Spam that evades DCC

Gary Mills mills@cc.UManitoba.CA
Tue Sep 24 20:35:28 UTC 2002


Here's an example of spam that evaded the DCC counts.
How is this possible?  There were 275 entries in our sendmail
log for that day, all from the same IP address and with the
same envelope sender.  The sizes were all different, and each
was sent to a single recipient.  Here are some sample log entries:

Sep 21 15:55:26 electra sm-mta[19378]: [ID 801593 mail.info] g8LKtMnp019378: from=<kate_g12001@yahoo.com>, size=9956, class=0, nrcpts=1, msgid=<200209212055.g8LKtMnp019378@electra.cc.umanitoba.ca>, proto=SMTP, daemon=MTA, relay=[66.238.52.31]
Sep 21 15:58:59 electra sm-mta[21261]: [ID 801593 mail.info] g8LKwunp021261: from=<kate_g12001@yahoo.com>, size=9896, class=0, nrcpts=1, msgid=<200209212058.g8LKwunp021261@electra.cc.umanitoba.ca>, proto=SMTP, daemon=MTA, relay=[66.238.52.31]
Sep 21 16:00:38 electra sm-mta[21711]: [ID 801593 mail.info] g8LL0Znp021711: from=<kate_g12001@yahoo.com>, size=9943, class=0, nrcpts=1, msgid=<200209212100.g8LL0Znp021711@electra.cc.umanitoba.ca>, proto=SMTP, daemon=MTA, relay=[66.238.52.31]

I am still running DCC version 1.1.2.  Would the latest version
catch this guy?

---------- Forwarded message ----------
Return-Path: <kate_g12001@yahoo.com>
X-Sieve: cmu-sieve 2.0
Received: from yahoo.com ([66.238.52.31])
	by electra.cc.umanitoba.ca (8.12.3/8.12.3) with SMTP id
    g8LKwunp021261
	for <dianne_cox@umanitoba.ca>; Sat, 21 Sep 2002 15:58:57 -0500 (CDT)
Message-Id: <200209212058.g8LKwunp021261@electra.cc.umanitoba.ca>
From: "Kate" <kate_g12001@yahoo.com>
To: dianne_cox@umanitoba.ca
Date: Saturday, September 21, 2002  2:10 PM
Subject: I know where you've been...
X-Mime-Key: search words: suspensory dolman alclad matachina rhymeless deer
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_000_00E5_01C13B83.0D941E50"
Content-Class: urn:content-classes:message
X-DCC-UofM-Metrics: electra 1032; Body=1 Fuz1=1 Fuz2=1

If you're concerned about your privacy you must read this.

 Every time you use the Internet your system is picking up bits of data that allow anyone to find out where you've been and what you've been doing. Simply deleting your history files or cache only partially removes these records and does not protect you. There's nothing you could do to really protect your privacy - until now:

Now there's iClean, a powerful utility that can protect your privacy, increase your system performance, and prevent malicious websites from learning more about you. iClean removes all tracks of what websites you've visited and what files you've had open. iClean makes it impossible for anyone to discover your activities.

Click here and save 58% now!
http://4kewloffers.com.al@q1lij0uo.dyn.tj/go.php?id=1106I

Your computer will run better while your privacy is protected!
These tracks take up large quantities of valuable hard drive space and can cause your system to slow down, hang up, or even crash! iClean gets it back. You'll be amazed at how much hard drive space you recover every time you run iClean! Your system will run faster and smoother. You get the best of both worlds - added privacy and improved system performance

Act now and get a 50% increase in your web speed - FREE!
If you act now, you'll not only get iClean at this special savings, we'll also send you a copy of Internet Velocity FREE! Internet Velocity optimizes your Internet connection, and eliminates annoying pop-up ads and other unwanted intrusions. Internet Velocity speeds web surfing up to <b>50% faster on ANY connection - dial-up, cable, DSL!


Click here:Get iClean + Internet Velocity + <b>FREE shipping!
http://4kewloffers.com.al@q1lij0uo.dyn.tj/go.php?id=1106I

100% satisfaction guaranteed! Your satisfaction is guaranteed. If iClean doesn't perform like we say it will, let us know and we'll give you a complete refund, no questions asked!

Order your iClean / Internet Velocity bundle today and we'll ship it to you on CD with NO CHARGE for shipping and handling!

P.S. Don't wait! Act now and save on these two incredible products, which regularly sell for $59.98 at finer retail stores everywhere. But you must act now, because this is a limited time private introductory offer.

Click here and order today!
http://4kewloffers.com.al@q1lij0uo.dyn.tj/go.php?id=1106I

UNSUBSCRIBE HERE
If you no longer wish to receive emails from us, please  click here
http://4kewloffers.com.al@q1lij0uo.dyn.tj/go.php?id=1106R

Your privacy is important to us. Nothing will be done with your email address other than to remove it from our database. Please allow 3-5 business days for your name to be removed and no further messages will be sent.




















































































































search words: suspensory dolman alclad matachina rhymeless deer


----- End forwarded message -----

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.