SlideShare ist ein Scribd-Unternehmen logo
1 von 46
Downloaden Sie, um offline zu lesen
Statisztikai spamszűrők
Hatékony védelem a spam ellen




   Sütő János (sj@acts.hu)
Graham - Plan for spam
Dekódolás, tokenekre bontás
Valószínűség és érdekesség
Döntési mátrix felépítése

   enhanced+libido 0,9999
   Subject*impress 0,9934
   triples         0,9311
   absolutely      0,8933
Statisztikai összegzés

       HAM       ???         SPAM




0%                     91%      100%
Token adatbázis
Tanítás
Tanítás mennyisége vs. idő
Pontosság vs. idő
Fehérlista

0. SQL táblában tárolt minták

1. Név, email, domain, IP-cím, FQDN

2. „From:” sor alapján
Csapda email cím + aknamező =
    intelligens feketelista
„Nehéz pontosan meghatározni
    a határértéket . . .”

           “...Ha túl magas, akkor
           kevés spamet ismer fel,
           ha túl alacsony, akkor
           sok jó levelet is elve-
           szítünk.”
Valószínűség eloszlás




Forrás: http://spambayes.sourceforge.net/images/chi2_graph.png
A szakértő megmondja
          „Egy embernél jól
          működhet, de 10000-
          nél már nem”

          „... később komoly
          csalódás éri a té-
          ves biztonságérzetű
          felhasználót”

          „A spammerek legú-
          jabb trükkjeit nem
          ismeri fel”
„A Bayes-alapú
technológiák
megbízhatósága
kétséges, két-
ségbe vonható”
Mikro/piko spam
Return-Path: <vpwwcomrigvri@yahoo.com>
X-Original-To: sj@xxxx.hu
Received: from av-engine (localhost [127.0.0.1])
        by xx.xxxx.hu (Postfix) with SMTP id E04CC17013
        for <sj@xxxx.hu>; Mon, 21 Jul 2008 04:38:58
Received: from 194.xx.xx.xx (unknown [58.248.77.145])
        by xx.xxxx.hu (Postfix) with SMTP id ABD1617012
        for <sj@xxxx.hu>; Mon, 21 Jul 2008 04:38:57
Received: from 22.185.62.188 by Sun,20 Jul 2008 21:35:59
Message-ID: <C[20
Date: Mon, 21 Jul 2008 04:38:57 +0200 (CEST)
From: vpwwcomrigvri@yahoo.com
To: undisclosed-recipients:;
FROM*yahoo.com                0.9507 1
NO_SUBJECT*                   0.9999 1
HEADER*undisclosed-recipients 0.8764 1

level84: 0.9995 in 68 [ms]
Received: from mx2.xxxx.hu (mx2.xxxx.hu [195.xx.xx.xx])
Received: from [200.158.63.250
    (200-158-63-250.dsl.telesp.net.br [200.158.63.250])
Received: from [200.158.63.250] by
    mail2.newfashionproducts.com; Wed, 23 Jul
    Hora oficial do Brasil
From: <nuyicjfry@bmount.com>
To: <sj@xxxx.hu>
Subject: Vulcan!
Date: Wed, 23 Jul   Hora oficial do Brasil
Content-Type: text/plain;
        format=flowed;
        charset=quot;Windows-1252quot;;
        reply-type=original
Content-Transfer-Encoding: 7bit

For bad boys only

http://ingenuitycopy.com/?said=r17
HEADER*windows-1252   0.9285 1
HEADER*mx2.xxxx.hu    0.9974 1
HEADER*195.xx.xx.xx   0.9972 1

level90: 0.9999 in 30 [ms]



ingenuitycopy.com.multi.surbl.org has address 127.0.0.86
ingenuitycopy.com.multi.uribl.com has address 127.0.0.2

SURBL0*ingenuitycopy.com 0.9999 1
Received: from mx2.xxxx.hu (mx2.xxxx.hu[195.xx.xx.xx])
    by xx.xxx.hu (Postfix) with SMTP id C3F7917018
    for <sj@xxxx.hu>; Tue, 15 Jul 2008 10:57:23 +0200
Received: from av-engine (localhost [127.0.0.1])
    by mx2.xxxx.hu (Postfix) with SMTP id C1C3642A0C6
    for <sj@xxxx.hu>; Tue, 15 Jul 2008 10:57:23 +0200
Received: from host1-111-dynamic.17-87-
 r.retail.telecomitalia.it (host1-111-dynamic.17-87-
 r.retail.telecomitalia.it [87.17.111.1])
    by mx2.xxxx.hu (Postfix) with SMTP id BC2D1429EA9
    for <sj@xxxx.hu>; Tue, 15 Jul 2008 10:57:22 +0200
Message-ID: <487C6670.6010903@acts.hu>
Date: Tue, 15 Jul 2008 10:57:20 +0100
From: quot;Annequot; <m@acts.hu>
To: quot;Vickiequot; <sj@xxxx.hu>
Subject: Style casino

