HTML Spam Email How to stop this?
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5758
Printed Date: 05 February 2025 at 12:08pm
Topic: HTML Spam Email How to stop this?
Posted By: tcrawford
Subject: HTML Spam Email How to stop this?
Date Posted: 16 August 2006 at 3:07pm
|
-----Original Message-----
From: Neddy Simpson [mailto:tcwdt@biblebrowser.com]
Sent: Wednesday, August 02, 2006 8:54 PM
To: Tammy Trador
Subject: track meet phonetic
With the feeling that she was going to her doom, she returned to thelanding. Like the flash of a fer-de-lance, Helen whipped round. But with the arrival of a new girl at the house she had smelt danger. Ogma, The might of heaven is Mine to give. Every cell seemed atrophied,every fibre withered. For a time The heavenly quest seemed won, the face of earth Turned to the skies. She looked at the Professor with incredulous eyes. And then the high king told her all the tale, Which he alone remembered but in myth And symbol. Please contact us beforehand to let us know your plans and to work out the details. As though struck by some recollection, he turned round and faced Helen. To contact Project Gutenberg of Australia go to http://gutenberg. And Dana said, I shall make beauty there. During two visits to the same house, theymight notice some trifle which I have overlooked. One more feature of the thrill-drama had arrived, with the samesuggestion of cumulative effect. And Angus said, My birds shall waken love. The old woman knew something which she would not reveal. In those First realms of immortal youth the gods Had everywhere their hearts desire. Would not your sorrow shared melt in our love? When she reached the hall, she repeated theoperation, in each reception-room. How did the scarf get inside Lady Warrens drawer? By the aureole of crispinglight-red hair, she knew that girl was herself. Just as it was in Helens nature,to explore, his own instinct was to satisfy any wish for knowledge. The Policeshould have it in their possession, without delay. It died instantly, as the Professor shook his head. She was penned in acorner, while the Professor closed her in. The Professor was impatient with her stupidity. A foam of glorious faces swayed to him Athirst for the heroic enterprise. And for a moment We almost mix in their eternity. The Professorhad proved his theory that a clever man could direct the actions of hisfellows. Only Lady Warren knew of thecrimes and had fulfilled the Law. And Dana said, I shall make beauty there. Unless she went out by the back-door, which is most unlikely, shesstill here, thought Helen. To Helens horror,she saw that his fingers were beginning to twitch. Helen wondered uneasily what had become of her. The Professor was impatient with her stupidity. And we who are the Children of the Light Must answer in the infinite brotherhood. Again the Professor frowned, in irritation.
|
Replies:
Posted By: tcrawford
Date Posted: 16 August 2006 at 3:38pm
|
Here is the log error that is letting these through i removed our real email address and server ip:
08/02/06 20:58:36:970 -- (45788) Connection from: 71.215.253.185 - Originating country : United States
08/02/06 20:58:37:532 -- (45788) Mail from: mailto:tcwdt@biblebrowser.com - tcwdt@biblebrowser.com
08/02/06 20:58:38:110 -- (45788) - MAPS search done...
