On Fri, 16 Sep 2016, John Hardin wrote:
>Chip, could you send me some spamples of non-image data: messages
>offlist? The only ones I have anywhere are images.
Sent last week - thanks for your ongoing work on this John! :)
After that request, I decided to add (in my post SA filter)
a minimally scoring test for "data:", to make it easy to find new
variants (in my log viewer, I can flag any test as a "warning"
which flashes an ugly yellow UI thingamajig, so I don't have to
remember to Look for Stuff).
My first hits have all been a new Snowshoe image variant that may
be of (mild) general interest:
http://puffin.net/software/spam/samples/0044_data_embedded_snow.txt
Nowhere near as dangerous as Phish, but more "pee-in-the-pool"
evidence that sane senders should avoid this technique. :\
- "Chip"