Win, win with us - our casino http://casdream.net/
HEADER*mx2.xxxx.hu    0.9973   1
HEADER*195.xx.xx.xx   0.9971   1
FROM*acts.hu          0.8960   1
Subject*casino        0.9955   1
with+our              0.9181   1

level65: 1.0000 in 41 [ms]
Received: from 65.204.40.211 (unknown [65.204.40.211])
        by xx.xxx.hu (Postfix) with SMTP id83F6C17018
Message-ID: <000601c8e6a4$053bc22c$c1d44282@bjoawxy>
From: quot;kalle sandgorgquot; <art@bonne-route.com>
To: <xxx@xxxx.hu>
Subject: We caught you naked in the shower xxxx
MIME-Version: 1.0
Content-Type: text/plain;
        charset=quot;iso-8859-1quot;
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198

         http://autodromomouras.com/view.exe
WATCH:
Subject*caught   0.9680   1
Subject*you      0.9843   1
Subject*shower   0.9747   1
Subject*naked    0.9791   1

level72: 0.9999 in 27 [ms]
Kreatív írás
Received: from abqr197.neoplus.adsl.tpnet.pl
     (abqr197.neoplus.adsl.tpnet.pl [83.8.85.197])
Received: from 141.156.31.140 (HELO merlin.cssiinc.com)
     by xx.xxxx.hu with ESMTP ({nChar[8-12]}nChar[4-6]})
From: quot;Louis Hernandezquot; <Louis@cssiinc.com>
To: quot;Melvin Kingquot; <xx@xxxx.hu>
Subject: Get a rod of colossal measurements!

------=_NextPart_6255_18D9_01C8ECCA.BFE87290
Content-Type: text/plain; charset=quot;windows-1250quot;
Content-Transfer-Encoding: quoted-printable

I thought I could not do anything with this small
dimension until I tried this remedy! Make it get bigger,
go for it! http://stillgen.com/

once, I didnt want to hit it again.would tell him, You
dont look Jewish. Nothing made him feel happierones.
FROM*louis              0.9314   1
FROM*hernandez          0.9771   1
HEADER*nchar            0.9946   1
windows-1250+meta       0.9051   1
Subject*get             0.9595   1
Subject*rod             0.9040   1
small+dimension         0.9040   1
made+him                0.9926   1
tried+this              0.9047   1
it!+font                0.9952   1
didnt+want              0.9942   1
until+tried             0.9952   1
you+dont                0.9958   1
mshtml+6.00.3790.1830   0.9952   1
6.00.3790.1830+name     0.9952   1

level93: 1.0000 in 33 [ms]
Adobe + „eltört” URL
Received: from (ipbf.tokyo.ocn.ne.jp [118.6.117.90])
From: quot;boote kirbyquot; <1kazman@jaring.my>
To: <sj@xxxx.hu>
Subject: to sj

Get the great discounts on popular software today !

Windows XP Pro With SP2 - $59.95
Adobe Acrobat Pro 8 - $69.95
Office 2003 Pro - $59.95
Adobe Photoshop CS2 - $79.95

Microsoft Office 2004 for MAC $79.95
Adobe Acrobat 7 Professional for MAC $59.95
Adobe Creative Suite 2 Premium for MAC $229.95

 - Visit our site:   www.rahwosoft[DOT]com
(copy this link and then replace quot;[DOT]quot; to quot;.quot;)
great+discounts 0.9952 1
adobe+acrobat 0.9952 1
adobe+creative 0.9954 1
suite+premium 0.9952 1
creative+suite 0.9952 1
microsoft+office 0.9570 1
$59.95+adobe 0.9952 1
$79.95+adobe 0.9957 1
NO_SUBJECT* 0.9999 1
adobe+photoshop 0.9958 1
acrobat+professional 0.9932 1
photoshop+cs2 0.9952 1
office+pro 0.9948 1
premium+for 0.9952 1
...
our+site 0.9027 1
com+copy 0.9631 1
copy+this 0.9680 1
replace+dot 0.9631 1

level66: 1.0000 in 41 [ms]
Image spam
Received: from x.x.x.x.pldt.net (unknown [210.213.113.173])
From: =?koi8-r?B?8i7nLiDz1NLVxdc=?= <whitney@apr.com>
To: =?koi8-r?B?4c3exc7Dxdc=?= <xxx@xxxx.hu>
Subject: =?koi8-r?B?NyDU28suIOFxMXU08vPQ0sxc7JxSDP1CDv0sLJ?=

<META http-equiv=Content-Type content=quot;text/html;
charset=koi8-rquot;>

<DIV align=center><FONT face=Arial color=#000000><img
=src=quot;cid:000401c8$4b27d4bb@mohjuegquot; align=middle>

=C6=D2=C1=CE=DB=C9=DA=CE=CF=C7=CF=20=D0=C1=CB=C5=D4=C1&nbsp;
<STRONG><FONT color=#fa6105>&laquo;ORBY&raquo;:</FONT>
C9=DE=C5=CE=CE=CF=C5 =D0=D2=C5=C4=CC=CF=D6=C5=CE=C9=C5 =

Content-Type: image/jpeg; name=quot;orbi0.jpgquot;
Content-Transfer-Encoding: base64
Subject*koi8-r                     0.9962   1
charset+koi8-r                     0.9918   1
koi8-r+content-transfer-encoding   0.9915   1
koi8-r+meta                        0.9993   1
div+bgcolor                        0.9460   1
bgcolor+div                        0.8803   1
raquo+font                         0.0743   1
jjjjj+nbsp                         0.9680   1
nbsp+jjj                           0.9040   1
color+jjj                          0.9040   1
jjj+jjjjj                          0.9721   1
generator+style                    0.8783   1
raquo+nbsp                         0.9718   1
color+img                          0.9761   1
strong+nbsp                        0.9467   1
src+cid                            0.8929   1
image+jpeg                         0.8960   1
jpeg+content-transfer-encoding     0.9121   1
content-transfer-encoding+base64   0.8750   1
IMAGE*                             0.9999   1
EMBED*                             0.9999   1

level70: 1.0000 in 51 [ms]
Received: from mary (24-183-185-151.charter.com
     [24.183.185.151])
Received: from [24.183.185.151] by f.mx.mail.yahoo.com;
From: quot;Carey Brunsonquot;@xx.xxxx.hu
To: <xx@xxxx.hu>
Subject: Great variety of little helpers for your health.

