[Mimedefang] Massive spam with randon subjects

Kayne Kruse Kayne at moranprinting.com
Fri Dec 19 16:56:21 EST 2003


> From: Marcelo Souza [mailto:mpsouza at centroin.com.br]
> Hi all,
> 
> 	Recently I notice a massive incoming messages with subjects like
> these:
> 
> Re: QCWGQOA, from the final
> Re: WEARJM, of the accusations
> Re: SSFE, never! a sudden
> Re: XEFJTNV, temple of truth
> Re: YOHKKWPN, offered her face
> Re: IAANWBC, what's this now?'
> Re: VE, this taletelling about
> 
> 	And some unwise spammer, show me part of the 
> construction method of
> the line:
> 
> Re: %RND_UC_CHAR[2-8], the two quarrelling
> 
> 	Some of you has build any filter or SA rule to catch it?
> 	Something like:
> 
> 	subject =~ /Re:\s\w{2,8},\s.{4-30}/
> 
> 	Seems to be arbitrary. Isn't it?
> 
> 
> 

I've just noticed this over the last few days, mostly because I called
action_quarantine_entire_message() in filter begin.  I doubt this has caught
all of them, but for what it's worth, I just dislike anything that writes
$SuspiciousCharsInHeaders and assume  I'd imagine lots of people caught this
since that part is part of the unmodified mimedefang-filter.

Kayne



More information about the MIMEDefang mailing list