Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Help with subtle HTM attachments
  FAQ FAQ  Forum Search   Register Register  Login Login

Help with subtle HTM attachments

 Post Reply Post Reply
Author
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Topic: Help with subtle HTM attachments
    Posted: 10 February 2006 at 8:28am

All,

Yes, this is a long post but the question is short.  Below, in blue, is a system report that my monitor system sends me and it comes through, as expected, as an html attachment.

Below that is a SPAM message, in red, that also comes through as an html attachment and though I see the differance, I can't see an obvious way to detect it as SPAM.

Anybody have this one figured out and willing to share?


Subject: Mags Systems Day End Report
Date: Fri, 10 Feb 2006 00:00:01 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0035_01BE01C7.112C2CE0"
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <
null@mags.net>
X-SF-RX-Return-Path: <
null@mags.net>
X-SF-HELO-Domain: mx01

 

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.


------=_NextPart_000_0035_01BE01C7.112C2CE0
Content-Type: text/plain;
        charset="iso-8859-1"


The Attached HTML Report Re: Mags Systems Day End Report


------=_NextPart_000_0035_01BE01C7.112C2CE0
Content-Type: text/html;
        name="EMReport.htm"
Content-Disposition: attachment;
        filename="EMReport.htm"


<html><head>
<base href="
http://192.168.222.10:8080/">
</head><body bgcolor=#ffffff link=#000000 ALINK=#888888 vlink=#000000 topmargin=0 leftmargin=0 maginheight=0 marginwidth=0>
<style>
<!--
font { font-family: Arial, sans-serif, Helvetica; }
td { font-family: Arial, sans-serif, Helvetica; }
.tiny { font-size: 8pt; }
.medium { font-size: 10pt; }
a.nil:link { text-decoration: none; }
a.nil:visited { text-decoration: none; }
a.nil:active { text-decoration: none; }
//-->
</style><center>
&nbsp;<br>
<a name="h3E777BBA00000037"><table width=520 border=0 cellspacing=0 cellpadding=0><tr><td><font size=-1 class="medium"><b>Report Index</b><hr></td></tr>
<tr bgcolor=#eeeeee><td><font size=-2 class="tiny">
<a class="nil" href="#h3E777BBA00000033">Availability for Global (All Monitors)</a><br>
<a class="nil" href="#h3E777BBA00000034">Downtime for Global (All Monitors)</a><br>
<a class="nil" href="#h3E777BBA00000035">Failure Events for Global (All Monitors)</a><br>
<a class="nil" href="#h3E777BBA00000036">Response Time for Global (All Monitors)</a><br>
</td></tr><tr><td><font size=-1 class="medium"><hr></td></tr>
</table>
<p><a name="h3E777BBA00000033"><p><a name="h3E777BBA00000034"><p><a name="h3E777BBA00000035"><p><a name="h3E777BBA00000036"></body></html>

------=_NextPart_000_0035_01BE01C7.112C2CE0--

============================================================ ======

Subject: lNSTANT DOWNLOAD XP PR0, OFFICE 2OO3, PHOTOSHOP, AD0BE & MORE EXPENSlVE SOFTWARES speaking
Message-ID: <
c3svshmy3vogam@olywa.net>
MIME-Version: 1.0
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.3854.4748
Content-Type: multipart/related;
 boundary="--5MXZQ60E4L.O97NB.OX0RE6"
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <
shmy3vogam@olywa.net>
X-SF-RX-Return-Path: <
shmy3vogam@olywa.net>
X-SF-HELO-Domain: mx01

----5MXZQ60E4L.O97NB.OX0RE6
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit

sale fly evening suddenly friend. talked place my force? commit sense comes truly taught shook.
fail rose glad tears across. become proud better tears,
using few fancy cold. repeated pronunciation may six some, suddenly break conduct.
forty approach quarter sugar mentioned added. talked wife goodbye pleasure edge wife, studied love opposite ticket sense goodbye.
whos really allow very.

----5MXZQ60E4L.O97NB.OX0RE6
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 8bit

<html>
<head>
<meta http-equiv="Content-Type" content="text; charset=iso-8859-1">
</head>
<body>
<font color=64FF64 size=1>longer quietly taken opposite wood got, miserable miserable explain arm spent or, pretty words mistress evening whos fill.</font>
<center><table border=5 cellspacing=0 cellpadding=10 width=540 bordercolor=BEFC30>
<tr><td bgcolor=ffffff align=left>
<font size=1 face=arial color=000000><center>
<font size=4 color=2828FF><b>1nstant Download 0riginal Software At 0nly $29-$55<br><font color=D9D900 size=3>INSTANT D0WNLOAD ur Software & give you LICENSE instantly!<br><font color=B7B7B7>Fast Respond Customer Support To serve u Better</font></font></font></b></ center><br><font color=000000 size=2>Microsoft Windows XP Professional with SP2 Corporate Edition - $54.95<br>
Microsoft Office System Professional 2003 - $54.95<br>
Creative Suite Premium Edition v2.0 - $99.95<br>
Microsoft Office 2006 V.12 Beta - $54.95<br>
Adobe Photoshop Elements V.4.0 - $19.95<br>
Norton Systemworks 2006 - $39.95<br>
Autocad 2006 - $69.95<br>
Creative Suite 2 Premium MacOsx - $99.95<br>
Solidworks V.2006 - $99.95<br>
Macromedia Flash MX Pro V.8.0 - $49.95<br>
Adobe Audition V.1.5 - $24.95<br>
Adobe Acrobat 7.0 Professional - $44.95<br>
Autodesk Autocad Electrical V.2006 - $54.95<br>
Macromedia Dreamweaver V.8.0 - $49.95<br>
Adobe Photoshop CS2 9.0 - $54.95<br>
Autodesk Autocad Mechanical V.2006 - $54.95<br>
CloneDVD V.3.5.6.0 - $19.95<br>
Norton Internet Secuity 2006 - $29.95<br>
Symantec Norton Ghost 9.0 - $14.95<br> & 500+ more softwares to choose from proud south</font><br><br>
<center>
<a href=http://ca.geocities.com/kurt37877raimund16628/ target=_blank><font size=4 color=FF1C1C><u>six <b>CIick Here To Instant Down1oad</b> you</font></u></a><br>The site might slow on loading, Please All1ow 10-15 sec to load up<br>AOL 9.0 Users, Please Click "Show images & enable links" in Upper Right Corner<br><br></center></td></tr& amp; gt;</table><font color=64FF64 size=1>anybody welcome wanted morning, page ten or teacher science east. choose spoke busy ought everyone raise.</font>
</body>
</html>

----5MXZQ60E4L.O97NB.OX0RE6--

======================================================

Thanks in advance.8:24 AM 2/10/2006



Edited by Desperado
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
Dan B View Drop Down
Senior Member
Senior Member
Avatar

Joined: 09 February 2005
Location: United States
Status: Offline
Points: 105
Post Options Post Options   Thanks (0) Thanks(0)   Quote Dan B Quote  Post ReplyReply Direct Link To This Post Posted: 13 February 2006 at 11:48am

You could just block the URL address http://ca.geocities.com

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 13 February 2006 at 12:10pm

Dan B,

This was an example of one of many and the URL's are random.  It's the method of attaching that concerns me.

The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.309 seconds.