<szöveges rész az elején>

------=_NextPart_001_000F_01C8E6D2.031FDE80
Content-Type: text/html; charset=quot;iso-8859-2quot;
Content-Transfer-Encoding: quoted-printable

<p><a href=quot;http://suffixwit.com/quot; target=quot;_blankquot;>
<strong><font size=3Dquot;+1quot;>CLICK HERE URL!!!
</font></strong></a> <br />

------=_NextPart_000_000E_01C8E6D2.031FDE80
Content-Type: image/gif; name=quot;10.gifquot;
Content-Transfer-Encoding: base64
HEADER*f.mx.mail.yahoo.com   0.9631   1
FROM*carey                   0.9870   1
Subject*great                0.9964   1
Subject*little               0.9955   1
Subject*helpers              0.9631   1
Subject*your                 0.8795   1
Subject*health.              0.9834   1
Subject*for+Subject*your     0.8975   1
center+bordercolor           0.9954   1
mshtml+6.00.2900.2670        0.9957   1
body+body                    0.9961   1
body+table                   0.9436   1
here+font                    0.9149   1
border+href                  0.8995   1
6.00.2900.2670+name          0.9957   1
content-type+meta            0.8783   1
head+title                   0.9251   1
div+align                    0.8783   1
size+click                   0.9299   1
IMAGE*                       0.9999   1

level97: 1.0000 in 33 [ms]
„A töltelékszavak lerontják a
felismerés hatékonyságát ...”
            “...Spamre nem jellem-
            ző szavakat tesznek
            bele, így fog átjutni
            a spamszűrőn. Ha taní-
            tod, akkor mérgezi az
            adatbázist, sokkal
            rosszabbul fog működ-
            ni.”
Received:from dsldevice.lan (x.x.x.x.orange.es[85.60.30.163])
Subject: Give freedom to the desires

<szöveges rész a lenti szósalátával>

Content-Type: text/html; charset=quot;Windows-1252quot;
Content-Transfer-Encoding: quoted-printable

<META http-equiv=Content-Type content=quot;text/html;
charset=Windows-1252quot;>
<META content=3Dquot;MSHTML 6.00.2720.1081quot; name=GENERATOR>
<STYLE></STYLE></HEAD>
<BODY bgColor=#ffffff><DIV align=center><FONT face=Comic Sans
MS size=3>A better way to give up smoking.</FONT></DIV><DIV
align=center><FONT face=Comic Sans size=3>Your new source of
great health.</FONT></DIV>

<DIV><FONT face=Comic Sans MS size=3></FONT>&nbsp;&nbsp;
</DIV><DIV align=center><FONT face=Comic Sans size=2><A
href=quot;http://q.bay.livefilestore.com/y1py...9A/gqoet.htmquot;>
Here!</A></FONT></DIV><BR><BR><BR><BR><BR>

exporatory euroaquilo equilivent esthesises entogenous
eurobridge ethermeter fBTERMINFO enterozoan februarius
HEADER*dsldevice.lan                     0.9944   1
FROM*charles                             0.9845   1
Subject*give                             0.9953   1
Subject*freedom                          0.8816   1
Subject*desires                          0.9902   1
windows-1252+meta                        0.9981   1
charset+windows-1252                     0.9799   1
windows-1252+content-transfer-encoding   0.9716   1
generator+style                          0.8786   1
here!+font                               0.9958   1
size+better                              0.9952   1
size+your                                0.8784   1
div+align                                0.8776   1
quoted-printable+the                     0.9769   1
bgcolor+div                              0.8806   1
you+dreamt                               0.9893   1
which+one                                0.9963   1
health.+font                             0.9808   1
URL*livefilestore.com                    0.9771   1

level73: 1.0000 in 27 [ms]
Received: from x-x-x-x.aaa.com.br (unknown[200.138.161.196])
From: quot;Mckenzie Lavinderquot; <wwinflation@dialusformurder.com>
To: quot;xxxquot; <xxx@xxxx.hu>
Subject: Actually you do not try them?