08/02/06 20:58:38:110 -- (45788) RCPT TO: mailto:email@email.com - email@email.com accepted
08/02/06 20:58:41:376 -- (45788) String matching error for ( with the feeling that she was going to her doom, she returned to thelanding. like the flash of a fer-de-lance, helen whipped round. but with the arrival of a new girl at the house she had smelt danger. ogma, the might of heaven is mine to give. --and-- (<!(--|[^>]*>).*){8}) : TRegExpr(comp): ParseReg Unmatched () (pos 15)
08/02/06 20:58:41:516 -- (45788) Scanning image for spam:lubricate.gif
08/02/06 20:58:41:516 -- (45788) Scanning image for spam:voucher.gif
08/02/06 20:58:41:516 -- (45788) Scanning image for spam:flushed.gif
08/02/06 20:58:41:532 -- (45788) Scanning image for spam:lantern.gif
08/02/06 20:58:41:532 -- (45788) Scanning image for spam:condiment.gif
08/02/06 20:58:41:548 -- (45788) Scanning image for spam:ascend.gif
08/02/06 20:58:41:548 -- (45788) Scanning image for spam:o.gif
08/02/06 20:58:41:579 -- (45788) EMail from mailto:tcwdt@biblebrowser.com - tcwdt@biblebrowser.com to mailto:email@email.com - email@email.com passes Bayesian filter - 0% spam (30ms)
08/02/06 20:58:41:595 -- (45788) EMail from mailto:tcwdt@biblebrowser.com - tcwdt@biblebrowser.com to mailto:email@email.com - email@email.com was queued. Size: 52 KB, 53248 bytes
08/02/06 20:58:41:595 -- (45496) Sending email from mailto:tcwdt@biblebrowser.com - tcwdt@biblebrowser.com to mailto:email@email.com - email@email.com
08/02/06 20:58:41:641 -- (46604) Time to add Msg to Bayes corpus:0
08/02/06 20:58:41:720 -- (45788) Disconnect
08/02/06 20:58:41:735 -- (45496) EMail from mailto:tcwdt@biblebrowser.com - tcwdt@biblebrowser.com to mailto:email@email.com - email@email.com was forwarded to
|
Posted By: sgeorge
Date Posted: 16 August 2006 at 3:56pm
The best way to attack an html spam email is by targetting some the distinct html code... you've only posted the plain text from the email. If you can post the original (minus your ip and email), it may help.
Also, and possibly more importantly...there seems to be an error in your keywords list: You have regular expression that has an unmatched set of parens ... meaning that the # of left parens and right parens in one of your keywords is not the same. It appears that the error is related to:
...the above keyword has 2 left parens, and 3 right parens
Stephen
|
Posted By: tcrawford
Date Posted: 17 August 2006 at 8:17am
|
I will check the keyword problem, thanks for the help. Here is the source code version of the email.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Message</TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1555" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV> </DIV>
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Neddy Simpson
[mailto:tcwdt@biblebrowser.com] <BR><B>Sent:</B> Wednesday, August 02, 2006 8:54
PM<BR><B>To:</B> Tammy Trador<BR><B>Subject:</B> track meet
phonetic<BR><BR></FONT></DIV>
<DIV><FONT face=Arial size=2><IMG alt="" hspace=0
src="cid:001901c6b698$9e72dd90$b8d9d747@jes" align=baseline border=0><IMG alt=""
hspace=0 src="cid:001a01c6b698$9e72dda5$b8d9d747@jes" align=baseline
border=0><IMG alt="" hspace=0 src="cid:001b01c6b698$9e72ddba$b8d9d747@jes"
align=baseline border=0></FONT></DIV>
<DIV><FONT face=Arial size=2><IMG alt="" hspace=0
src="cid:001c01c6b698$9e72ddcf$b8d9d747@jes" align=baseline border=0><IMG alt=""
hspace=0 src="cid:001d01c6b698$9e72dde4$b8d9d747@jes" align=baseline
border=0><IMG alt="" hspace=0 src="cid:001e01c6b698$9e72ddf9$b8d9d747@jes"
align=baseline border=0><IMG alt="" hspace=0
src="cid:001f01c6b698$9e72de0e$b8d9d747@jes" align=baseline
border=0></FONT></DIV>With the feeling that she was going to her doom, she
returned to thelanding. Like the flash of a fer-de-lance, Helen whipped round.
But with the arrival of a new girl at the house she had smelt danger. Ogma, The
might of heaven is Mine to give. Every cell seemed atrophied,every fibre
withered. For a time The heavenly quest seemed won, the face of earth Turned to
the skies. She looked at the Professor with incredulous eyes. And then the high
king told her all the tale, Which he alone remembered but in myth And symbol.
Please contact us beforehand to let us know your plans and to work out the
details. As though struck by some recollection, he turned round and faced Helen.
