seriously anti-spam

As I was working on the abuse desk today, I found the following E-mail from a so called

Mrs Jasmine Barber <jas@barberfamily.com>

I am Mrs Jasmine A. Barber,suffering from cancerous ailment.I was married to Mr.Raymond Barber,my husband worked with Chevron/Texaco in the United Kingdom for twenty years before he died in the year 2003.My late husband deposited the sum of 5.3 Million (Five Million Three Hundred Thousand Pounds) with a Bank in United Kingdom.

Recently,my Doctor told me that I have limited days to live due to the stroke and cancerous problems I am suffering from. I have decided to donate this fund to you and want you to use this husbands effort to fund the upkeep of widows and charities worldwide.I took this decision because I do not have any child that will inherit this money and my husband relatives are bourgeois and very wealthy persons and I do not want my husband hard earned money to be misused.

Awaiting your urgent reply via my email.address: jasminebarber@qq.com With God all things are possible.

Your Sister in Christ,

Mrs Jasmine A. Barber

jasminebarber@qq.com

Since when QQ supports the mail address with names?
Thought I missed any changes, but after I checked the SMTP session, I am relaxed :)

SMTP session

[Contacting mx3.qq.com [184.105.206.82]...]
[Connected]
220 newmx31.qq.com MX QQ Mail Server
EHLO mx1.validemail.com
250 newmx31.qq.com
MAIL FROM:<>
550 Error: content rejected.http://mail.qq.com/zh_CN/help/content/rejectedmail.html.
MAIL FROM:<>
550 Error: content rejected.http://mail.qq.com/zh_CN/help/content/rejectedmail.html.
[Unfavorable reply code, cannot continue]
RSET
250 Ok
QUIT
221 Bye.
[Connection closed]
[Contacting mx2.qq.com [103.7.29.244]...]
[Connected]
220 newmx97.qq.com MX QQ Mail Server
EHLO mx1.validemail.com
250-newmx97.qq.com
250-SIZE 73400320
250 OK
MAIL FROM:<>
250 Ok
RCPT TO:<jasminebarber@qq.com>
250 Ok
RSET
250 Ok
QUIT
[Connection closed]

Anyway, pay attention on the mails you got!

blacklisting and the spam filter

I have been asked about the blacklisting and the spam filter recently.

Actually I am working on the topic of spam filters momentary at background.

I am pretty interested and trying to figure out which spam filters are used by whom for most important local ISPs.

SpamAssassin is a spam filter, widely used by middle and small ISPs, who haven’t developed their own filters, like the biggest local provider “webmail.co.za” in South Africa.

So, in my opinion, it’s not less important.

This filter stamps every mail with a score, normally a score less than 50 is qualified as non-spam.

The ISP can change a bit on the matrices to get a better control of the strictness for anti-spamming.

Barracuda is a blacklist as well as a filter.

As a blacklist, Barracuda is not as huge or important as Spamhaus, but we should not over see it.

In some countries, like India, Italy, the local providers look up this list to filter incoming emails.

So it is a so called filter deciding to receive or bounce.

As a spam filter (spam filter decides into inbox or spam folder. With the precondition, the mail is received by ISP), I haven’t seen often. So I suppose, it’s not so important.

Coremail

I heard about Coremail for a very long time. Coremail is the first platform in China made by Chinese for Chinese to solve the E-mail Marketing supports and services problems.

I don't know much about this ESP, but I am pretty sure, that this platform has been used most widest in China, by not only in business, for the big companies with big brands, but also govenment, schools and such important organisation. Typical :)

By any chance, I booked the newsletter of air china, who is sending emails over Coremail
The comfimationsemail looks ugly... only text, no any graphs at all

尊敬的会员：
您的知音卡号为XXXXXXXXXXX，开通邮箱作为国航知音网站的登录账户请点击以下地址 http://ffp.airchina.com.cn/user.action?method=addBindEmail&member=c2FpY29fbGVlQDE2My5jb20=&inmid=MS1IWUgzMFE= 进行确认。如果您在电子邮件中无法点击此地址，请将此地址复制到浏览器的地址栏中并回车确认。此邮件无需回复，如需与国航俱乐部联系，请发送邮件到ffp@mail.airchina.com.cn或拔打服务热线4006 100666。

The link was unavailable to be clicked from the mailbox.

If I check the header of this mail,

I actually expected to see the IPv6, no sign

Yohuu Google says Happy Birthday to me

12306 confirmation emails

12306 is the official homepage of "Sinorail Customer Service Center".

If you'd like to book a railway ticket for your next trip, you might just sign up and use their online ticket buying system.

The funny thing is, that lots of people have difficulties to get the confirmation email in their inbox after the registration.

It seems only the QQ Mailbox can solve this issue. see

Let's check the header to see what happens. I signed up with my netease mailaddress at 163.com.

12306 is straight using double opt-in, but they are not using any authentications, even don't set up a SPF record. What a shame!

the famous ROKSO list

The Register of Known Spam Operations (ROKSO) database collates information and evidence on known professional spam operations that have been terminated by a minimum of 3 Internet Service Providers for spam offenses. 


Spamhaus does not accept delisting requests for ROKSO records. In order to be delisted from ROKSO there must be a 6 month period with no spam traceable to the ROKSO entity. After that 6 months the list can petition for a review of the record. If the spam has stopped their record is retired. 

On the today's list, I saw the name of my collegue

Congratulations, Andreas! You did it :D

How to set up the feedbackloops at QQ

Basically, I don't want to put the stuffs about my work here.
Maybe it could be very helpful, so I am sharing it with you :)

First of all, you need an access, a so called QQ number. I don't care whereever you get it :P
Then go to the "abuse" page of QQ:  

http://open.mail.qq.com


For each of the domains you have, you need

1. The right to check out the postmaster address.

postmaster@domain.com

The confirmationsemail will be landed there.

2. To set up an Address for receiving the feedbacks

mailforfeedback@domain.com


After logging yourself in, choose the last tab,

click the bank,

and get into the monitoring page. Here you can add your domains by clicking this:

Once the FBLs have been set up, you will receive the emails including the original header of the complained "spam" from the ISP under the address:

feedbackloop@qq.com

Have fun and tell me how it works ^^