Content-Type: text/plain; charset=quot;iso-8859-15quot;
<szöveges rész összefüggéstelen szavakból álló mondatokkal>

<A href=quot;http://qtk8q.bay.livefilestore.com/yw/imjl.htmquot;>
<IMG alt=quot;As sunkenquot; hspace=0
src=quot;http://cufbtg.bay.livefilestore.com/y1pBw...g/jskd.jpgquot;
align=baseline border=0></A></DIV>

<DIV align=left><FONT face=Bookman Old Style size=1>But
sold? Is by consequence indistinguishable. Is therefore It
viewer. For counteract. At to broaden. on by supplementary
seriously sentiment. avoid at twist. my what, dangerous the
pipes.</FONT></DIV>
<DIV align=left><FONT face=Bookman Old Style size=1>Which
disappear. He is ignorant, repose. you timetable faculty.
That easy it welch appellant. by go prescribed broken
misguided. mistress the mindless. prophet social a hive. To
be violate master.</FONT></DIV>
Subject*actually        0.9863   1
Subject*you             0.9843   2
Subject*not             0.9956   2
Subject*try             0.9952   1
Subject*them            0.9924   1
charset+iso-8859-15     0.9808   1
align+baseline          0.9808   1
border+div              0.9416   1
URL*livefilestore.com   0.9771   1
hspace=0+src            0.9480   1
div+align               0.8776   1
bgcolor+div             0.8810   1
generator+style         0.8786   1
baseline+border         0.9838   1
size+but                0.9952   1
size+which              0.9528   1

level78: 1.0000 in 58 [ms]
Magyar nyelvű spam
Received:from 3lyw4 (x.x.x.x.vodafone.hu[89.223.208.212])
From: =?ISO-8859-1?Q?Anikó?= <balogh.aniko@vipmail.hu>
Subject: Nyerj LCD TV-t!
To: sj@xxxx.hu
Content-Type: text/plain; charset=quot;ISO-8859-1quot;
Reply-To: balogh.aniko@vipmail.hu

Hello!

Szívesen néznéd Te is a filmeket egy nagyképernyos LCD
TV-n, de nincs rá pénzed? Akkor nyerj egyet! Csak egy
sms-t kell elküldened, és máris jó esélyed van rá, hogy
jelképes áron vásárolhasd meg álmaid nagyképernyos
plazmatv-jét! Nézd meg ezt az oldalt, megéri!

http://www.matutinyersz.eu/
FROM*vipmail.hu        0.9877   1
FROM*anikó             0.9631   1
HEADER*3lyw4           0.9888   1
egy+sms-t              0.9631   1
van+hogy               0.0202   1   phrase: 0.8139

RBL checking: 212.208.223.89.zen.spamhaus.org
surbl check for matutinyersz.eu (0) took 0 ms

FROM*vipmail.hu        0.9877   2
FROM*anikó             0.9631   2
HEADER*3lyw4           0.9888   2
egy+sms-t              0.9631   1
filmeket               0.9718   1
van+hogy               0.0202   1
van                    0.1005   1
sms-t                  0.9631   1
hogy                   0.1005   1   mix: 0.8703
megéri!                0.9631   1   caught by rbl
RBL0*89.223.208.212    0.9999   1

level76: 0.9797 in 28 [ms]
Received: from mx2.xxxx.hu (mx2.xxxx.hu [195.xx.xx.xx])
Received: from 192.168.1.1(x.x.x.x.pool.tvnet.hu[85.238.82.84])
From: quot;Molnár Zsoltquot; <molnarzsolt2007@gmail.com>
To: <xx@xxxx.hu>
Subject: Címlista

Tisztelt Hölgyem/ Uram!

Megrendelhető nálam az alábbi email címlista:

- 200.000 magyarországi vállalkozás email címe, tetszés
szerinti csoportosításban (összesítve, illetve számos kategória
külön is).
- 400.000 magyarországi magán email cím.

Továbbá el tudom vállalni az email kampány lebonyolítását
(kiküldés), valamint tudok ajánlani email címeket gyűjtő,
valamint hírlevél kiküldő programot.

Valamennyi címlistát idén, 2008. januárjában allítottam össze,
a hibaszázalék mindössze 5-10 százalék, vagyis aktuálisabb,
mint szinte valamennyi más hasonló adatbázis.

Üdvözlettel, Molnár Zsolt
Subject*címlista            0.9564   1
uram!+megrendelhető         0.9564   1
megrendelhető+nálam         0.9564   1
részletes+tájékoztatót      0.9564   1
email+címlista              0.9564   1
valamennyi+címlistát        0.9564   1
tudok+ajánlani              0.9040   1
küldök+illetve              0.9564   1
email+címem                 0.9564   1
vállalkozás+email           0.9564   1
magyarországi+magán         0.9564   1
bármilyen+felmerülő         0.9564   1
alábbi+email                0.9564   1
tájékoztatót+küldök         0.9564   1
illetve+válaszolok          0.9564   1
hasonló+adatbázis.          0.9564   1
válaszolok+bármilyen        0.9564   1
számos+kategória            0.9564   1
címlista+200.000            0.9564   1
magyarországi+vállalkozás   0.9564   1
Üdvözlettel+molnár          0.9564   1
molnár+zsolt                0.9564   1
Received: from mobilier1 (dslXXXX.pool.t-online.hu [78.92.82.147])
From: Kontra =?ISO-8859-1?Q?György?= <flexen2@freemail.hu>
To: <xx@xxxx.hu>
Subject: =?ISO-8859-1?Q?Bemutatkozás?=
X-DCC--Metrics: mail02a.mail.t-online.hu 0; Body=1 Fuz1=1 Fuz2=1

