SPAM: strange spam

Doug McGarrett

3 May 2006 3 May '06

04:50

Has anybody else been getting strange spam, consisting of a list of unrelated words, as if this was some kind of secret code? It seems like the "sender" is always in upper-case letters, and the "subject" makes no sense, like the words. How would one filter out something like this? (I don't think I can filter on case, since I am running Eudora on XP, and hope to be running it on Linux also. And I wouldn't know how, anyway.) I assume that it's some kind of porn operation. Look at the url it points to. (I'm not going to actually _look_ at the url.) This was supposedly sent by "PITTMAN BRYAN". Copy to my ISP--maybe they can get rid of it. I don't know if the offenders got my name from the list, or from somewhere else--something I Googled, perhaps. ********************************************************** free live cam site: http://www.2.livejasmin.com/ID=137 http://www.2.livejasmin.com/ID=137 eye teaching stamp beautiful trouble circle hard collar year iron leather userange plant driving peace brother angle chalk sugar fold bent gold cloud *********************************************************** --doug -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.1.385 / Virus Database: 268.5.1/328 - Release Date: 5/1/2006

Show replies by date

Peter Nikolic

3 May 3 May

07:43

New subject: [SLE] SPAM: strange spam

On Wednesday 03 May 2006 05:50, Doug McGarrett wrote:

...

Has anybody else been getting strange spam, consisting of a list of unrelated words, as if this was some kind of secret code? It seems like the "sender" is always in upper-case letters, and the "subject" makes no sense, like the words. How would one filter out something like this? (I don't think I can filter on case, since I am running Eudora on XP, and hope to be running it on Linux also. And I wouldn't know how, anyway.)

I assume that it's some kind of porn operation. Look at the url it points to. (I'm not going to actually _look_ at the url.) This was supposedly sent by "PITTMAN BRYAN".

Copy to my ISP--maybe they can get rid of it.

I don't know if the offenders got my name from the list, or from somewhere else--something I Googled, perhaps.

Hi .. In KMail it is easy to create filters to deal with this sort of thing - Settings-- Configure filters and follow your nose from there pick the action you want from the list and bingo .. very few if any of thoses get thru here and it's all done in KMail filters Pete . -- The Labour party has changed their emblem from a rose to a condom as it more accurately reflects the government's political stance. A condom allows for inflation, halts production, destroys the next generation, protects a bunch of pricks, and gives you a sense of security while you are actually being fucked. from GSM

Kevanf1

08:18

New subject: SPAM: Re: [SLE] SPAM: strange spam

On 03/05/06, Doug McGarrett wrote:

...

Has anybody else been getting strange spam, consisting of a list of unrelated words, as if this was some kind of secret code? It seems like the "sender" is always in upper-case letters, and the "subject" makes no sense, like the words. How would one filter out something like this? (I don't think I can filter on case, since I am running Eudora on XP, and hope to be running it on Linux also. And I wouldn't know how, anyway.)

I assume that it's some kind of porn operation. Look at the url it points to. (I'm not going to actually _look_ at the url.) This was supposedly sent by "PITTMAN BRYAN".

Copy to my ISP--maybe they can get rid of it.

I don't know if the offenders got my name from the list, or from somewhere else--something I Googled, perhaps.

**********************************************************

free live cam site: http://www.2.livejasmin.com/ID=137 http://www.2.livejasmin.com/ID=137

eye teaching stamp beautiful trouble circle hard collar year iron leather userange plant driving peace brother angle chalk sugar fold bent gold cloud

***********************************************************

--doug

Yes it's a porn site - I bit the bullet and looked. No, I didn't get excited...I must be getting too old :-( at only 43??? Anyway, that string of seemingly unrelated words is a classic spammers way of getting round certain filters. I don't know how it works but I did read about it not too long ago in a Linux comic - I forget which one. -- ============================================== I am only human, please forgive me if I make a mistake it is not deliberate. ============================================== PLEASE DON'T drink and drive it's not clever, it's just stupid. Kevan Farmer Linux user #373362 Cheslyn Hay Staffordshire WS6 7HR

Carlos E. R.

09:49

New subject: [SLE] SPAM: strange spam

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Wednesday 2006-05-03 at 00:50 -0400, Doug McGarrett wrote:

...

Has anybody else been getting strange spam, consisting of a list of unrelated words, as if this was some kind of secret code? It seems like the "sender"

By the hundreds. Not at all strange. Welcome to the nuisance. It's a method to try confuse learning type filters. They also put text gathered from fiction books (ie, not random). They may have an html part that contains the "real" spam, or load a .gif image with it - filters can not look at the image.

...

