Spam Filter ISP Forums : weird spam emails

weird spam emails : I am not the "Master"...

Fri, 18 Mar 2005 11:18:56 +0000

Author: Desperado
Subject: 5104
Posted: 18 March 2005 at 11:18am

I am not the "Master" ... just persistant.

weird spam emails : Dan! Could I have it too? (kim...

Fri, 18 Mar 2005 02:29:21 +0000

Author: Web123
Subject: 5104
Posted: 18 March 2005 at 2:29am

Dan!

Could I have it too? (kim @ engberg.fi)

You seem to be "The Master" of the keywords-list.

Thanks,
Kim

weird spam emails : email sent. Dan, thanks again....

Thu, 17 Mar 2005 17:02:41 +0000

Author: chinabee
Subject: 5104
Posted: 17 March 2005 at 5:02pm

email sent. Dan, thanks again.

weird spam emails : chinabee, Yes, it would be placed...

Thu, 17 Mar 2005 16:57:07 +0000

Author: Desperado
Subject: 5104
Posted: 17 March 2005 at 4:57pm

chinabee,

Yes, it would be placed in the keyword blacklist. please email me at daseligmann at hotmail dot com BUT, I usually only use this account for testing so it is not my general point of contact.

Dan S.

weird spam emails : What do you mean? add this in...

Thu, 17 Mar 2005 16:21:04 +0000

Author: chinabee
Subject: 5104
Posted: 17 March 2005 at 4:21pm

What do you mean? add this in keyword black list?

Would you mind sharing your keyword list with me? I think you are realllllly great at this!!!!

Edited by chinabee

weird spam emails : Fractional Font sizes are not...

Thu, 17 Mar 2005 12:19:23 +0000

Author: Desperado
Subject: 5104
Posted: 17 March 2005 at 12:19pm

Fractional Font sizes are not valid and are used to obscure / fool filters.

This is what I use:

Corrected Version:

((?i)(font\-size\:[\x20]{0,1}(\d){1,}\.[1-9]{1,}[\d]{0,1}((\")|(\;)|(p(t|x)))))

Dan

Edited by Desperado

weird spam emails : This is what user sees: Hello,...

Thu, 17 Mar 2005 10:01:00 +0000

Author: chinabee
Subject: 5104
Posted: 17 March 2005 at 10:01am

This is what user sees:

Hello, VISlT Our Great PharmB.yMail Shop and SAVE 75%

Vl		RA VA		UM AM		EN Cl		S	, man
	AG		Ll		Bl		ALl			y Other.

Have a good day.

P.S. You will be pIeasantIy surprised with our PRlCES ;-)

weird spam emails : Body <DIV><DIV><P...

Thu, 17 Mar 2005 09:59:47 +0000

Author: chinabee
Subject: 5104
Posted: 17 March 2005 at 9:59am

Body

Hello, http://www.am.ox.com.starrinin.com/"> face=Arial size=4>VISlT Our Great PharmB.yMail Shop and SAVE 75%

Have a good day.

P.S. You will be pIeasantIy surprised with our PRlCES ;-)

Do you Yahoo!?

Yahoo! Small Business - Try'>http://us.rd.yahoo.com/evt=31637/*http://smallbusiness. yahoo.com/resources/">Try our new resources site!

weird spam emails : Header Microsoft Mail Internet...

Thu, 17 Mar 2005 09:59:00 +0000

Author: chinabee
Subject: 5104
Posted: 17 March 2005 at 9:59am

Header

Microsoft Mail Internet Headers Version 2.0
Received: from ren.mycompany.com ([192.168.33.184]) by hou.mycompany.com with Microsoft SMTPSVC(5.0.2195.6713);
Wed, 16 Mar 2005 08:30:11 -0600
Received: from bran.WED01 ([192.168.11.180])
by ren.mycompany.com (SAVSMTP 3.0.0.44) with SMTP id M2005031608301015532
for <dan@mycompany.com>; Wed, 16 Mar 2005 08:30:10 -0600
Received: (from webmail [192.168.11.20])
by bran.WET01 (SMSSMTP 4.0.0.59) with SMTP id M2005031609220303359
for <dan@mycompany.com>; Wed, 16 Mar 2005 09:22:03 -0500
Received: from 68.142.200.101 by (LogSat Software SMTP Server) Wed, 16 Mar 2005 09:30:10 -0500
Received: (qmail 46453 invoked by uid 60001); 16 Mar 2005 14:29:58 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
b=AwhO3OIzoesaLplnrOzxQaJ5InI9WOxgUpaXUwFJJbUpoicBDY9Crny+bY Ns2py4L1P4dgvMs2etV1qDUWtMAdv2VPCxCsdeLj3Ajz/GjsUYBykGaS+ZJi BFfKf5AE9UBudt8KNpBGgXL8FxXTapEA5Cp2S+hRgMNG7B1Vb6p+4= ;
Message-ID: <20050316142958.46451.qmail@web30308.mail.mud.yahoo.com>
Received: from [12.119.21.244] by web30308.mail.mud.yahoo.com via HTTP; Wed, 16 Mar 2005 06:29:58 PST
Date: Wed, 16 Mar 2005 06:29:58 -0800 (PST)
From: Chinabee <chinabee@nowhere.com>
Reply-To: chinabee@nowhere.com
Subject: af
To: dan@mycompany.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1297890435-1110983398=:46223"
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <chinabee@nowhere.com>
Return-Path: chinabee@nowhere.com
X-OriginalArrivalTime: 16 Mar 2005 14:30:11.0296 (UTC) FILETIME=[A90F8600:01C52A34]

--0-1297890435-1110983398=:46223
Content-Type: text/plain; charset=us-ascii

--0-1297890435-1110983398=:46223
Content-Type: text/html; charset=us-ascii

--0-1297890435-1110983398=:46223--

weird spam emails : To have any chances of finding...

Wed, 16 Mar 2005 18:22:04 +0000

Author: LogSat
Subject: 5104
Posted: 16 March 2005 at 6:22pm

To have any chances of finding out the reason, we need to see the wholeoriginal email. If you're not able to do so there's nothing we can do.Please note that you can usually succeed in obtaining the originalemail by forwarding it as an attachment to an email account that uses a"clean" email client like Outlook Express to retrieve the email.

Vl	< /FONT>	RA VA	< /FONT>	UM AM	< /FONT>	EN Cl	< /FONT>	S	, man	< /FONT>
	AG		Ll		Bl		ALl			y Other.