<html><head><title>Tisztelt Hölgyem</title></head><body>

<p align=quot;leftquot;>Tisztelt Hölgyem/Uram! <br>Kérem engedje meg hogy,
bemutatkozzunk pár másodperc alatt. <br> Tekintse meg
szórólapunkat, és ha felkeltettük érdeklõdését tekintse meg web
oldalunkat és keressen fel személyesen vagy telefonon. </p>
<a href=quot;http://www.mobilier.huquot;>Tekintse meg aktuális akciónkat!</
a></p><a href=quot;http://www.mobilier.huquot;><img border=quot;0quot; src=
quot;http://www.freeweb.hu/mobilier115/szoro1.jpgquot; width=quot;439quot;
height=quot;621quot;></a><p align=quot;leftquot;>Köszönjük a türelmét!<br>
Üdvözlettel: Kontra György<br>

Az Ön e-mail címe valamely nyilvános, mindenki által elérhetõ
adatbázisból származik. Ez az e-mail nem minősül spamnek, hanem a
2001. évi CVIII. Törvény 14. §-ban elõírt &quot;hozzájárulás&quot;
kérés az informáláshoz. Amennyiben a továbbiakban nem kíván ilyen
üzenetet kapni, kérjük, jelezze ezt egy válasz e-mailben. Ha
levelünkkel zavartuk, elnézést kérünk.<br>
HEADER*78.92.82.147                                         0.9631 1
HEADER*mobilier1                                            0.9631 1
FROM*Kontra =?ISO-8859-1?Q?Gy=F6rgy?= <flexen2@freemail.hu> 0.9631 1
Subject*bemutatkozás                                        0.9631 1
microsoft+frontpage                                         0.9953 1
frontpage.editor.document+meta                              0.9631 1
content+frontpage.editor.document                           0.9952 1
content-language+content                                    0.9499 1
title+tisztelt                                              0.9631 1
keressen+fel                                                0.9631 1
engedje+meg                                                 0.9822 1
hogy+bemutatkozzunk                                         0.9631 1
oldalunkat+href                                             0.9631 1
windows-1250+title                                          0.9631 1
URL*mobilier.hu                                             0.9631 1
URL*freeweb.hu                                              0.9631 1
kérjük+jelezze                                              0.9040 1
alatt.+tekintse                                             0.9631 1
jelezze+ezt                                                 0.9631 1
web+oldalunkat                                              0.9631 1
e-mail+nem                                                  0.9631 1
spamnek+hanem                                               0.9631 1
hanem+2001.                                                 0.9845 1
2001.+évi                                                   0.9845 1
évi+cviii.                                                  0.9845 1
cviii.+törvény                                              0.9747 1
törvény+14.                                                 0.9747 1
Bayes mérgezés
   Date: Tue, 15 Jul 2008 10:57:20 +0100
   From: quot;Annequot; <m@teszt.hu>
   To: quot;Vickiequot; <sj@xxxx.hu>
   X-Abcde: ajaja ahah aua akakaka akaka
   Subject: Re: attack on spam filters

   I agree with you!<br>

   <font color=”white”>ajaj ajaju azaha
   azazazz akak</font>


   <!-- jaja ajajaj ajah uzauaz u azuua
   zuazau ahaha -->
Hogyan lehet legyőzni a
statisztikai spamszűrőket?
Ha nem használod . . .

Weitere ähnliche Inhalte

Was ist angesagt?

Pixelplant - WebDev Meetup Salzburg
Pixelplant - WebDev Meetup SalzburgPixelplant - WebDev Meetup Salzburg
Pixelplant - WebDev Meetup Salzburg
wolframkriesing
 
Проблемы использования TCP в мобильных приложениях. Владимир Кириллов
Проблемы использования TCP в мобильных приложениях.  Владимир КирилловПроблемы использования TCP в мобильных приложениях.  Владимир Кириллов
Проблемы использования TCP в мобильных приложениях. Владимир Кириллов
Anthony Marchenko
 
Ch 1 part-1 final
Ch 1 part-1 finalCh 1 part-1 final
Ch 1 part-1 final
aminsir
 
Kdz fw upd_log
Kdz fw upd_logKdz fw upd_log
Kdz fw upd_log
J Dionisio
 

Was ist angesagt? (20)

A look at the CQL changes in 3.x (Benjamin Lerer, Datastax) | Cassandra Summi...
A look at the CQL changes in 3.x (Benjamin Lerer, Datastax) | Cassandra Summi...A look at the CQL changes in 3.x (Benjamin Lerer, Datastax) | Cassandra Summi...
A look at the CQL changes in 3.x (Benjamin Lerer, Datastax) | Cassandra Summi...
 
A look at the cql changes in 3.x
A look at the cql changes in 3.xA look at the cql changes in 3.x
A look at the cql changes in 3.x
 
MongoDB .local Houston 2019: Using Client Side Encryption in MongoDB 4.2
MongoDB .local Houston 2019: Using Client Side Encryption in MongoDB 4.2MongoDB .local Houston 2019: Using Client Side Encryption in MongoDB 4.2
MongoDB .local Houston 2019: Using Client Side Encryption in MongoDB 4.2
 
MongoDB .local Munich 2019: New Encryption Capabilities in MongoDB 4.2: A Dee...
MongoDB .local Munich 2019: New Encryption Capabilities in MongoDB 4.2: A Dee...MongoDB .local Munich 2019: New Encryption Capabilities in MongoDB 4.2: A Dee...
MongoDB .local Munich 2019: New Encryption Capabilities in MongoDB 4.2: A Dee...
 
