Spam increase - Page 3

evantoliopoulos · 26 Oct 2006, 02:50 PM

I also noticed an increase in spam that had the sender identified as being nonsense@my.domain.

So some spammer is sending spam, with the sender identified, essentially, as me.

This means I get lot's of replies from mailer-daemons and auto-replies and spam-arrest messages!

To stop it found that this thread showed me how to set SPF records to help spam software identify the rogue emails as not being from me. BTW, info about SPF can be found at: http://www.openspf.org/

It seems to have worked! I am getting less than one a day now.

mainsoft · 26 Oct 2006, 05:59 PM

Quote:

Originally posted by robmueller
a) A type of .gif stock pump and dump spams
b) A porn URL type spam that points to geocities pages

Is that what other people are seeing? Is it specific types of spam getting through?

Rob

Hi,

I guess I should say yes to a): "financial" emails containing random text with a random title where the actual "message" is a gif image. They are all proposing the purchase of some wonderful stocks. Strangely enough, only a part of them are filtered out. The others are not even scored although they are very similar. if these could also be filtered out, things would be much better.

No to b).

Another type of message that I'm getting in mass amounts is a message always having something like "Read through" or "You should to read" or "you must to read" in their title. They are also proposing stocks.

Finally, the spam filter leaks massively when the message is not in english.

Thanks.

mainsoft · 26 Oct 2006, 06:04 PM

Quote:

Originally posted by robmueller
Bah, I know more spam appears to be getting through.
Rob

By the way, I have another question. Since the support doesn't seem to have enough time to even acknowledge user requests within a reasonable period of time, maybe you will :-) ?

Someone in this thread told me that the "Report Spam" command actually does nothing beside moving the email to the Junk Mail folder. This is not what the online help explains. Is this true?

Thanks.

XB77 · 27 Oct 2006, 12:43 AM

Yes, Rob, I am getting loads of those stock promoting pump & dump spams with text and a gif (which has the actual message). They are generally between 13KB and 88KB in size. I have put in a sieve script to force them into the Junk folder, if they come in with a less than 5 spam score--see below. I wish that there was some way to get SA to boost their scores (above my discard threshold of 10) so that they would get discarded and I wouldn't have to see them. If you want a bunch of them, I could forward my Junk folder contents.

BTW--Is anyone working on individual SA training yet? Of course, that assumes that that would help with this type of spam which may not be the case.

I have not seen the porn spam you mentioned, thank god.

if allof(
header :contains ["X-Attached"] ".gif",
size :over 10K,
size :under 90K
) {
fileinto "INBOX.Junk Mail";
stop;
}

robmueller · 27 Oct 2006, 08:12 AM

The problem is that there's no obvious characteristics that these emails have that make them spam vs non-spam. There's random text with an image attached, how do you know it's not just a friend sending you a picture?

The fact that the spam filter catches some and not others is usually due to non-content related factors. You'll probably find lots of hits to do with RBLs and the like for ones that are caught.

If there was a good set of rules to catch these, I would have created one, but the chance of false positives is high. One interesting thing, I got none of these overnight, so maybe they've stopped sending them right now.

Reporting spam currently doesn't train the bayes filter, however it does put the spam into a corpus that will go to build your bayes filter when we enable it, so it is still useful.

Rob

**Sherry** · 27 Oct 2006, 08:33 AM

Quote:

Originally posted by robmueller
Reporting spam currently doesn't train the bayes filter, however it does put the spam into a corpus that will go to build your bayes filter when we enable it, so it is still useful.

Is that based on individual user reports of spam who click the spam button or used in a general way based on the many that may say something is spam?

Sherry

Bamb0 · 27 Oct 2006, 10:19 AM

Yes i notice more spam also

I thought thats why fastmail added the ad links so we wouldnt get spam??

paleolith · 27 Oct 2006, 11:16 AM

If there was a good set of rules to catch these, I would have created one, but the chance of false positives is high.

This is very true. Others have posted details of filters which work well for them, and I've checked my saved email and found that I'd have had lots of false positives with the same filters. People differ not only in the valid email they receive but also in the spam they receive.

One interesting thing, I got none of these overnight, so maybe they've stopped sending them right now.

Or maybe AED/greylisting got re-enabled? You didn't answer my question about that. My junk box currently has about 1/3 the contents as it did at this time yesterday.

Edward

mainsoft · 27 Oct 2006, 03:20 PM

Quote:

Originally posted by robmueller
Reporting spam currently doesn't train the bayes filter, however it does put the spam into a corpus that will go to build your bayes filter when we enable it...

Rob

So when? And why is it not already enabled? Remember that some of your competitors already allow individual training.

DrStrabismus · 28 Oct 2006, 02:06 AM

Quote:

Originally posted by robmueller
The problem is that there's no obvious characteristics that these emails have that make them spam vs non-spam. There's random text with an image attached, how do you know it's not just a friend sending you a picture?

I've been trying a tuffmail trial account this week, and they are using the FussyOCR plugin. e.g.:

Code:

 3.7 FUZZY_OCR              BODY: Message contains an image with common spam text     
[price  with fuzz 0: score 0.50]     
[drugs  with fuzz 0: score 0.50]     
[type  with fuzz 0: score 0.50]     
[high  with fuzz 0: score 0.50]     
[higher  with fuzz 16: score 0.10]     
[buy  with fuzz 0: score 0.50]     
[cialis  with fuzz 16: score 0.10]

From what I've seen so far this feature is contributing more than Bogofilter.

nowork · 28 Oct 2006, 02:54 PM

I was getting 10-20 of those embedded-.gif stock spams. It was driving me crazy. Nothing worked, reporting it. Fastmail must be unable to do anything about them.

I was looking for a common denominator of all those spams and I found in the headers there is this...

