A Credit Crunch Variation on a 419 Theme

I got this in the mail this morning. It is good to see the 419'ers are adapting
to the new world where people are out of work, or worried about work, or need
extra money. So what so you need right now? Thats right some fecking arsehole
of a con-main pretending to be from Virgin and offering you £1500 a month (at
least they got the currency right!)

[sarcasm]my faith in human nature is restored once again![/sarcasm]

Here are the headers

Return-path:
X-Modus-BlackList: 194.46.8.182=OK;Apollackiwan@kvhadvoc.nl=OK
X-Modus-Trusted: 194.46.8.182=YES
X-Modus-Audit: FALSE;0;0;0
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AtPnAOvrAEk9xlHzWmdsb2JhbACDVh4hA4NSAYFYh2GCQi8
X-IPAS: positive-out
Received: from adsl-195-098-012-192.dynamic.nextra.sk ([195.98.12.192])
*************** 24 Oct 2008 04:30:23 +0000
Message-ID: <000601c935dc$05bd9398$b2847380@vgisgqv>
From: "edvard boaz"
To: <****************nternet.com>
Subject: Apply for open job positions
Date: Fri, 24 Oct 2008 11:42:51 +0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2720.3000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300

and here is the message

Virgin.com

Looking for part-time job?

In 2008 Virgin became more global than ever before, because creating and capitalizing
on opportunities is about staying on the move.
We have a vacant position “Private Client Manager” in our team and will
be glad to have you work with us.

This is part-time job (2-3 hours a day, except holidays) and the position provides
support filling the transactions of our customers.
We deal exclusively with private clients with special requirements for high speed of
receiving funds for their business .
Consumers value the services we offer. What we do, helping people stay connected,
brings vitality to relationships.
And thinking responsibly for the company and the community is the anchor of how we do
business

Your work would be basic at first , yet thorough - you will make transfers for our
clients to suit their needs.
Our mangers will assist you during the trial period and explain everything you will
need to know.
We offer a competitive salary: for the first month you will get 1700 GBP for your
work,
the next month your salary will be increased if you do your work responsible and on
time.

Send us an e-mail to: <!-- Located Email Address --><a href="javascript:press_email('hrmanager.levinson@gmail.com')">hrmanager.levinson@gmail.com</a>

with phone numbers and time to reach you, and we will contact you and answer all your
questions.

Try us and you'll be glad you did!

Regards,
James Levinson
HR Manager,Virgin.com

What a TWONK!

Pleasantly Poetic Spam

It is not often you get a bit of spam where you look twice this one did. The bot that wrote this deserves a prize for pseudo creativity!


You are quite a Mephistopheles, Will--I say it to my sorrow.

Would that I were in your place.

Would that you were. Fifteen years ago I might have called the chance a magnificent one.

Now this is quite odd and it came (sorta) via Ed Brill's site

This arrived in my mail today, snuck in under the spam radar so to speak now normally I wouldn't even give this a second thought. But look were they found "my profile". Ed are you running a dating site now? If you are I prefer blondes ;-) Click to make it bigger.












PS I KNOW they just harvested my mail address and I should be more careful ;-)

Getting Spammed by an anti spam company

Got a bunch of emails today from a company called "untangle" ... which claims to be a spam filter which has caught some mail from me and that I should go and check it and release it.

A closer look at the "release" and "delete" links show they are pointing at https//10.12.10.11/... addresses.




The email header shows it originates from 217.205.42.35 which is registered to Ugam Solutions UK Ltd. which surprise surprise is a marketing company.

So here we have what is probably a decent anti spam product and some prawn in Marketing has thought .. we need to advertise! Lets get some marketing company to send 10,000s of pointless mails because we can reach a lot of people that way and it may not have been done before.. well it has and it is called SPAM and your company is trying to stop it.

I have never Heard of UNTANGLE
I have never until today visited the UNTANGLE site
I have never requested information from them
I NEVER tick the "send me information" boxes on web pages or register with marketing companies for "interesting newsletters". In fact two of the addresses this mail was sent to are totally fictitious addresses set up and published on a web page to act as spam magnet for web crawler bots and the mail sent to these accounts keeps our Bayesian filters current.

I hate sending to ABUSE@ addresses, because at best you get a form mail back and then nothing happens. So I have posted my surprise on there forums here. I await a response with interest

Patterns appear in our Bayesian Analysis of Spam

I have over the past three years being tailoring our in-house spam filter that sits on an SMTP gateway in-front of our domino servers. The filter uses Bayesian analysis of the message contents to to calculate a probability of any given message being Spam.

As I am sure you are all well aware the way this is done using PR(Spam|words) = Pr(words|spam)*Pr(spam)/Pr(words).

Particular words have particular probabilities of occurring in spam email and in legitimate email. For instance, most email users will frequently encounter the word "cock" in spam email, but will seldom see it in other email as our business is not chicken related. When we started the filter didn't know these probabilities so we got our users to place any junk mail into their JUNK folders. Once an hour a scheduled job awoke and reviewed the contents of each mail file's JUNK folder and their INBOXs and thus built up a data base of words along with the probability of any word being in a spam message. For all words in each training email both good and bad, the filter will adjust the probabilities that each word will appear in spam or legitimate email in its database. Over time our filter has learnt that for instance "volutptous" is very unlikely to be used in a mail concerning the electrical characteristics of a thermistor where as "capacitance" has an equally low probability of being a spam email.

Any email's spam probability is computed over ALL words in the email, and if the total exceeds a certain threshold (in our case 94.674%), the filter will mark the email as a spam. Email marked as spam is then quarantined for 2 weeks before being scrapped.

Once a month i have to check the database for any anomalies where a word I would consider to be OK picks up a skewed probability. For example "teenslut" should have a high probability and "dialectric" a low one. I have a table of know "good" words and their scores over time that i use to scan the main database and it flags up words with a value that I should be concerned about.

Recently I have noticed a pattern emerge...as some of the words change. This pattern appears to have been relatively constant for the past 12 weeks other than fact they exist I have no idea why they are there or why just these words and why just these numbers?

Word	Mon	Tue	Wed	Thu	Fri	Sat	Sun
Carbon	8	42	4	43	23	16	15
Magnet	15	42	8	4	43	23	16
Medical	16	42	15	8	4	43	23
Nuclear	23	42	16	15	8	8	43
Capacitance	43	42	23	16	15	4	4
Domino	4	42	43	23	16	15	8