MongoDB .local London 2019: Tips and Tricks++ for Querying and Indexing MongoDB
MongoDB .local London 2019: Tips and Tricks++ for Querying and Indexing MongoDBMongoDB .local London 2019: Tips and Tricks++ for Querying and Indexing MongoDB
MongoDB .local London 2019: Tips and Tricks++ for Querying and Indexing MongoDB
 
MongoDB .local Chicago 2019: Using Client Side Encryption in MongoDB 4.2
MongoDB .local Chicago 2019: Using Client Side Encryption in MongoDB 4.2MongoDB .local Chicago 2019: Using Client Side Encryption in MongoDB 4.2
MongoDB .local Chicago 2019: Using Client Side Encryption in MongoDB 4.2
 
Webinar: Replication and Replica Sets
Webinar: Replication and Replica SetsWebinar: Replication and Replica Sets
Webinar: Replication and Replica Sets
 
The Ring programming language version 1.2 book - Part 39 of 84
The Ring programming language version 1.2 book - Part 39 of 84The Ring programming language version 1.2 book - Part 39 of 84
The Ring programming language version 1.2 book - Part 39 of 84
 
Embracing the-power-of-refactor
Embracing the-power-of-refactorEmbracing the-power-of-refactor
Embracing the-power-of-refactor
 
Neo4j after 1 year in production
Neo4j after 1 year in productionNeo4j after 1 year in production
Neo4j after 1 year in production
 
Pixelplant - WebDev Meetup Salzburg
Pixelplant - WebDev Meetup SalzburgPixelplant - WebDev Meetup Salzburg
Pixelplant - WebDev Meetup Salzburg
 
It's 10pm: Do You Know Where Your Writes Are?
It's 10pm: Do You Know Where Your Writes Are?It's 10pm: Do You Know Where Your Writes Are?
It's 10pm: Do You Know Where Your Writes Are?
 
CouchDB @ red dirt ruby conference
CouchDB @ red dirt ruby conferenceCouchDB @ red dirt ruby conference
CouchDB @ red dirt ruby conference
 
CDR-Stats : VoIP Analytics Solution for Asterisk and FreeSWITCH with MongoDB
CDR-Stats : VoIP Analytics Solution for Asterisk and FreeSWITCH with MongoDBCDR-Stats : VoIP Analytics Solution for Asterisk and FreeSWITCH with MongoDB
CDR-Stats : VoIP Analytics Solution for Asterisk and FreeSWITCH with MongoDB
 
Проблемы использования TCP в мобильных приложениях. Владимир Кириллов
Проблемы использования TCP в мобильных приложениях.  Владимир КирилловПроблемы использования TCP в мобильных приложениях.  Владимир Кириллов
Проблемы использования TCP в мобильных приложениях. Владимир Кириллов
 
The Ring programming language version 1.10 book - Part 63 of 212
The Ring programming language version 1.10 book - Part 63 of 212The Ring programming language version 1.10 book - Part 63 of 212
The Ring programming language version 1.10 book - Part 63 of 212
 
Webconfig
WebconfigWebconfig
Webconfig
 
Ch 1 part-1 final
Ch 1 part-1 finalCh 1 part-1 final
Ch 1 part-1 final
 
Kdz fw upd_log
Kdz fw upd_logKdz fw upd_log
Kdz fw upd_log
 
سوالات تئوری سیزدهمین دوره مسابقات علمی عملی بهمن 1394 مرحله استانی_هماهنگ کشوری
سوالات تئوری سیزدهمین دوره مسابقات علمی عملی بهمن 1394 مرحله استانی_هماهنگ کشوریسوالات تئوری سیزدهمین دوره مسابقات علمی عملی بهمن 1394 مرحله استانی_هماهنگ کشوری
سوالات تئوری سیزدهمین دوره مسابقات علمی عملی بهمن 1394 مرحله استانی_هماهنگ کشوری
 

Andere mochten auch

Cerebral Palsy And Treatments
Cerebral Palsy And TreatmentsCerebral Palsy And Treatments
Cerebral Palsy And Treatments
guest3723ac
 
Pki Digital Signature
Pki Digital SignaturePki Digital Signature
Pki Digital Signature
Saeed Aminian
 
آشنایی با زیرساخت کلید عمومی (PKI)
آشنایی با زیرساخت کلید عمومی (PKI)آشنایی با زیرساخت کلید عمومی (PKI)
آشنایی با زیرساخت کلید عمومی (PKI)
مرکز دولتی صدور گواهی الکترونیکی ریشه
 
نوآوری باز در تحقیق و توسعه
نوآوری باز در تحقیق و توسعهنوآوری باز در تحقیق و توسعه
نوآوری باز در تحقیق و توسعه
Esmaeil Abedi
 

Andere mochten auch (6)

Cerebral Palsy And Treatments
Cerebral Palsy And TreatmentsCerebral Palsy And Treatments
Cerebral Palsy And Treatments
 
Ggt36
Ggt36Ggt36
Ggt36
 
Pki Digital Signature
Pki Digital SignaturePki Digital Signature
Pki Digital Signature
 
زیرساخت کلید عمومی (PKI)، مفاهیم، کاربردها و کاربری امضای دیجیتال
زیرساخت کلید عمومی (PKI)، مفاهیم، کاربردها و کاربری امضای دیجیتالزیرساخت کلید عمومی (PKI)، مفاهیم، کاربردها و کاربری امضای دیجیتال
زیرساخت کلید عمومی (PKI)، مفاهیم، کاربردها و کاربری امضای دیجیتال
 
