How to block this one spam mail (Full Version)

All Forums >> [Web & Mail Security] >> GFI MailEssentials



Message

Zulan -> How to block this one spam mail (20.Sep.2005 1:44:00 AM)

Hi!

I am getting complaints from all over our office about this one spam mail that gets through everytime. I have sent a whole bunch of them to the bayesian filter but it doesnt take it. Keywords doesnt take since the mail differs everytime, but it looks exactly the same. Its really hard to explain. But here's my try. The email looks exactly like this in outlook:

VALIUM $3.75
Ambien
Cialis $1.21
Meridia
Ultram
Celebrex
VIAGRA $ 3.33
Propecia
Levitra
Xanax

http://www.neponetelis.com

But if I copy this mail and paist it to notepad, this is what it looks like:


V
A
C
M
U
C
V
P
L
XA
m
I
e
l
e
I
r
e
aL
b
A
r
t
l
A
o
v
nI
i
L
i
r
e
G
p
i
aU
e
I
d
a
b
R
e
t
xM
n
S
ia
m
rex
A
cia
ra
$3

$1

$3

.75

.21

.33


http://www.neponetelis.com

They change the spacings all the time and the change the webadress all the time. What can I do to block this?



mlevin -> RE: How to block this one spam mail (20.Sep.2005 4:15:00 AM)

Hello,

The only reliable information in that message is the URL of neponetelis.com

Use Spam URI Realtime Blocklist filter, and, if the following check does not show the neponetelis.com as listed:

http://www.rulesemporium.com/cgi-bin/uribl.cgi

use Keywords Checking, without "Match whole words", and add neponetelis.com as the General Keyword

Mikhail.



Zulan -> RE: How to block this one spam mail (20.Sep.2005 4:38:00 AM)

I have users that get like 30 emails like this a day, each time with a different URL [Confused]



Patrizia -> RE: How to block this one spam mail (21.Sep.2005 1:52:00 AM)

Zulan,

Please compress a number of such mails to a zip file and send them over to support@gfi.com for analysis. We will check further what can best be done to block these mails.



Zulan -> RE: How to block this one spam mail (21.Sep.2005 3:18:00 AM)

Thanks Patrizia, I have now sent an e-mail to support.



Page: [1]