convincing spam from CNN
Quote from: Bob Anything with the x-pstn-xfilter: y header *is* marked as spam. The x-pstn-neptune-cave-rslt: qtine header on the other hand reduces the spam score by 20 (or resets it to 0) - this makes it far more likely to be identified as spam. Problem with some of these messages though is the fact that Postini is scoring them so high.
I get the impression from this thread and some of the tickets in our ticket pools that there are now less and less of these messages with the x-pstn-xfilter: y header
Yes, sorry Bob. The 'y' ones got through at the start but you reset things so they get caught now, didn't you! (It's still in my filter from before you changed it).
Re the 'qutine' ones, that's exactly what I was saying in my earlier post this morning, that they're being scored too high by Postini to end up in the Spam folders.
It's not all of them that are being scored too high, just a few, so I suppose it's something to do with what the included headlines are. All those that got through to the computer are identical - "Men say they've found a Bigfoot" and "The ugly side of beauty" as the two main 'stories'. I can't check if those that got caught were the same or different as I've deleted them all in webmail now!
Quote from: Bob I get the impression from this thread and some of the tickets in our ticket pools that there are now less and less of these messages with the x-pstn-xfilter: y header
"x-filter" historically appears to generally be a very short-term fix (that's short as measured in postini time mind you so usually around a week or two) and none of the most recent CNN spams I've received have had this header. Unfortunately, quite a few of them have had scores of 99.9% with perhaps the majority having scores between 50% and 90% so they just come sailing straight through. Most of them seem to use the previous days genuine CNN message as a template so are almost guaranteed to get high scores. I didn't get as many overnight as I was expecting but still a fair old few and I've not had my genuine CNN messages as yet either
Never mind, some more very nice vids in all the spammy messages to look at while I wait (*)BTW, as mentioned somewhere before, I've also had them allegedly from something@something.cnn.com (but clearly they're not of course) so filtering on !(something@something.cnn.com) wont necessarily work, it would have to be filtered against !(a_valid_CN_ip) rather than the much easier alleged from address. Incorporating the "GT1" filter in the test would quite probably do it without having to go the IP checking route tho because all the genuine CNN messages I have appear to trigger this category filter whereas the spammy ones (currently) do not.
How come I have some messages appearing to bypass neptune completely tho ?
(*) Yup, that's right, I've happily clicked and watched almost all of them at some time or another but fear not, no problem because Mr.Spammer is way too lazy to tweak all of the links to dodgy ones ! It's only those peeps viewing the dodgy html message that get caught out - any half-decent reader should probably reject the html as iffy anyway but as I only get to see the good old plain text version, all I get is the original genuine CNN message and could easily spot dodgy links if there were any so all is well
Micro$oft and html: making life easier for spammers/hackers almost since time began
Quote from: geewizz @4steve : Can't you just ban those people who click on spam mails from having internet access at their work?
I read the original comment as being, that he works for a computer repair place fixing computers for their clients. So the affected machines (of their clients) could be home users or businesses. Busnesses could pull the plug on their users internet access, but who'd do that for the home users? (who arguably are the worst culprits of propagating this mess!).
Maybe all internet users should be forced to pass an exam before being allowed to connect to the internet!
A lot of these sorts of problems could be solved by better education of the general public!
