"Opera's revolutionary e-mail client"? - SpamAssassin

This is a discussion on "Opera's revolutionary e-mail client"? - SpamAssassin ; Hi folks -- this string has been cropping up a lot in the SOUGHT rules recently; it appears a spammer is using it: -- Using Opera's revolutionary [MUNGED] e-mail client: http://www.opera.com/mail/ (I added "[MUNGED]" in case you're using the ruleset ...

+ Reply to Thread
Results 1 to 6 of 6

Thread: "Opera's revolutionary e-mail client"?

  1. "Opera's revolutionary e-mail client"?

    Hi folks --

    this string has been cropping up a lot in the SOUGHT rules recently;
    it appears a spammer is using it:


    --
    Using Opera's revolutionary [MUNGED] e-mail client: http://www.opera.com/mail/


    (I added "[MUNGED]" in case you're using the ruleset in question

    Grepping my ham corpora, I find some hits from 2005 and 2006, but nothing
    in the past 2 years for this. Does anyone use recent builds of the "real"
    Opera mail? does it use this footer, or is it safe to list it in the
    rule?

    --j.


  2. Re: "Opera's revolutionary e-mail client"?

    On Tue, 2008-06-24 at 09:54 +0100, Justin Mason wrote:
    >
    > this string has been cropping up a lot in the SOUGHT rules recently;
    > it appears a spammer is using it:


    FWIW, my devel OPERA_MID_* rules are designed to trigger on these recent
    forgery.

    guenther


    --
    char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a \x10\xf4\xf4\xc4";
    main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}


  3. Re: "Opera's revolutionary e-mail client"?


    Karsten =?ISO-8859-1?Q?Br=E4ckelmann?= writes:
    > On Tue, 2008-06-24 at 09:54 +0100, Justin Mason wrote:
    > >
    > > this string has been cropping up a lot in the SOUGHT rules recently;
    > > it appears a spammer is using it:

    >
    > FWIW, my devel OPERA_MID_* rules are designed to trigger on these recent
    > forgery.


    the more the merrier!


  4. Re: "Opera's revolutionary e-mail client"?

    Justin Mason wrote:
    > Grepping my ham corpora, I find some hits from 2005 and 2006, but nothing
    > in the past 2 years for this. Does anyone use recent builds of the "real"
    > Opera mail? does it use this footer, or is it safe to list it in the
    > rule?


    I don't normally use Opera for email, but I use it regularly for web
    browsing. I just set up email on my copy of Opera 9.5 (the latest
    release), and hit Compose to see what would happen.

    The text you're seeing is the default signature.

    --
    Kelson Vibber
    SpeedGate Communications


  5. Re: "Opera's revolutionary e-mail client"?

    To follow up, here's a message actually sent from Opera 9.5 on Windows, in
    case someone wants the info for header analysis.

    And yes, I've changed the signature, partly so that it won't trip the rule
    in question.

    --
    Kelson Vibber
    SpeedGate Communications


  6. Re: "Opera's revolutionary e-mail client"?


    Kelson writes:
    > Justin Mason wrote:
    > > Grepping my ham corpora, I find some hits from 2005 and 2006, but nothing
    > > in the past 2 years for this. Does anyone use recent builds of the "real"
    > > Opera mail? does it use this footer, or is it safe to list it in the
    > > rule?

    >
    > I don't normally use Opera for email, but I use it regularly for web
    > browsing. I just set up email on my copy of Opera 9.5 (the latest
    > release), and hit Compose to see what would happen.
    >
    > The text you're seeing is the default signature.


    thanks for checking -- I'll whitelist that pattern then.


+ Reply to Thread