[Mimedefang] Fw: [Sare-users] Spam with numbers in subj and b ody

Damrose, Mark mdamrose at elgin.edu
Thu Jun 8 12:09:51 EDT 2006


> -----Original Message-----
> From: Kevin A. McGrail

> I'm aware that it marks any email that has digits in the 
> body.  My plan is to change it to {3,6} because my theory is 
> that the number emails all have numbers greater than 3.  If 
> you or others have input on this fact, I'd like it to hear 
> it.  However, I have received very few of these emails though 
> I have definitely tracked their passing on numerous servers.  

It may be becoming a moot point, as they suddenly stopped here
yesterday morning.

However, I quarantined them all while they were coming in, and
every one that I got had either the number 969 or 5556.

Here's an example (e-mails munged).

Date: Tue, 06 Jun 2006 17:28:46 -0500
To: "Webmaster" <webmaster (at) elgin.edu>
From: "Webmaster" <webmaster (at) elgin.edu>
Subject: 57657
Message-ID: <fpbrsqkstlwrorhggko at elgin.edu>
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

<html><body>
5556

<br>
</body></html>



They all have identical To/From lines.
The real name matches the local part, with the first letter capitalized.
Content-Type and Content-Transfer-Encoding are also identical in all
messages.
There are 2 blank lines at the end.

Other than the 969 vs. 5556, the body does not vary at all.



More information about the MIMEDefang mailing list