To contact Project Gutenberg of Australia go to http://gutenberg - http://gutenberg . And Dana said,
I shall make beauty there. During two visits to the same house, theymight notice
some trifle which I have overlooked. One more feature of the thrill-drama had
arrived, with the samesuggestion of cumulative effect. And Angus said, My birds
shall waken love. The old woman knew something which she would not reveal. In
those First realms of immortal youth the gods Had everywhere their hearts
desire. Would not your sorrow shared melt in our love? When she reached the
hall, she repeated theoperation, in each reception-room. How did the scarf get
inside Lady Warrens drawer? By the aureole of crispinglight-red hair, she knew
that girl was herself. Just as it was in Helens nature,to explore, his own
instinct was to satisfy any wish for knowledge. The Policeshould have it in
their possession, without delay. It died instantly, as the Professor shook his
head. She was penned in acorner, while the Professor closed her in. The
Professor was impatient with her stupidity. A foam of glorious faces swayed to
him Athirst for the heroic enterprise. And for a moment We almost mix in their
eternity. The Professorhad proved his theory that a clever man could direct the
actions of hisfellows. Only Lady Warren knew of thecrimes and had fulfilled the
Law. And Dana said, I shall make beauty there. Unless she went out by the
back-door, which is most unlikely, shesstill here, thought Helen. To Helens
horror,she saw that his fingers were beginning to twitch. Helen wondered
uneasily what had become of her. The Professor was impatient with her stupidity.
And we who are the Children of the Light Must answer in the infinite
brotherhood. Again the Professor frowned, in irritation. </BODY></HTML>
|
Posted By: Marco
Date Posted: 17 August 2006 at 11:13am
|
i personally would dump that biblebrowser domain into my little black bin.
-------------
Anyone who is capable of getting himself made president, should on no account be allowed to do the job. D.Adams
|
Posted By: sgeorge
Date Posted: 18 August 2006 at 10:01am
Not a bad idea, Marco.
tcrawford, I don't have time to today help out to see if there's a magic keyword that might do the trick... But I'll take another look next weekat the message you posted.
Stephen
|
Posted By: tcrawford
Date Posted: 21 August 2006 at 4:08pm
|
I fixed the keyword problem, but they are still getting through, they don't come from the same domain it is different all the time. This about the only spam that is getting through right now.
|
Posted By: tcrawford
Date Posted: 21 August 2006 at 4:17pm
|
Here is the latestest one that is getting through and I believe it is the max message size, how can I change that?
thanks in advance
Tom Crawford
08/21/06 13:26:24:375 -- (33020) Connection from: 205.234.170.138 - Originating country : United States
08/21/06 13:26:25:000 -- (33020) Mail from: mailto:cfknj@canaaninc.org - cfknj@canaaninc.org
08/21/06 13:26:25:421 -- (33020) - MAPS search done...
08/21/06 13:26:25:421 -- (33020) RCPT TO: mailto:email@email.com - email@email.com accepted
08/21/06 13:26:28:218 -- (33020) Scanning image for spam:ad lib.gif
08/21/06 13:26:28:234 -- (33020) Scanning image for spam:dumpy.gif
08/21/06 13:26:28:234 -- (33020) Scanning image for spam:horizon.gif
08/21/06 13:26:28:250 -- (33020) Scanning image for spam:quotient.gif
08/21/06 13:26:28:250 -- (33020) Warning - Message exceeds MaxMsgSizeForKeywordScan, skipping statistical scan
08/21/06 13:26:28:250 -- (33020) EMail from mailto:cfknj@canaaninc.org - cfknj@canaaninc.org to mailto:email@email.com - email@email.com passes Bayesian filter - 0% spam (0ms)
08/21/06 13:26:28:250 -- (33020) EMail from mailto:cfknj@canaaninc.org - cfknj@canaaninc.org to mailto:email@email.com - email@email.com was queued. Size: 72 KB, 73728 bytes
08/21/06 13:26:28:265 -- (25744) Sending email from mailto:cfknj@canaaninc.org - cfknj@canaaninc.org to mailto:email@email.com - email@email.com --
08/21/06 13:26:28:296 -- (33020) Disconnect
08/21/06 13:26:28:437 -- (25744) EMail from mailto:cfknj@canaaninc.org - cfknj@canaaninc.org to mailto:email@email.com - email@email.com -- was forwarded to emailserver ip
|
Posted By: tcrawford
Date Posted: 21 August 2006 at 4:18pm
|
Thanks for all the help so far.
|
Posted By: LogSat
Date Posted: 21 August 2006 at 4:53pm
There are a few problems with this ... problem.