How would one filter out something like this? (I don't think I can filter on case, since I am running Eudora on XP,

By using SpamAssassin in linux :-P - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEWHy+tTMYHG2NR9URAhzDAJ9KAnhmHbdONJmgHW0NJl2qEhfHugCdETu8 Lb7hjfXm1jq4Tsk30FumPRc= =mmd9 -----END PGP SIGNATURE-----

Paul Cartwright

4 May 4 May

10:41

New subject: [SLE] SPAM: strange spam

On Wed May 3 2006 12:50 am, Doug McGarrett wrote:

...

Copy to my ISP--maybe they can get rid of it.

the way to do it is to view all headers ( in kmail anyway) view-headers-all then look for the first IP in brackets before the words HELO, like your message: Received: from [195.135.221.131] ([195.135.221.131]:38920 "HELO lists.suse.com") by lmg17.affinity.com with SMTP id S460265AbWECEuV; then go to Arin's WHOIS: http://www.arin.net/whois/ and plug it in and see who the owner is: in your case it shows as a RIPE site ( European), so you have to go to the RIPE whois site: http://www.ripe.net/whois in the case of this list, the owner is suse.de: person: Christian Deckelmann address: SuSE Linux AG address: Deutschherrenstrasse 15-19 address: D-90429 Nuernberg phone: +49 911 74053-0 fax-no: +49 911 7417755 e-mail: hostmaster@suse.de but normally there will be an ABUSE site listed for a domain, and you can send them an email, and if you live in the US you can also copy the federal abuse site: "uce@ftc. gov" -- Paul Cartwright Registered Linux user # 367800

Patrick Shanahan

5 May 5 May

20:51

New subject: [SLE] SPAM: strange spam

* Paul Cartwright [05-04-06 06:43]:

...

but normally there will be an ABUSE site listed for a domain, and you can send them an email, and if you live in the US you can also copy the federal abuse site: "uce@ftc. gov"

The address has been changed in the last few days to spam@uce.gov. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery2

Paul Cartwright

21:19

New subject: [SLE] SPAM: strange spam

On Fri May 5 2006 4:51 pm, Patrick Shanahan wrote:

...

* Paul Cartwright [05-04-06 06:43]:

...
but normally there will be an ABUSE site listed for a domain, and you can send them an email, and if you live in the US you can also copy the federal abuse site: "uce@ftc. gov"

The address has been changed in the last few days to spam@uce.gov.

please PLEASE don't ever quote my email address in a message again. I don't want to start another thread, just leave it alone. Yes, I also got a bounce when I sent a message to the old address, and I have since sent a few to the new one. -- Paul Cartwright Registered Linux user # 367800

François Pinard

21:25

New subject: [SLE] SPAM: strange spam

[Paul Cartwright]

...

please PLEASE don't ever quote my email address in a message again.

I did not follow the thread, but at least read out of context, this is an unreasonable demand. A lot of mail user agents quote email addresses routinely and automatically when replying. If you really do not want your email address to be known, do not use it. -- François Pinard http://pinard.progiciels-bpi.ca

Carlos E. R.

22:51

New subject: [SLE] SPAM: strange spam

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Friday 2006-05-05 at 17:25 -0400, François Pinard wrote:

...

I did not follow the thread, but at least read out of context, this is an unreasonable demand. A lot of mail user agents quote email addresses routinely and automatically when replying.

Most can be configured. MUAs should use the real name, not the address. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEW9betTMYHG2NR9URAhrJAJ91cVYf+WE1AarVrfyHEniaaDFfQgCeIGUC TlebYldOmLKRrySkx5Lzl/E= =p2PP -----END PGP SIGNATURE-----

Patrick Shanahan

21:53

New subject: [SLE] SPAM: strange spam

* Paul Cartwright [05-05-06 17:22]:

...

On Fri May 5 2006 4:51 pm, Patrick Shanahan wrote:

...
* Paul Cartwright [05-04-06 06:43]:

...
but normally there will be an ABUSE site listed for a domain, and you can send them an email, and if you live in the US you can also copy the federal abuse site: "uce@ftc. gov"

The address has been changed in the last few days to spam@uce.gov.

please PLEASE don't ever quote my email address in a message again. I don't want to start another thread, just leave it alone.

You would prefer that I don't quote it, but you don't mind doing it yourself? :^) In case you hadn't noticed, EVERYONE who posts to this list has their email address available. If you prefer it not available, mudge it in your posts. You can do it, the list only requires the correct envelope_from, not the "From:". -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery2

Carlos E. R.

22:55

New subject: [SLE] SPAM: strange spam

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Friday 2006-05-05 at 17:53 -0400, Patrick Shanahan wrote:

...

You would prefer that I don't quote it, but you don't mind doing it yourself? :^)

He means that you should use the real name, not the address, in the quotes and the salutation line, like I do above.

