[Mimedefang] Massive spam with randon subjects
Kayne Kruse
Kayne at moranprinting.com
Fri Dec 19 16:56:21 EST 2003
> From: Marcelo Souza [mailto:mpsouza at centroin.com.br]
> Hi all,
>
> Recently I notice a massive incoming messages with subjects like
> these:
>
> Re: QCWGQOA, from the final
> Re: WEARJM, of the accusations
> Re: SSFE, never! a sudden
> Re: XEFJTNV, temple of truth
> Re: YOHKKWPN, offered her face
> Re: IAANWBC, what's this now?'
> Re: VE, this taletelling about
>
> And some unwise spammer, show me part of the
> construction method of
> the line:
>
> Re: %RND_UC_CHAR[2-8], the two quarrelling
>
> Some of you has build any filter or SA rule to catch it?
> Something like:
>
> subject =~ /Re:\s\w{2,8},\s.{4-30}/
>
> Seems to be arbitrary. Isn't it?
>
>
>
I've just noticed this over the last few days, mostly because I called
action_quarantine_entire_message() in filter begin. I doubt this has caught
all of them, but for what it's worth, I just dislike anything that writes
$SuspiciousCharsInHeaders and assume I'd imagine lots of people caught this
since that part is part of the unmodified mimedefang-filter.
Kayne
More information about the MIMEDefang
mailing list