آشنایی با زیرساخت کلید عمومی (PKI)
آشنایی با زیرساخت کلید عمومی (PKI)آشنایی با زیرساخت کلید عمومی (PKI)
آشنایی با زیرساخت کلید عمومی (PKI)
 
نوآوری باز در تحقیق و توسعه
نوآوری باز در تحقیق و توسعهنوآوری باز در تحقیق و توسعه
نوآوری باز در تحقیق و توسعه
 

Ähnlich wie Statisztikai Spamszurok 2008

Django SEM
Django SEMDjango SEM
Django SEM
Gandi24
 
Caleb Xss Dating Website
Caleb   Xss   Dating WebsiteCaleb   Xss   Dating Website
Caleb Xss Dating Website
Caleb Sima
 

Ähnlich wie Statisztikai Spamszurok 2008 (20)

Apache Kafka® 102 - Applied
Apache Kafka® 102 -  AppliedApache Kafka® 102 -  Applied
Apache Kafka® 102 - Applied
 
CodeIgniter 3.0
CodeIgniter 3.0CodeIgniter 3.0
CodeIgniter 3.0
 
Secure Software: Action, Comedy or Drama? (2017 edition)
Secure Software: Action, Comedy or Drama? (2017 edition)Secure Software: Action, Comedy or Drama? (2017 edition)
Secure Software: Action, Comedy or Drama? (2017 edition)
 
Beyond Good & Evil: The nuts and bolts of DRM - Dave Cramer - ebookcraft 2017
Beyond Good & Evil: The nuts and bolts of DRM - Dave Cramer - ebookcraft 2017Beyond Good & Evil: The nuts and bolts of DRM - Dave Cramer - ebookcraft 2017
Beyond Good & Evil: The nuts and bolts of DRM - Dave Cramer - ebookcraft 2017
 
Rewriting the Drupal Theme layer
Rewriting the Drupal Theme layerRewriting the Drupal Theme layer
Rewriting the Drupal Theme layer
 
Django SEM
Django SEMDjango SEM
Django SEM
 
The Ring programming language version 1.5.1 book - Part 28 of 180
The Ring programming language version 1.5.1 book - Part 28 of 180The Ring programming language version 1.5.1 book - Part 28 of 180
The Ring programming language version 1.5.1 book - Part 28 of 180
 
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
Shameful Secrets of Proprietary Network Protocols - OWASP AppSec EU 2014
 
[CSSDevConf] Adaptive Images in Responsive Web Design 2014
[CSSDevConf] Adaptive Images in Responsive Web Design 2014[CSSDevConf] Adaptive Images in Responsive Web Design 2014
[CSSDevConf] Adaptive Images in Responsive Web Design 2014
 
Velocity 2012 - Learning WebOps the Hard Way
Velocity 2012 - Learning WebOps the Hard WayVelocity 2012 - Learning WebOps the Hard Way
Velocity 2012 - Learning WebOps the Hard Way
 
On Mining Bitcoins - Fundamentals & Outlooks
On Mining Bitcoins - Fundamentals & OutlooksOn Mining Bitcoins - Fundamentals & Outlooks
On Mining Bitcoins - Fundamentals & Outlooks
 
PHP記帳網頁教材(第一頁是空白的)
PHP記帳網頁教材(第一頁是空白的)PHP記帳網頁教材(第一頁是空白的)
PHP記帳網頁教材(第一頁是空白的)
 
Autobots @ REA
Autobots @ REAAutobots @ REA
Autobots @ REA
 
Beyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeBeyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the code
 
My app is secure... I think
My app is secure... I thinkMy app is secure... I think
My app is secure... I think
 
DDoS attacks, Booters, and DDoSDB
DDoS attacks, Booters, and DDoSDBDDoS attacks, Booters, and DDoSDB
DDoS attacks, Booters, and DDoSDB
 
Caleb Xss Dating Website
Caleb   Xss   Dating WebsiteCaleb   Xss   Dating Website
Caleb Xss Dating Website
 
Tactical Assassins
Tactical AssassinsTactical Assassins
Tactical Assassins
 
Become a Java GC Hero - All Day Devops
Become a Java GC Hero - All Day DevopsBecome a Java GC Hero - All Day Devops
Become a Java GC Hero - All Day Devops
 
Game of Fraud Detection with SQL and Machine Learning
Game of Fraud Detection with SQL and Machine LearningGame of Fraud Detection with SQL and Machine Learning
Game of Fraud Detection with SQL and Machine Learning
 

Mehr von Janos Suto (6)

Docker security
Docker securityDocker security
Docker security
 
Open source email archivalas
Open source email archivalasOpen source email archivalas
Open source email archivalas
 
Why email archiving is good for you
Why email archiving is good for youWhy email archiving is good for you
Why email archiving is good for you
 
Vállalati spamszűrés open source célhardveren (SFD 2011, Szeged)
Vállalati spamszűrés open source célhardveren (SFD 2011, Szeged)Vállalati spamszűrés open source célhardveren (SFD 2011, Szeged)
Vállalati spamszűrés open source célhardveren (SFD 2011, Szeged)
 
