[Mimedefang] Fw: [Sare-users] Spam with numbers in subj and b ody
Damrose, Mark
mdamrose at elgin.edu
Thu Jun 8 12:09:51 EDT 2006
> -----Original Message-----
> From: Kevin A. McGrail
> I'm aware that it marks any email that has digits in the
> body. My plan is to change it to {3,6} because my theory is
> that the number emails all have numbers greater than 3. If
> you or others have input on this fact, I'd like it to hear
> it. However, I have received very few of these emails though
> I have definitely tracked their passing on numerous servers.
It may be becoming a moot point, as they suddenly stopped here
yesterday morning.
However, I quarantined them all while they were coming in, and
every one that I got had either the number 969 or 5556.
Here's an example (e-mails munged).
Date: Tue, 06 Jun 2006 17:28:46 -0500
To: "Webmaster" <webmaster (at) elgin.edu>
From: "Webmaster" <webmaster (at) elgin.edu>
Subject: 57657
Message-ID: <fpbrsqkstlwrorhggko at elgin.edu>
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
<html><body>
5556
<br>
</body></html>
They all have identical To/From lines.
The real name matches the local part, with the first letter capitalized.
Content-Type and Content-Transfer-Encoding are also identical in all
messages.
There are 2 blank lines at the end.
Other than the 969 vs. 5556, the body does not vary at all.
More information about the MIMEDefang
mailing list