Skip to main content
Information Security

Return to Question

Post Closed as "too localized" by user10211, AJ Henderson, Iszi, Scott Pack, Rory Alsop♦
added 3235 characters in body
Source Link
Hot Licks
Hot Licks
  • 917
  • 7
  • 14

I don't pretend to understand this stuff, but here is some of the header info from a typical spam from today's flood:

Received: from adminteam ([203.123.157.82]) by na3sys009amx187.postini.com ([74.125.148.10]) with SMTP;
    Mon, 01 Apr 2013 10:47:16 CDT
Received: (qmail 3351 by uid 143); Mon, 1 Apr 2013 15:48:00 -0530
From: "No risk Katy Perry Free trials" <[email protected]>
To: <[email protected]>
Subject: Fwd: ..
Date: Mon, 1 Apr 2013 15:19:48 -0530
Message-ID: <005301ce2f1e$7ff59b90$7fe0d2b0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0052_01CE2F1E.7FF59B90"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acjhs69UR3NtbvBhPNkurEv2AtSBlw==
Content-Language: en-us
X-pstn-levels:     (S: 0.00000/66.47495 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-Bayes-Prob: 0.0001 (Score 0, tokens from: @@RPTN)
X-Spam-Score: 2.00 (**) [Tag at 3.80] HK_NAME_FREE,HTML_MESSAGE,SPF(none:0),RBL(rp-grey:1.0)
X-CanIt-Geo: ip=203.123.157.82; country=IN; region=25; city=Chennai; latitude=13.0833; longitude=80.2833; http://maps.google.com/maps?q=13.0833,80.2833&z=6
X-CanItPRO-Stream: 06202139 (inherits from 32_HI_TAG-LO_BLOCK,default)
X-Canit-Stats-ID: Bayes signature not available
X-Scanned-By: IEEE Spam Scanner (https://uce.ieee.org/) on 140.98.193.228

While here is some typical "legitimate" spam (that gets flagged by my mail forwarder):

From: "The New Yorker" <[email protected]>
To: <[email protected]>
Subject: ***[Possible UCE]*** =?utf-8?B?QXByaWwgOCwgMjAxMzogSGVucnkgQmxvZGdldDsgdGhlIHJpc2Ugb2YgVmljZSBNZWRpYTsgY29va2luZyBzaG93czsgYW5kIG1vcmUu?=
Date: Mon, 01 Apr 2013 22:31:44 +1000
MIME-Version: 1.0
X-Mailer: MailEnable
X-Priority: 3
Message-ID: <40efcf1c-741e-4e4e-b0ce-90fd5b422bc3.MAI@mail.realviewtechnologies.com>
Content-Type: multipart/alternative;
           boundary="--=_NextPart_01042013103144_006229358"
X-RVID: 101536031
X-pstn-neptune: 28/1/0.04/98
X-pstn-levels:     (S:30.17530/99.90000 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-Bayes-Prob: 0.9919 (Score 2.5, tokens from: @@RPTN)
X-Spam-Flag: YES
X-Spam-Score: 4.00 (****) [Tag at 3.80] HTML_MESSAGE,SPF(softfail:0),RBL(rp-mixed:1.5),Bayes(0.9919:2.5)
X-CanIt-Geo: ip=210.87.32.100; country=AU; region=07; city=Melbourne; latitude=-37.8139; longitude=144.9634; http://maps.google.com/maps?q=-37.8139,144.9634&z=6
X-CanItPRO-Stream: 06202139 (inherits from 32_HI_TAG-LO_BLOCK,default)
X-Canit-Stats-ID: Bayes signature not available
X-Scanned-By: IEEE Spam Scanner (https://uce.ieee.org/) on 140.98.193.228

It's curious that the spam score of this second is twice that of the first, and the Bayes probability (whatever that is) is near certainty, while for the first case it's essentially nil. Seems like somehow the first case was successfully eluding the spam filter.

(For what it's worth, the flood seems to have stopped.)

