per Jessen
John Hardin wrote: On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? I'm just interested in the kind of

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Jason Bertoch
I'm just interested in the kind of java-script(?) munging that has gone on there and what it is in 'English' for want of a better phrase. Nothing was munged, it's just random text. If so, what's the point to it? By no means a JS coder, and haven't dug deeper to find out, but couldn't it be

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Benny Pedersen
On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote http://pastebin.com/m66a5a2ae X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Francis Russell
Jason Bertoch wrote: By no means a JS coder, and haven't dug deeper to find out, but couldn't it be pre-compiled JS and not just random text? Doubtful. I don't believe JavaScript has a bytecode or any other (except in some JavaScript engines internal representation) compiled format. Francis

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread John Hardin
On Tue, 12 Jan 2010, Jason Bertoch wrote: I'm just interested in the kind of java-script(?) munging that has gone on there and what it is in 'English' for want of a better phrase. Nothing was munged, it's just random text. If so, what's the point to it? By no means a JS

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Wed, 13 Jan 2010 00:41:00 +0100 Benny Pedersen m...@junc.org wrote: On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote http://pastebin.com/m66a5a2ae X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) Err, yes - I had already *highlighted* that, it was posted because