Content-Type: multipart/alternative;...

only it isn't... /alternative, it is something else. Sorry I can't remember right now and I can't check my email because of the server crash"

Anyway, I noticed ALL of the stock image spams had that Content-Type: multipart/???????;
so I put that phrase into the rejecting email filters in the options area...
"Define rules" rejecting emails

it worked!

What I don't know is I'm blocking other mail. I have been getting everything that I know of.

**Sherry** · 28 Oct 2006, 03:07 PM

Quote:

Originally posted by nowork
What I don't know is I'm blocking other mail. I have been getting everything that I know of.

Couldn't you just use a file into folder rule for awhile, at least until you're sure it's not getting anything you may want?

Sherry

nowork · 28 Oct 2006, 03:32 PM

Yes, Thank you!

Now I remember, it's...
Content-Type: multipart/related;

Yes, I will file them into a folder...I missed that.
Thanks

nowork · 28 Oct 2006, 03:38 PM

BTW, I only put the words...
"multipart/related" into the filter. Not the "Content-Type"

This will be an education. Can't wait for the server to be up.

snsh · 28 Oct 2006, 11:27 PM

XB77: your rule works well for me

26 Oct 2006, 02:50 PM	#31
evantoliopoulos Junior Member Join Date: Jul 2006 Location: Sydney, Australia Posts: 15	I also noticed an increase in spam that had the sender identified as being nonsense@my.domain. So some spammer is sending spam, with the sender identified, essentially, as me. This means I get lot's of replies from mailer-daemons and auto-replies and spam-arrest messages! To stop it found that this thread showed me how to set SPF records to help spam software identify the rogue emails as not being from me. BTW, info about SPF can be found at: http://www.openspf.org/ It seems to have worked! I am getting less than one a day now.

27 Oct 2006, 12:43 AM	#34
XB77 Essential Contributor Join Date: Dec 2002 Location: Los Angeles Posts: 365	Yes, Rob, I am getting loads of those stock promoting pump & dump spams with text and a gif (which has the actual message). They are generally between 13KB and 88KB in size. I have put in a sieve script to force them into the Junk folder, if they come in with a less than 5 spam score--see below. I wish that there was some way to get SA to boost their scores (above my discard threshold of 10) so that they would get discarded and I wouldn't have to see them. If you want a bunch of them, I could forward my Junk folder contents. BTW--Is anyone working on individual SA training yet? Of course, that assumes that that would help with this type of spam which may not be the case. I have not seen the porn spam you mentioned, thank god. if allof( header :contains ["X-Attached"] ".gif", size :over 10K, size :under 90K ) { fileinto "INBOX.Junk Mail"; stop; }

27 Oct 2006, 08:12 AM	#35
robmueller Intergalactic Postmaster Join Date: Oct 2001 Location: Melbourne, Australia Posts: 6,102 Representative of: Fastmail.FM	The problem is that there's no obvious characteristics that these emails have that make them spam vs non-spam. There's random text with an image attached, how do you know it's not just a friend sending you a picture? The fact that the spam filter catches some and not others is usually due to non-content related factors. You'll probably find lots of hits to do with RBLs and the like for ones that are caught. If there was a good set of rules to catch these, I would have created one, but the chance of false positives is high. One interesting thing, I got none of these overnight, so maybe they've stopped sending them right now. Reporting spam currently doesn't train the bayes filter, however it does put the spam into a corpus that will go to build your bayes filter when we enable it, so it is still useful. Rob

27 Oct 2006, 10:19 AM	#37
Bamb0 Master of the @ Join Date: Feb 2005 Location: USA Posts: 1,875	Yes i notice more spam also I thought thats why fastmail added the ad links so we wouldnt get spam??

27 Oct 2006, 11:16 AM	#38
paleolith Cornerstone of the Community Join Date: Mar 2002 Location: Florida Posts: 545	If there was a good set of rules to catch these, I would have created one, but the chance of false positives is high. This is very true. Others have posted details of filters which work well for them, and I've checked my saved email and found that I'd have had lots of false positives with the same filters. People differ not only in the valid email they receive but also in the spam they receive. One interesting thing, I got none of these overnight, so maybe they've stopped sending them right now. Or maybe AED/greylisting got re-enabled? You didn't answer my question about that. My junk box currently has about 1/3 the contents as it did at this time yesterday. Edward

28 Oct 2006, 02:54 PM	#41
nowork Junior Member Join Date: Oct 2006 Posts: 11	I was getting 10-20 of those embedded-.gif stock spams. It was driving me crazy. Nothing worked, reporting it. Fastmail must be unable to do anything about them. I was looking for a common denominator of all those spams and I found in the headers there is this... Content-Type: multipart/alternative;... only it isn't... /alternative, it is something else. Sorry I can't remember right now and I can't check my email because of the server crash" Anyway, I noticed ALL of the stock image spams had that Content-Type: multipart/???????; so I put that phrase into the rejecting email filters in the options area... "Define rules" rejecting emails it worked! What I don't know is I'm blocking other mail. I have been getting everything that I know of.

28 Oct 2006, 03:32 PM	#43
nowork Junior Member Join Date: Oct 2006 Posts: 11	Yes, Thank you! Now I remember, it's... Content-Type: multipart/related; Yes, I will file them into a folder...I missed that. Thanks

28 Oct 2006, 03:38 PM	#44
nowork Junior Member Join Date: Oct 2006 Posts: 11	BTW, I only put the words... "multipart/related" into the filter. Not the "Content-Type" This will be an education. Can't wait for the server to be up.

28 Oct 2006, 11:27 PM	#45
snsh Cornerstone of the Community Join Date: Dec 2002 Location: Boston Posts: 611	XB77: your rule works well for me