Print Page | Close Window

New Spam Trend

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=2954
Printed Date: 22 February 2025 at 5:50pm


Topic: New Spam Trend
Posted By: Desperado
Subject: New Spam Trend
Date Posted: 14 February 2004 at 6:14pm

Has anyone seen the same trend I have over the past 3-4 days?  I am seeing less keywords than usual and my No RDNS and MAPS are way up.  I use the following MAPS Servers:

dnsbl.sorbs.net
cbl.abuseat.org
dnsbl.njabl.org
sbl.spamhaus.org

Regards,

Dan S.


Replies:
Posted By: Guests
Date Posted: 15 February 2004 at 1:53pm

maybe spammers noticed microsoft fixed the http://" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http:// ... @ and the http://....:" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://....: bug...

which makes their body unreadable, as plain txt....

i use now the xbl-sbl.spamhaus.org, it`s the rbl and exploit DB in one lookup,

works great, high hit rates.

 

-eric-

Posted By: Guests
Date Posted: 15 February 2004 at 5:48pm

I have seen the same thing. Less keywords but I see more of: "557 You exceeded the maximum number of RCPT TO" then anything else. I wish I could not quarantine them with out turning quarantineing off completely. Mydoom and Max RCPT TO are this most common blocked emails during the last week on my network with RDNS and MAPS following and keywords. Since I block a lot of countries they are the most blocked source.

Posted By: Guests
Date Posted: 16 February 2004 at 5:21am

i notice more encoded messages,

html>
body>
p><font color="#FFFFF1">OQ14 274Mb21 8h F2YEVK0 q225u sq22h6K2 X57pY3 nn312</font></p>
<A href=" undefined" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://202.71.240.122:8888/index.htm" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://202.71.240.122:8888/index.htm "><IMG src="cid:Q8011pm28ifs6P2CoEu47Hi4Bx354g3V" border=0></A>
<p><font color="#FFFFF4">0qU h7t23n 54r2 5662 5hsOb FX14BJ43h bYn63 5R6 21tSIE 47586mn36 j7582X43 y1Bd</font></p>

like we use to hide our http://mailto:" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://mailto: tags, in sites, spammers now use that same feature.


Print Page | Close Window