- As sgeorge correctly identified, there's an error in one of your keywords regular expressions:(<!(--|[^>]*>).*){8})
There are two "(" and three ")", so the parenthesis are mistamtched,
causing an error in the RegEx lookups, as looged in SpamFilter:
08/02/06 20:58:41:376 -- (45788) String matching error for - The source code you posted appears to have been extracted from Microsoft Outlook by doing a "view source" from the email client. Unfortunately Microsoft *completely* changes the real source of the email. What you are seing is not even close to what the real email's source is
 . You should use other email clients, like Eudora, Mozilla Thunderbird, Netscape, or even Microsoft Outlook Express, as they all can show the real source. - The last log you posted shows the email being 72KB in size, which exceeds the default value of 64KB. You can easily change that by editing the MaxMsgSizeForKeywordScan value in the SpamFilter.ini file (you don't even have to start SpamFilter after making the change... the new setting will be re-imported within 60 seconds...). However please note that increasing this maximum size does affect the CPU usage. If you have CPU to spare on your server, you can be pretty aggressive by increasing it ten-fold, otherwise... be conservative!
-------------
Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|
Posted By: tcrawford
Date Posted: 22 August 2006 at 10:32am
 LogSat wrote:
There are a few problems with this ... problem.
- As sgeorge correctly identified, there's an error in one of your keywords regular expressions:(<!(--|[^>]*>).*){8})
There are two "(" and three ")", so the parenthesis are mistamtched, causing an error in the RegEx lookups, as looged in SpamFilter:
08/02/06 20:58:41:376 -- (45788) String matching error for
- The source code you posted appears to have been extracted from Microsoft Outlook by doing a "view source" from the email client. Unfortunately Microsoft *completely* changes the real source of the email. What you are seing is not even close to what the real email's source is . You should use other email clients, like Eudora, Mozilla Thunderbird, Netscape, or even Microsoft Outlook Express, as they all can show the real source.
- The last log you posted shows the email being 72KB in size, which exceeds the default value of 64KB. You can easily change that by editing the MaxMsgSizeForKeywordScan value in the SpamFilter.ini file (you don't even have to start SpamFilter after making the change... the new setting will be re-imported within 60 seconds...). However please note that increasing this maximum size does affect the CPU usage. If you have CPU to spare on your server, you can be pretty aggressive by increasing it ten-fold, otherwise... be conservative!
|
I fixed the ( error in the keyword.
I also increased the size limit.
Thanks for the help I will keep you updated on the results.
|
Posted By: sgeorge
Date Posted: 23 August 2006 at 2:50pm
Hi tcrawford,
I also pm'd a keyword to you that I use to stop lot of this stuff for me. I hope it helps.
Stephen
|
Posted By: tcrawford
Date Posted: 23 August 2006 at 3:24pm
|
sgeorge wrote:
Hi tcrawford,
I also pm'd a keyword to you that I use to stop lot of this stuff for me. I hope it helps.
Stephen
|
Thanks a ton!!!
|
Posted By: tcrawford
Date Posted: 24 August 2006 at 11:02am
|
Here is a better sample of the message
-----Original Message-----
From: Alfred Mata [mailto:nkr@carolwhite.com]=20
Sent: Tuesday, August 22, 2006 4:50 PM
To: user
Subject: crosstown organization
Orlandos day was passed, it would seem, somewhat in this fashion.
Ladies headdresses AT LEAST six foot high.
The elders, however, who had seen more of foreigners thanthey had,
became suspicious. Perhaps itwould be well to begin the speech all over
again.
MrPeregrine said I looked QUITE lovely which I only repeat to you,
mydearest, because I know.
Again the trumpets peal forth:Modesty Avaunt! We may take advantage of
this pause in the narrative to make certainstatements.
In the firstroom, it was permissible only to mention the weather.
Trees were withered hags,and sheep were grey boulders. There, in the
shadow of a giant fig tree, waited an oldgipsy on a donkey. For, no
sooner had the Ambassador despatched one such visit,than another had to
be undertaken.
To one hundred and two mats, each thirty yards long. There were no
hedges for ferns to grow on, and no fields forsheep to graze. The
envious said thatthis was Nell Gwyns tribute to the memory of a leg.
Ravishing, she exclaims ten times on one page, wondrous. Now, she
perched, top heavyupon a fire screen.
We should not haveblamed her had she rung the bell, screamed, or
fainted.