...

In case you hadn't noticed, EVERYONE who posts to this list has their email address available.

Yes, but the web archive doesn't put it in clear text. It just making it a bit more difficult for spammers to catch addresses automatically by searching webpages for the "@" character.

...

If you prefer it not available, mudge it in your posts. You can do it, the list only requires the correct envelope_from, not the "From:".

Unfortunately, only mutt can do that. I would, if I could. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEW9fktTMYHG2NR9URAoewAJ47/En7bxT48hLkkJ0Cliy24bno3gCfTAui R/HPtX9YmwxDd/yEfQmZHPE= =76nB -----END PGP SIGNATURE-----

François Pinard

23:18

New subject: [SLE] SPAM: strange spam

[Carlos E. R.]

...

[Patrick Shanahan]

...

...
If you prefer it not available, mudge it in your posts. You can do it, the list only requires the correct envelope_from, not the "From:".

...

Unfortunately, only mutt can do that. I would, if I could.

Before Mutt, I was using Gnus, which is able to do so as well. And I'm sure many other mailers have this capability. I'm surprised by "I would, if I could.". "I would, if I wanted." may be closer to the truth: you may use Mutt, don't you? :-) P.S. - I'm kidding a bit, of course. I understand you do not feel like switching to another mail user agent, but you have to bear your choices. Keep happy, all! -- François Pinard http://pinard.progiciels-bpi.ca

Carlos E. R.

6 May 6 May

10:39

New subject: [SLE] SPAM: strange spam

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Friday 2006-05-05 at 19:18 -0400, François Pinard wrote:

...

...
Unfortunately, only mutt can do that. I would, if I could.

Before Mutt, I was using Gnus, which is able to do so as well. And I'm sure many other mailers have this capability.

I don't know any. I looked.

...

I'm surprised by "I would, if I could.". "I would, if I wanted." may be closer to the truth: you may use Mutt, don't you? :-)

My sentence above had double meaning: I would use the envelope from trick, if I could, and/or that I would (perhaps) use mutt, if I could. I tried mutt. No go. Not user friendly. Pine you can learn as you go. Mutt neads reading a manual. My saying: "good user's programs (GUI or TUI) do not require reading a manual before using them". :-P

...

P.S. - I'm kidding a bit, of course. I understand you do not feel like switching to another mail user agent, but you have to bear your choices.

I know. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEXHzxtTMYHG2NR9URAsSCAJ93MLCPP+WgGEcgUV4PHGIuqsS9KQCfSmVK roPok/Wm8BhCnr/vte3ZCvM= =EO3I -----END PGP SIGNATURE-----

François Pinard

12:58

New subject: Good programs [was: SPAM: strange spam]

[Carlos E. R.]

...

I tried mutt. No go. Not user friendly. Pine you can learn as you go. Mutt neads reading a manual. My saying: "good user's programs (GUI or TUI) do not require reading a manual before using them".

I quite understand the desire (or dream) that UI design replace the need of reading traditional documentation. Pushed to its extreme, some will even prefer Microsoft Windows to SuSE Linux! :-) However, in my relatively long experience with computers, and despite there are exceptions, UI only programs (those not needing manuals) have a lot of chrome over pretty weak engines, and if there is no manual, this is only because there is not much to say. For me, a "good program" on the user standpoint is one that represent an opening on a field of activity (or a field of science, if you are so-inclined), that is, something that you may start with and that will be with you for quite a while, along your journey of discovery. A program who superficially appears to be good because users have the feeling they learned it quickly (often because there is nothing to learn), represent more a closing than an opening. They define a short-term horizon in which the user, knowingly or not, will be held captive for years. These should be the ones making you say "No go", because deep down, they do not lead you anywhere far from where you already are. For one, I'm ready to read and even scrutinize manuals, lots of them. It is really, _really_ worth the effort. Many programs I find on the SuSE distributions (and elsewhere) are wonders, which I would not be able to appreciate without their documentation. For example, one may use Emacs or Vim as editors, or Gimp or Blender for graphical work say, without ever reading any manual about them, but they then miss big. It's true I'm irritated that Mutt does not give me scroll bars and does not obey to the mouse wheel. But it has many other virtues, and has been _so_ useful to me, that I'm ready to suffer the irritation. Dropping Mutt, seduced by some half-empty chrome, would not be wise. It would be a bit like, for a men, sacrificing a family and a life, for a 2-weeks superficial affair with a temporarily attractive women :-). -- François Pinard http://pinard.progiciels-bpi.ca

Carlos E. R.

14:21

New subject: [SLE] Re: Good programs [was: SPAM: strange spam]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Saturday 2006-05-06 at 08:58 -0400, François Pinard wrote:

...