I don't pretend to understand this stuff, but here is some of the header info from a typical spam from today's flood:

Received: from adminteam ([203.123.157.82]) by na3sys009amx187.postini.com ([74.125.148.10]) with SMTP;
    Mon, 01 Apr 2013 10:47:16 CDT
Received: (qmail 3351 by uid 143); Mon, 1 Apr 2013 15:48:00 -0530
From: "No risk Katy Perry Free trials" <[email protected]>
To: <[email protected]>
Subject: Fwd: ..
Date: Mon, 1 Apr 2013 15:19:48 -0530
Message-ID: <005301ce2f1e$7ff59b90$7fe0d2b0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0052_01CE2F1E.7FF59B90"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acjhs69UR3NtbvBhPNkurEv2AtSBlw==
Content-Language: en-us
X-pstn-levels:     (S: 0.00000/66.47495 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-Bayes-Prob: 0.0001 (Score 0, tokens from: @@RPTN)
X-Spam-Score: 2.00 (**) [Tag at 3.80] HK_NAME_FREE,HTML_MESSAGE,SPF(none:0),RBL(rp-grey:1.0)
X-CanIt-Geo: ip=203.123.157.82; country=IN; region=25; city=Chennai; latitude=13.0833; longitude=80.2833; http://maps.google.com/maps?q=13.0833,80.2833&z=6
X-CanItPRO-Stream: 06202139 (inherits from 32_HI_TAG-LO_BLOCK,default)
X-Canit-Stats-ID: Bayes signature not available
X-Scanned-By: IEEE Spam Scanner (https://uce.ieee.org/) on 140.98.193.228

While here is some typical "legitimate" spam (that gets flagged by my mail forwarder):

From: "The New Yorker" <[email protected]>
To: <[email protected]>
Subject: ***[Possible UCE]*** =?utf-8?B?QXByaWwgOCwgMjAxMzogSGVucnkgQmxvZGdldDsgdGhlIHJpc2Ugb2YgVmljZSBNZWRpYTsgY29va2luZyBzaG93czsgYW5kIG1vcmUu?=
Date: Mon, 01 Apr 2013 22:31:44 +1000
MIME-Version: 1.0
X-Mailer: MailEnable
X-Priority: 3
Message-ID: <40efcf1c-741e-4e4e-b0ce-90fd5b422bc3.MAI@mail.realviewtechnologies.com>
Content-Type: multipart/alternative;
           boundary="--=_NextPart_01042013103144_006229358"
X-RVID: 101536031
X-pstn-neptune: 28/1/0.04/98
X-pstn-levels:     (S:30.17530/99.90000 CV:99.9000 FC:95.5390 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-status: off
X-Bayes-Prob: 0.9919 (Score 2.5, tokens from: @@RPTN)
X-Spam-Flag: YES
X-Spam-Score: 4.00 (****) [Tag at 3.80] HTML_MESSAGE,SPF(softfail:0),RBL(rp-mixed:1.5),Bayes(0.9919:2.5)
X-CanIt-Geo: ip=210.87.32.100; country=AU; region=07; city=Melbourne; latitude=-37.8139; longitude=144.9634; http://maps.google.com/maps?q=-37.8139,144.9634&z=6
X-CanItPRO-Stream: 06202139 (inherits from 32_HI_TAG-LO_BLOCK,default)
X-Canit-Stats-ID: Bayes signature not available
X-Scanned-By: IEEE Spam Scanner (https://uce.ieee.org/) on 140.98.193.228

It's curious that the spam score of this second is twice that of the first, and the Bayes probability (whatever that is) is near certainty, while for the first case it's essentially nil. Seems like somehow the first case was successfully eluding the spam filter.

(For what it's worth, the flood seems to have stopped.)

Tweeted twitter.com/#!/StackSecurity/status/318904208550154240
Source Link
Hot Licks
Hot Licks
  • 917
  • 7
  • 14

Is there a spam storm?

I realize this is a bit off-topic, but don't know where else to go to ask...

I've gotten an enormous amount of spam in the past 24 hours (hundreds), even after some relatively good spam filters. Virtually all of this stuff is hokey weight loss schemes, claimed to be forwarded from Beyonce, Pamela Anderson, et al. The email texts are quite varied, and the included links are to a number of different locations.

Is this something unique to my email address, or is there a general spam "storm" in the works? (Seems a little like the sort of childish stuff that spammers might do to "get even" for some of the recent policing actions.)