Yahoo forum and Sexual Spam: need a filter!

Whether you're a MailWasher veteran or complete newbie, all users are welcome to get together. Discussions include usage and possible problems.
SillyBilly
Mystified Moa
Posts: 7
Joined: Fri Nov 14, 2008 10:56 am

Yahoo forum and Sexual Spam: need a filter!

Sun Dec 14, 2014 6:39 am

Hi
I am a member of a Yahoo forum which is being swamped with offensive spam. Since the yahoo adoption of their neo url the owner has had problems barring members and in fact cannot be sure they are real members. He also cant delete as spam. I usually have no problem creating filters and blacklists but have no success with this one. Could anyone spot something in the Full Header below that I could use?

Return-Path: <sentto-5946234-42742-1418447477-mail=xxxxx.fsnet.co.uk@returns.groups.yahoo.com>
Received: from mwinf5c15 (mwinf5c15 [10.223.111.65])
by mwinb3105 with LMTPA;
Sat, 13 Dec 2014 06:11:19 +0100
X-Sieve: CMU Sieve 2.3
Received: from ng3-ip5.bullet.mail.bf1.yahoo.com ([98.139.165.11])
by mwinf5c15 with ME
id StBJ1p0090F4dMe01tBJ2W; Sat, 13 Dec 2014 06:11:19 +0100
X-bcc: xxxxx@fsnet.co.uk
Envelope-to: mail@xxxxx.fsnet.co.uk
X-ME-bounce-domain: xxxxx.fsnet.co.uk
X-ME-engine: default
X-me-spamcause: (15)(0000)gggruggvucftvghtrhhoucdtuddrfeejiedrgeekgdekfecutefuodetggcurfhrohhfihhlvgemucfogfenuceurghilhhouhhtmecugedttdenucgoteeftdduqddtudculdduhedmnecujfgurhepgifvkffrihfhshggjehpjfffufhrtgesrgdtjhhptddtvdenucfhrhhomhepfdfjrghllhgvucfhlhhuugguuchmuhhlthhiphhlrghofihnvghrshesmhdrohgughgurghtihhnghdrtghomhculghmuhhlthhiphhlrghofihnvghrshgnfdcuoehmuhhlthhiphhlrghofihnvghrsheshigrhhhoohhgrhhouhhpshdrtghordhukheqnecuffhomhgrihhnpeihrghhohhordgtohhmpdifohhlihhsthhsrdgtohhm
X-me-spamlevel: not-spam
X-ME-Helo: ng3-ip5.bullet.mail.bf1.yahoo.com
X-ME-IP: 98.139.165.11
X-ME-Entity: ouk
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoogroups.co.uk; s=oscaro; t=1418447477; bh=Yt13Hw26dmpNWiBP4v2bgGspHv6wnadvYb0CKlw+rQ8=; h=To:From:List-Id:List-Unsubscribe:Date:Subject:Reply-To:From:Subject; b=cqBrYR+7HL/88TadY/2Ze6t4JY8E3mjdbGn57Fimy4EFvzs6XoYLZhoIanBEXNC4b24Th+9ehCPB3aNexSxwyaGzPTaMlQkhdMLMsJ6ayQbzDz70tiMGOGxBoxCWhZ5U45cPVyFOBBtytljevBiXx5f4LoumN6u1T/spvvTssZM=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=oscaro; d=yahoogroups.co.uk;
b=dN0CJ6gvxmqUJtIPN3RgdvMQfUJnkzyhjSpNuW03Ufr356BJtrmjVK5NPzu70xq5KOY8sKaNkjfT+lgTlMVkQpchOquDBZvGAZsz76hmZ/CiAPIVxffQ0ZAVPyyaqcq/j6OKadN0O0ztvxR/tA1Y90RPcnE2ig/rqwaZMTf2/B4=;
Received: from [66.196.81.183] by ng3.bullet.mail.bf1.yahoo.com with NNFMP; 13 Dec 2014 05:11:17 -0000
Received: from [10.193.85.17] by tg11.bullet.mail.bf1.yahoo.com with NNFMP; 13 Dec 2014 05:11:17 -0000
X-Yahoo-Newman-Id: 5946234-m42742
X-Sender: multiplaowners@m.odgdating.com
X-Apparently-To: multiplaowners@yahoogroups.com
X-Received: (qmail 38920 invoked by uid 102); 13 Dec 2014 05:11:17 -0000
X-Received: from unknown (HELO mtaq5.grp.bf1.yahoo.com) (10.193.84.36)
by m1.grp.bf1.yahoo.com with SMTP; 13 Dec 2014 05:11:17 -0000
X-Received: (qmail 23607 invoked from network); 13 Dec 2014 05:11:17 -0000
X-Received: from unknown (HELO mx2.m.odgdating.com) (98.138.215.82)
by mtaq5.grp.bf1.yahoo.com with SMTP; 13 Dec 2014 05:11:17 -0000
To: multiplaowners <multiplaowners@yahoogroups.co.uk>
Message-ID: <91237085ac2e710eb2445a2dfb232c05@mila.ammateu.com>
X-Priority: 3
X-Originating-IP: 198.50.139.153
X-Original-From: Halle Fludd <multiplaowners@m.odgdating.com>
From: "Halle Fludd multiplaowners@m.odgdating.com [multiplaowners]" <multiplaowners@yahoogroups.co.uk>
Sender: multiplaowners@yahoogroups.co.uk
MIME-Version: 1.0
Mailing-List: list multiplaowners@yahoogroups.co.uk; contact multiplaowners-owner@yahoogroups.co.uk
Delivered-To: mailing list multiplaowners@yahoogroups.co.uk
List-Id: <multiplaowners.yahoogroups.co.uk>
Precedence: bulk
List-Unsubscribe: <mailto:multiplaowners-unsubscribe@yahoogroups.co.uk>
Date: Sat, 13 Dec 2014 02:07:57 -0300
Subject: [Multipla owners] Hot girls and boys looking for casual encounters
Reply-To: multiplaowners@yahoogroups.co.uk
X-Yahoo-Newman-Property: groups-email-tradh-u
Content-Type: multipart/alternative;
boundary="b1_91237085ac2e710eb2445a2dfb232c05"

--b1_91237085ac2e710eb2445a2dfb232c05
Content-Type: text/plain; charset=us-ascii

Lot of sexy people looking for casual, no strings attach encounters... > http://wolists.com/g/262_90235_o081u/Good Luck, Have A Great Dating!


