[antispam-f] Re: New spam technique

  • From: Harriet Bazley <lists@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
  • To: antispam@xxxxxxxxxxxxx
  • Date: Wed, 04 Oct 2006 23:59:35 +0100

On 4 Oct 2006 as I do recall,
          Steven Pampling wrote:

> On 04 Oct, Harriet Bazley <lists@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > A new type of spam is making its way past Antispam - and past
> > Spamstamp's subsequent filtering - by posing as mailing list traffic:
> [Snip]
> > I assume this is a mailing list that doesn't even *exist*;  it's
> > certainly not one I'm subscribed to!
> Doesn't really matter. If you use mainly whitelists and all the mailing
> lists tend to have a subject line with a particular marker (like
> [antispam-f] in this case) so doing an accept on that normally works.

I've always used
Accept List-Id: = **
Accept Mailing-List: = **
in order to save having twenty or so separate rules (and having to
remember to add a new one if I subscribe to a new group), but clearly
they've cottoned onto this technique.   :-(

> All other traffic set to DEFER and use the marking facility - not had
> *anything* get past that in I don't know how long.

I've got it set to header anything over 5000 bytes, on the grounds that
for e-mail under this size, it's actually slower to download the header
twice than to download the whole thing by default and then discard it -
and more work for me to mark them than it's worth (if Spamstamp gets
them then I don't have to read their revolting little subject lines).
So I suppose the fact that I'm getting a dozen or so small spams
slipping through the net every day this week isn't actually costing me
very much in download time.   :-)

One thing I have just noticed is that all these fake mailing list spams
have the string "Apple Message framework" in their Mime-Version header,
and a header "Received-SPF: pass (<domain>: local policy)" which normal
messages don't seem to have;  I don't get a lot of e-mail from Mac users
to check against.   How common are these headers?   I can't find any in
any of my mailing lists with a Mime-Version of anything other than

Harriet Bazley                     ==  Loyaulte me lie ==

No man has a right to live - but every man has a duty to save him if he can

Other related posts: