Stock Alert Spam

[Big_M]

Our receptionist at work is getting several 'stock alert' spam emails that appear to be getting through our spam filter. They seem to be quite sophisticated and use bogus reply addresses. The content is scanned text sent as a picture attachment.

I have googled the problem and no one seems to offer a solution but it looks like the American Gov is investigating and emails should be forwarded to [e-mail]

Anyone else got any experience of these?

[__lee__]

Have you checked the headers to see if they are being sent from the same server?

[Jinx]

Been getting them on my Yahoo account plus my works email (though this is more understandable as it appears on my works website) - though yahoo does automatically dump them in the bulk folder. Must admit that I haven't bothered with a solution as they appear harmless enough and with titles such as "devious possee" I'm not going to inadventantly open any of them.

[Big_M]

__lee__ said:

Have you checked the headers to see if they are being sent from the same server?

Yep checked - different server everytime

[JamieBeeston]

just add the 'stock' in question to your spam filter.

Stops it dead (until they change to a new stock.. then repeat)

J

[aldi]

SpamAssassin's picking up quite a lot of these.

[billb]

yep getting loads of them in web mail and filtered work mail

[zumbruk]

JamieBeeston said:

just add the 'stock' in question to your spam filter. Stops it dead (until they change to a new stock.. then repeat)

That's what I thought. Then I wondered why it didn't work. Then I looked at the source of the emails - they're an inline MIME encoded bitmap of text, not actual text. Cleverer mail readers automatically unpack and display the bitmap.

Doubtless there's some way of spotting them by the MIME headers, but I haven't worked out what it is yet, and I have more urgent things to fix right now.

[Carrera2]

We're getting these to all mail addresses on our domain. Pain in the arse.

[UncleDave]

Same here... very annoying

[_dobbo_]

This highlights the problem with content based spam filtering. For as long as you make filters to block particular content, SPAMmers will simply adjust their email to circumvent these. In the meantime the system admin wastes time trying to filter these, and staff waste time deleting them...

Anti-Spam technology is moving (in some cases has moved) to other mechanisms of blocking junk mail - such as detecting and analysing global patterns in the delivery of mail, and blocking the stuff that is clearly SPAM.

I believe a few vendors implement this, our next version of our software will include this and I'm seeing a 99.8% detection rate on my accounts, I used to get about 150 spams a day, now I get about 1 a week. Lovely!

[Big_M]

This is the header for one of the mails - IP shows a Buenos Aires base, but probably re-routed.

Return-Path: <[e-mail]>
Delivered-To: 292-mail@*************.co.uk
Received: (qmail 71511 invoked from network); 1 Jun 2006 14:05:30 +0100
Received: from host204.200-43-86.telecom.net.ar (200.43.86.204)
by *********.com with SMTP; 1 Jun 2006 14:05:28 +0100
Received: from utc.tk ([200.43.223.42])
by host204.200-43-86.telecom.net.ar (8.13.3/8.13.3) with SMTP id k51DJksp028824;
Thu, 1 Jun 2006 10:19:46 -0300
Message-ID: <001a01c6857d$fafae2f2$[e-mail]>
From: "Mark Ware" <[e-mail]>
To: <mail@***********.co.uk>
Subject: eyesore
Date: Thu, 1 Jun 2006 10:16:36 -0300
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0016_01C68564.D5ADAA8A"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1441
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441

This is a multi-part message in MIME format.

------=_NextPart_000_0016_01C68564.D5ADAA8A
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0017_01C68564.D5ADAAA4"


------=_NextPart_001_0017_01C68564.D5ADAAA4
Content-Type: text/plain;
charset="windows-1252"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_001_0017_01C68564.D5ADAAA4
Content-Type: text/html;
charset="windows-1252"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dwindows-1252">
<META content=3D"MSHTML 6.00.2800.1441" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2><IMG alt=3D"" hspace=3D0=20
src=3D"cid:001501c6857d$fafae270$[e-mail]" align=3Dbaseline=20
border=3D0></FONT></DIV>
</BODY></HTML>

Only getting a couple a day but the subject titles are very clever - not your obvious spam type headings.

[mcflurry]

I looked up a couple of these stocks. The last one they "recommended" fell from USD3 to USD1.5 within 2 days of the email arriving...

[simpo two]

I get a lot of these.

You can either delete them, which takes a few seconds, or fret over how to stop them which will take hours

[Scraggles]

www.dnsstuff.com/tools/whois.ch?ip=200.43.223.42

fretting for hours ? right...

I also use spamcop to report them and confirm manual abuse reports work from time to time

[cptsideways]

Scraggles said:

www.dnsstuff.com/tools/whois.ch?ip=200.43.223.42 fretting for hours ? right... I also use spamcop to report them and confirm manual abuse reports work from time to time

WHOIS results for 200.43.223.42
Generated by www.DNSstuff.com
Location: Argentina

ARIN says that this IP belongs to LACNIC; I'm looking it up there.


Using 0 day old cached answer (or, you can get fresh results).
Displaying E-mail address (use sparingly -- this will make it more likely that you will trigger our rate limiting system).


% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries


% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2006-06-03 05:25:32 (BRT -03:00)

inetnum: 200.43.223.0/25
status: reallocated
owner: Cotelvo Ltda.
ownerid: AR-COLT1-LACNIC
responsible: Yaccuzzi Dina Viviana
address: Belgrano, 1268, p.b.
address: 3580 - Villa Ocampo (Santa F&#39520;-
country: AR
phone: [phone] [/337]
owner-c: COL
tech-c: COL
created: 20030827
changed: 20030827
inetnum-up: 200.43/16

nic-hdl: COL
person: COTELVO LTDA
e-mail: [e-mail]
address: Belgrano, 1268,
address: 3580 - Villa Ocampo - SF
country: AR
phone: [phone] []
created: 20030822
changed: 20030822

% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.


Is the ****ard that's been sending them then? or a clever way to hide where it came from?? the details include a phone number & address

[_dobbo_]

cptsideways said:

Is the ****ard that's been sending them then? or a clever way to hide where it came from?? the details include a phone number & address

Nope, this is the telco of the B-start that's been sending them. You could send an abuse report to [e-mail] and include the headers, but trust me, doing that for every spam you get is not the way to spend your time. Work smarter not harder

[dieselnut]

Spamassassin's your man. Gives you a response such as this below, I've set my spam "threshold" at 5... low enough that I'm not letting too much spam through, and high enough that I'm not missing important mail,

Any spam's thrown to one side into another folder for later viewing.

We run this system at work infront of our exchange systems, which has chopped spam:real email down from 99% to about 2%

Once someone's listed it in spamcop (as previously mentioned) then it gets a high weighting and never comes through again... so you only tend to see the same spam once

The report below is someone offering me drugs to enhance my manhood.. the bit I like is it notices deliberate mis-spellings of words, and notices that the email is just an image with little text...



----------------------------
Content analysis details: (28.9 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry
0.5 FUZZY_CPILL BODY: Attempt to obfuscate words in spam
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
3.1 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
3.2 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS records
1.6 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: thronemy.com]
4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: thronemy.com]
2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: thronemy.com]
4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: thronemy.com]
2.4 DRUGS_ERECTILE_OBFU Obfuscated reference to an erectile drug
0.5 DRUGS_ERECTILE Refers to an erectile drug
0.9 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

[aldi]

dieselnut said:

(28.9 points, 5.0 required)

Go on then... what's your high score

[Saabyfox]

Have a look on the www.ironport.com site regarding these Stocks and Shares emails.

Some spam engines work by analysing and identifying the message body ( Brightmail/ Ironport filters/ DCC etc).
The stocks and shares spam emails have been very clever as they have been randomly changing ONE pixel in the image so that the message bodies change every time. Traditional spam engines looking for text are a waste of time, as these emails contain NO standard text.

Personal spam filters will have alot of trouble identifying these ( as they try and match header information ) , that is why reputation filters such as used by Ironport/Senderbase and Sophos with their new Email Appliance are far superior to content scanning or bayesian filter spam engines- essentially they dont care what is in the message, but actually where it came from in the first place.

In a corporate world, IMHO , and with money no object, Ironport beats any other Email gateway by far.

Sorry if this sounds like an advert, but this is what i install and support most days.....
(Ironport/Sophos/Clearswift engineer)