[Carlos E. R.]

...
I tried mutt. No go. Not user friendly. Pine you can learn as you go. Mutt neads reading a manual. My saying: "good user's programs (GUI or TUI) do not require reading a manual before using them".

I quite understand the desire (or dream) that UI design replace the need of reading traditional documentation. Pushed to its extreme, some will even prefer Microsoft Windows to SuSE Linux! :-)

However, in my relatively long experience with computers, and despite there are exceptions, UI only programs (those not needing manuals) have a lot of chrome over pretty weak engines, and if there is no manual, this is only because there is not much to say.

Sorry, but I dissagree. I have installed and used probably thousands of programs. There are those programs that do a lot of complex things and require a manual. There are those programs designed for Joe User, with a good user interface that allows the user to learn as he goes, at least some of the way (example OOo). Those programs may have a lot more behind that needs reading the manual, but I label those programs with a GUI or TUI that require reading the manual upfront as "bad programs", of if you prefer, programs with a bad graphical/text user interface. IMO, of course. It is a requirement for good programs to have a good UI. Not the only requirement, but it is a requirement, nevertheless. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEXLDRtTMYHG2NR9URAuWCAJ4zHKgC7ou8o13pfBsDVHEPadFJPwCfRqam MFInjAeQ7T+L/nk3FJDOU6c= =I34J -----END PGP SIGNATURE-----

Paul Cartwright

5 May 5 May

23:40

New subject: [SLE] SPAM: strange spam

On Fri May 5 2006 5:53 pm, Patrick Shanahan wrote:

...

...
...
* Paul Cartwright [05-04-06 06:43]:

You would prefer that I don't quote it, but you don't mind doing it yourself? :^)

note, I put a FAKE address in there, you didn't catch the ponderosa.ranch??

...

In case you hadn't noticed, EVERYONE who posts to this list has their email address available. If you prefer it not available, mudge it in your posts. You can do it, the list only requires the correct envelope_from, not the "From:".

I told you i didn't want to start a new thread, nuff said,bah bye. -- Paul Cartwright

Vince Littler

6 May 6 May

08:19

New subject: [SLE] SPAM: strange spam

On Friday 05 May 2006 22:19, Paul Cartwright wrote:

...

On Fri May 5 2006 4:51 pm, Patrick Shanahan wrote:

...
* Paul Cartwright [05-04-06 06:43]:

...
but normally there will be an ABUSE site listed for a domain, and you can send them an email, and if you live in the US you can also copy the federal abuse site: "uce@ftc. gov"

The address has been changed in the last few days to spam@uce.gov.

please PLEASE don't ever quote my email address in a message again. I don't want to start another thread, just leave it alone.

Yes, I also got a bounce when I sent a message to the old address, and I have since sent a few to the new one.

-- Paul Cartwright Registered Linux user # 367800

Sorry about this Paul. He insists on doing it, I have been complaining about him doing it to me for years, but he just carries on. In the early days, people used to say that your email address could be scraped from anywhere, not necessarily the archives. I have even posted some quite conclusive evidence that spammers are scraping from the archives, but nowadays, people just tell you to accept it as a 'fact of net life'. Last time Mr Shanahan posted my email, he indicated that he was doing it deliberately. I think that it is just plain antisocial to knowingly expose fellow list members' email addresses to the low grade criminals who run spamming operations. Others have suggested that he reconfigure his mail client, but he resists that. He also complains if noobs top post or hijack threads, because he believes in netiquette. I have very little doubt he will contrive to post some reply to this, just to get my email address into the archives again.

Peter Nikolic

10:21

New subject: [SLE] SPAM: strange spam

On Saturday 06 May 2006 09:19, Vince Littler wrote:

...

On Friday 05 May 2006 22:19, Paul Cartwright wrote: He also complains if noobs top post or hijack threads, because he believes in netiquette.

I have very little doubt he will contrive to post some reply to this, just to get my email address into the archives again.

I have no comment on the first part of this post other than to say that if your email address worries you that much then do as i do i have 1 address for this list another address for other things then if one bugs you just can it end of problem . BUT .. Top posting is a NO NO cant people get it into there heads .. And Blatant thread hijacking should be treated with the contempt it deserves total and utter contempt -- The Labour party has changed their emblem from a rose to a condom as it more accurately reflects the government's political stance. A condom allows for inflation, halts production, destroys the next generation, protects a bunch of pricks, and gives you a sense of security while you are actually being fucked. from GSM

6571

Age (days ago)

6574

Last active (days ago)

List overview

Download

17 comments

8 participants

participants (8)

Carlos E. R.
Doug McGarrett
François Pinard
Kevanf1
Patrick Shanahan
Paul Cartwright
Peter Nikolic
Vince Littler