Print Page | Close Window

Gibberish messages getting through... HELP!!!

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=2652
Printed Date: 11 May 2025 at 2:42am


Topic: Gibberish messages getting through... HELP!!!
Posted By: Guests
Subject: Gibberish messages getting through... HELP!!!
Date Posted: 07 January 2004 at 10:53am

I am getting tons of these kinds of gibberish messages and have no apparent method of blocking them. The subject lines appear to be normal email subjects with a line of random characters prefixed or suffixed (eg. Re: UMPIIUAP, the study opened)

These are apparently coming from "good" servers !!!   Anybody got any suggestions?  I am running the current beta version

---------------------------
Sample Body as delivered
---------------------------

Free Cable_ TV

< http://www.550000x.com/cable/>" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.550000x.com/cable/> normalcy ammeter softball headphone

savonarola emblematic bromide aptitude bulblet breeze adolphus

incompletion gibberish dispense beribbon kajar

carbone inexplicit guarantee opacity curtain douse milton hertz

loquacious congratulate eventide mirage antonym wingmen cygnus cane

pedantic

 




Replies:
Posted By: Guests
Date Posted: 07 January 2004 at 12:52pm

These kinds of messages make me laugh... at the sender.

These are "last ditch effort" messages sent by spammers who are being blocked so effectively that they just can't get a message to go through any other way.  I remember reading an article a couple months ago.  The writer stated that, as anti-spam tools reach their maximum effectiveness, all spammers are being reduced to messages containing nothing but a link to a website.  Once spammers are reduced to this point, we (those of us battling this form of theft called spam) have won.

Theoretically, the message you posted would (eventually) be blocked by the statistical filtering version of SpamFilter that is in beta right now.  A message containing a combination of words such as "enblematic bromide aptitude bulblet" has a 99%+ probability of being spam.  This practice of putting gibberish words or even non-words in a message -- attempting to poison the Bayes corpus -- ends up actually working against the spammer.

But, for now, I wouldn't be too worried.  Spam is a form of advertising, and it doesn't take a neurosurgeon to figure out that an ad with the words"incompletion gibberish" within the text will have a zero response rate.  So desperate to get through anti-spam measures, they have created an "ad" that is so bad, nobody will respond to it.  Believe it or not, spammers DO care (at least the ones who are trying to stay in business) about response rates.  The response rates can be very low, but not zero... and this spammer is putting up a lot of zeros with this kind of ad.  This spammer will be put out of business by his/her own stupidity.



Posted By: Guests
Date Posted: 08 January 2004 at 2:34am

I took a little time tonight to research my own server's quarantine for messages like these.

It appears that both the dsbl and SpamCop blocklists have had some success with blocking these "Re: BYBBLOB, the collie smiled" type messages on our system.  You could include both of these blacklists in your RBL list and set-up SpamFilter to block or quarantine based on two blacklist hits... or take a more aggressive approach (one blacklist hit) if you're not too concerned about a very few false positives that the SpamCop list will generate.



Posted By: Desperado
Date Posted: 12 January 2004 at 2:17pm

All,

I have been having huge sucess with the following dnsbl's

site1=dnsbl.sorbs.net, true
site2=cbl.abuseat.org, true
site3=dnsbl.njabl.org, true
site4=sbl.spamhaus.org, true
site5=dnsbl.mags.net, true (This is our own ... DO NOT USE)

Dan S.

 




Print Page | Close Window