He stood upright in complete nakednessbefore us, and while the trumpets
pealed Truth! He now set to work in earnest, as we can prove beyond a
doubt if we lookat his ledgers. For, no sooner had the Ambassador
despatched one such visit,than another had to be undertaken.
The gipsies followed thegrass; when it was grazed down, on they moved
again.
She climbed the mountains; roamed the valleys; sat onthe banks of the
streams.
Nohuman being, since the world began, has ever looked more ravishing.=20
------_=_NextPart_002_01C6C6B9.13ED046C
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Message</TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1561" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV> </DIV>
<DIV></DIV>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Alfred Mata=20
[mailto:nkr@carolwhite.com] <BR><B>Sent:</B> Tuesday, August 22, 2006 =
4:50=20
PM<BR><B>To:</B> Donna McKenna<BR><B>Subject:</B> crosstown=20
organization<BR><BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><IMG alt=3D"" hspace=3D0=20
src=3D"cid:001101c6c62d$d97e5140$226d0246@xhs.syqd" align=3Dbaseline=20
border=3D0></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Orlandos day was passed, it would seem, =
somewhat in=20
this fashion.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Ladies headdresses AT LEAST six foot=20
high.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>The elders, however, who had seen more =
of=20
foreigners thanthey had, became suspicious. Perhaps itwould be well to =
begin the=20
speech all over again.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>MrPeregrine said I looked QUITE lovely =
which I only=20
repeat to you, mydearest, because I know.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Again the trumpets peal forth:Modesty =
Avaunt! We=20
may take advantage of this pause in the narrative to make=20
certainstatements.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>In the firstroom, it was permissible =
only to=20
mention the weather.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Trees were withered hags,and sheep were =
grey=20
boulders. There, in the shadow of a giant fig tree, waited an oldgipsy =
on a=20
donkey. For, no sooner had the Ambassador despatched one such visit,than =
another=20
had to be undertaken.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>To one hundred and two mats, each =
thirty yards=20
long. There were no hedges for ferns to grow on, and no fields forsheep =
to=20
graze. The envious said thatthis was Nell Gwyns tribute to the memory of =
a=20
leg.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Ravishing, she exclaims ten times on =
one page,=20
wondrous. Now, she perched, top heavyupon a fire screen.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>We should not haveblamed her had she =
rung the bell,=20
screamed, or fainted.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>He stood upright in complete =
nakednessbefore us,=20
and while the trumpets pealed Truth! He now set to work in earnest, as =
we can=20
prove beyond a doubt if we lookat his ledgers. For, no sooner had the =
Ambassador=20
despatched one such visit,than another had to be =
undertaken.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>The gipsies followed thegrass; when it =
was grazed=20
down, on they moved again.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>She climbed the mountains; roamed the =
valleys; sat=20
onthe banks of the streams.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>Nohuman being, since the world began, =
has ever=20
looked more ravishing. </FONT></DIV></BODY></HTML>
------_=_NextPart_002_01C6C6B9.13ED046C--
------_=_NextPart_001_01C6C6B9.13ED046C
Content-Type: image/gif;
name="forlorn.gif"
Content-Transfer-Encoding: base64
Content-ID: < mailto:001101c6c62d$d97e5140$226d0246@xhs.syqd - 001101c6c62d$d97e5140$226d0246@xhs.syqd >
Content-Description: forlorn.gif
Content-Location: 1_multipart%3F2_forlorn.gif
|
Posted By: tcrawford
Date Posted: 29 August 2006 at 4:25pm
|
Thanks for all the help, the keyword that you pm'd me worked great. I have one more question what percent do most of you set the Bayesian Filter Threshold at?
thanks a ton
|
Posted By: sgeorge
Date Posted: 29 August 2006 at 5:01pm
Glad to hear it.
My bayesian setup is a bit radical - I set it to 62%. I only do this because...
- I check my quarantine regularly... releasing false positives and tightening filtering rules - this should help to keep by bayesian corpus database strong
- I rarely get bayesian results that range between 15% - 85%
- The bayesian filter treats me well - I've only had a single time that this filter made a false-positive
...just fyi, of the spam I catch from bayesian, the majority of it scores +90%. I don't expect that I would fail to catch any more than 5 spam messages if I were to bump by bayesian threshold from 62% up to 85%, so the low value doesn't necessarily give me a huge advantage.
Stephen
|
|