Print Page | Close Window

Nigerian spam now using PDF's

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6739
Printed Date: 23 October 2017 at 5:38am


Topic: Nigerian spam now using PDF's
Posted By: WebGuyz
Subject: Nigerian spam now using PDF's
Date Posted: 20 August 2009 at 1:05pm
Getting spam with a simple message in body  like 'See the attached for more details' and there is a PDF attached with the same old Nigerian scams inside. Guess they caught up with technology.
 
Any chance of reading the contents of PDF's for the same blacklisted keywords we've always used to fight this type of spam?
 
Thanks!


-------------
http://www.webguyz.net



Replies:
Posted By: LogSat
Date Posted: 20 August 2009 at 6:02pm
Ouch... Actually that was possible until SpamFilter 4.1.2.810. Please see the release note below Ouch...


// New to VersionNumber = '4.1.2.810';
{TODO -cFix : Removed ability to scan for text and images in PDFs files due to instability of PDF library}


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: WebGuyz
Date Posted: 20 August 2009 at 8:22pm

Here is the content of the PDF. Look familiar?

Quote FROM THE DESK MR. LARRY MOSONGO.

RAND MERCHANT BANK

TEL: +27 733480908

FAX: +27 866588288

EMAIL: lrry_m@hotmail.com

ATTENTION: SIR/MADAM

STRICTLY CONFIDENTIAL

I know that you will be surprised to receive this letter. First and foremost, I apologize using this

medium to reach you for a transaction/business of this magnitude, but this is due to confidentiality

and prompt access reposed on this medium. Be informed that I obtained your enviable credentials/

particulars from the South African Export Promotion Council. I have decided to seek a confidential

co-operation with you in the execution of the deal described here under for the benefit of

both parties.

I am MR. LARRY MOSONGO, credit officer of Rand Merchant Bank South Africa. On October 6, 2005

an American consultant/contractor with South African Solid Mineral Corporation. Mr. David

Creanga made a fixed Deposit for Twelve calendar month valued at US$7, 350, 050.00 (Seven

Million Three Hundred and Fifty Thousand and Fifty United States Dollars only) in my branch.

Upon maturity I sent a routine notification to his forwarding address but no reply, after a month

we sent a reminder and finally we discovered from his contract employers the South African Solid

Mineral Corporation that Mr. David Creanga died in a fatal motor accident along Pretoria -

Johannesburg expressway and all attempts to trace his next of kin was fruitless .

I therefore made further investigation and discovered that Mr. David Creanga did not declare any

kin or relations in all his official documents including his bank deposit paperwork in my bank. This

sum of US$7, 350, 050.00 is still in my bank and the interest is being rolled over with the principal

sum at the end of each year.

No one will ever come forward to claim it, according to the South African foreign and defenses

affairs at the expiration of 5(five) years such funds will revert to the ownership of South African

Government for financing military operations such as arms purchasing and ammunitions for the

military.

In order to avert this negative development, I will like to seek for your permission as a foreigner to

stand as the next of kin to Mr. David Creanga so that the fruit of this old man's labor will not be

use for financing weapons which will further enhance the causes of war in the world in general.

The money will be paid into your account for us to share in the ratio of 60% for me and 40% for

you.

There is no risk at all as all the paperwork for this transaction will be done by my attorney and

with my position as the credit officer guarantees the successful execution of this transaction. If

you are interested please reply immediately. Upon your response, I shall then provide you with

more details that will help you understand the transaction. You should observe utmost

confidentiality and be rest assured that this transaction would be most profitable for both us

because I shall require your assistance to invest my share in your country.

PLEASE CONTACT ME ON MY PRIVATE EMAIL AND TELEPHONE WITH YOUR INFORMTION

NAME……………………………….

AGE……………………………….

ADDRESS ……………………………….

DIRECT PHONE……………………………….

MOBILE……………………………….

OCCUPATION……………………………….

COMPANY……………………………….

COUNTRY……………………………….

I will await your urgent response.

Kindly reply me through: lrry_m@hotmail.com

Thanks and regards

Mr. Larry Mosongo.

Copyright 2009 Rand Merchant Bank. All rights Reserved.

Rand Merchant Bank registration number: 1986/004794/06.

Authorized financial



-------------
http://www.webguyz.net


Posted By: yapadu
Date Posted: 21 August 2009 at 8:57am
The PDF scanner that WAS included with spamfilter did not allow us to run keywords against it anyway did it?  It used some super secret methods to determine if the PDF was spam or not.


Posted By: LogSat
Date Posted: 21 August 2009 at 1:21pm
Actually it did... SpamFilter was both scanning for images within the PDF files for spam-like content, and it was also using the list of keywords to scan for them within the PDF content as well.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP



Print Page | Close Window