--b1_91237085ac2e710eb2445a2dfb232c05
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: 7bit





<head>

<style type="text/css">
<!--

/* start of attachment style */
.ygrp-photo-title{
clear: both;
font-size: smaller;
height: 15px;
overflow: hidden;
text-align: center;
width: 75px;
}
div.ygrp-photo{
background-position: center;
background-repeat: no-repeat;
background-color: white;
border: 1px solid black;
height: 62px;
width: 62px;
}

div.photo-title
a,
div.photo-title a:active,
div.photo-title a:hover,
div.photo-title a:visited {
text-decoration: none;
}

div.attach-table div.attach-row {
clear: both;
}

div.attach-table div.attach-row div {
float: left;
/* margin: 2px;*/
}

p {
clear: both;
padding: 15px 0 3px 0;
overflow: hidden;
}

div.ygrp-file {
width: 30px;
valign: middle;
}
div.attach-table div.attach-row div div a {
text-decoration: none;
}

div.attach-table div.attach-row div div span {
font-weight: normal;
}

div.ygrp-file-title {
font-weight: bold;
}
/* end of attachment style */
-->
</style>
</head>
<html><body>


<!-- |**|begin egp html banner|**| -->

<br><br>

<!-- |**|end egp html banner|**| -->


<div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><b> Lot of sexy people looking for casual, no strings attach encounters... <br>> <a href="http://wolists.com/g/262_90235_o081u/"> ... a><br>Good Luck, Have A Great Dating!</b></div>



<!-- |**|begin egp html banner|**| -->

<br>


<br>

<!-- |**|end egp html banner|**| -->


<div width="1" style="color: white; clear: both;"/>__._,_.___</div>





<div id="fromDMARC" style="clear:both; margin-top: 10px;">
<hr style="height:2px ; border-width:0; color:#E3E3E3; background-color:#E3E3E3;">
Posted by: Halle Fludd <multiplaowners@m.odgdating.com> <hr style="height:2px ; border-width:0; color:#E3E3E3; background-color:#E3E3E3;">
</div>
<!-- Start Recommendations -->
<!-- End Recommendations -->


<!-- |**|begin egp html banner|**| -->

<br><br>
<tt>
To unsubscribe from this group, send an email to:<BR>
multiplaowners-unsubscribe@yahoogroups.co.uk<BR>
<BR>
</tt>
<br><br>

<!-- |**|end egp html banner|**| -->



<!-- |**|begin egp html banner|**| -->

<img src="http://geo.yahoo.com/serv?s=97490503/gr ... 1418447477" width="1" height="1"> <br>

<!-- |**|end egp html banner|**| -->


<!-- |**|begin egp html banner|**| -->

<br>






<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #f2f2f2; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">

<span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; "><a href="https://uk.groups.yahoo.com/neo/groups/ ... Q0NzQ3Nw--" style="text-decoration: none;">Visit Your Group</a></span>

<ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
</ul>
</div>


<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
<a href="https://uk.groups.yahoo.com/neo;_ylc=X3 ... E4NDQ3NDc3" style="float: left;"><img src="http://l.yimg.com/ru/static/images/yg/i ... 137x19.png" height="19" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
<div style="color: #747575; float: right;"> &bull; <a href="https://info.yahoo.com/privacy/uk/yahoo ... tails.html" style="text-decoration: none;">Privacy</a> &bull; <a href="mailto:multiplaowners-unsubscribe@yahoogroups.co.uk?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> &bull; <a href="https://info.yahoo.com/legal/uk/yahoo/u ... tails.html" style="text-decoration: none;">Terms of Use</a> </div>
</div>

<!-- |**|end egp html banner|**| -->

</div> <!-- ygrp-msg -->




<br>

<!-- |**|end egp html banner|**| -->


<div style="color: white; clear: both;"/>__,_._,___</div>
</body></html>



--b1_91237085ac2e710eb2445a2dfb232c05--
dadto7
Student Sheep
Location: Phoenix, AZ
Posts: 16
Joined: Sun Sep 05, 2010 10:54 am

Re: Yahoo forum and Sexual Spam: need a filter!

Fri Mar 31, 2017 8:14 am

I started getting this spam also. What worked for me was a REGEX filter like "\d{8}\." without the quotes.
User avatar
rusticdog
Firetrust Monkey
Posts: 15864
Joined: Mon Jun 13, 2005 6:27 pm

Re: Yahoo forum and Sexual Spam: need a filter!

Fri Mar 31, 2017 11:58 am

That's a tough one, nothing immediately leaps out as being something you could reliably filter on. That said, Yahoo Group emails are quite long, 230 lines in this case, so be sure in MailWasher under Settings >> General >> Checking Mail >> you have MailWasher set to download a decent number of lines. Personally I'd go with 350.

This helps to ensure that when you train these emails as spam (but not blacklist) MailWasher will more accurately look at the words that matter, which helps for future detection.

Return to “Troubleshooting and Help for MailWasher 5 and 6”