Spam? Már szinte el is felejtettem, mi az
Spam? Már szinte el is felejtettem, mi azSpam? Már szinte el is felejtettem, mi az
Spam? Már szinte el is felejtettem, mi az
 
Clapf Egy Irto Jo Spamszuro
Clapf Egy Irto Jo SpamszuroClapf Egy Irto Jo Spamszuro
Clapf Egy Irto Jo Spamszuro
 

Kürzlich hochgeladen

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 

Kürzlich hochgeladen (20)

Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
 
Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
A Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusA Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source Milvus
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 

Statisztikai Spamszurok 2008

  • 1. Statisztikai spamszűrők Hatékony védelem a spam ellen Sütő János (sj@acts.hu)
  • 2. Graham - Plan for spam
  • 5. Döntési mátrix felépítése enhanced+libido 0,9999 Subject*impress 0,9934 triples 0,9311 absolutely 0,8933
  • 6. Statisztikai összegzés HAM ??? SPAM 0% 91% 100%
  • 11. Fehérlista 0. SQL táblában tárolt minták 1. Név, email, domain, IP-cím, FQDN 2. „From:” sor alapján
  • 12. Csapda email cím + aknamező = intelligens feketelista
  • 13. „Nehéz pontosan meghatározni a határértéket . . .” “...Ha túl magas, akkor kevés spamet ismer fel, ha túl alacsony, akkor sok jó levelet is elve- szítünk.”
  • 15. A szakértő megmondja „Egy embernél jól működhet, de 10000- nél már nem” „... később komoly csalódás éri a té- ves biztonságérzetű felhasználót” „A spammerek legú- jabb trükkjeit nem ismeri fel”
  • 17. Mikro/piko spam Return-Path: <vpwwcomrigvri@yahoo.com> X-Original-To: sj@xxxx.hu Received: from av-engine (localhost [127.0.0.1]) by xx.xxxx.hu (Postfix) with SMTP id E04CC17013 for <sj@xxxx.hu>; Mon, 21 Jul 2008 04:38:58 Received: from 194.xx.xx.xx (unknown [58.248.77.145]) by xx.xxxx.hu (Postfix) with SMTP id ABD1617012 for <sj@xxxx.hu>; Mon, 21 Jul 2008 04:38:57 Received: from 22.185.62.188 by Sun,20 Jul 2008 21:35:59 Message-ID: <C[20 Date: Mon, 21 Jul 2008 04:38:57 +0200 (CEST) From: vpwwcomrigvri@yahoo.com To: undisclosed-recipients:;
  • 18. FROM*yahoo.com 0.9507 1 NO_SUBJECT* 0.9999 1 HEADER*undisclosed-recipients 0.8764 1 level84: 0.9995 in 68 [ms]
  • 19. Received: from mx2.xxxx.hu (mx2.xxxx.hu [195.xx.xx.xx]) Received: from [200.158.63.250 (200-158-63-250.dsl.telesp.net.br [200.158.63.250]) Received: from [200.158.63.250] by mail2.newfashionproducts.com; Wed, 23 Jul Hora oficial do Brasil From: <nuyicjfry@bmount.com> To: <sj@xxxx.hu> Subject: Vulcan! Date: Wed, 23 Jul Hora oficial do Brasil Content-Type: text/plain; format=flowed; charset=quot;Windows-1252quot;; reply-type=original Content-Transfer-Encoding: 7bit For bad boys only http://ingenuitycopy.com/?said=r17
  • 20. HEADER*windows-1252 0.9285 1 HEADER*mx2.xxxx.hu 0.9974 1 HEADER*195.xx.xx.xx 0.9972 1 level90: 0.9999 in 30 [ms] ingenuitycopy.com.multi.surbl.org has address 127.0.0.86 ingenuitycopy.com.multi.uribl.com has address 127.0.0.2 SURBL0*ingenuitycopy.com 0.9999 1
  • 21. Received: from mx2.xxxx.hu (mx2.xxxx.hu[195.xx.xx.xx]) by xx.xxx.hu (Postfix) with SMTP id C3F7917018 for <sj@xxxx.hu>; Tue, 15 Jul 2008 10:57:23 +0200 Received: from av-engine (localhost [127.0.0.1]) by mx2.xxxx.hu (Postfix) with SMTP id C1C3642A0C6 for <sj@xxxx.hu>; Tue, 15 Jul 2008 10:57:23 +0200 Received: from host1-111-dynamic.17-87- r.retail.telecomitalia.it (host1-111-dynamic.17-87- r.retail.telecomitalia.it [87.17.111.1]) by mx2.xxxx.hu (Postfix) with SMTP id BC2D1429EA9 for <sj@xxxx.hu>; Tue, 15 Jul 2008 10:57:22 +0200 Message-ID: <487C6670.6010903@acts.hu> Date: Tue, 15 Jul 2008 10:57:20 +0100 From: quot;Annequot; <m@acts.hu> To: quot;Vickiequot; <sj@xxxx.hu> Subject: Style casino Win, win with us - our casino http://casdream.net/
  • 22. HEADER*mx2.xxxx.hu 0.9973 1 HEADER*195.xx.xx.xx 0.9971 1 FROM*acts.hu 0.8960 1 Subject*casino 0.9955 1 with+our 0.9181 1 level65: 1.0000 in 41 [ms]
  • 23. Received: from 65.204.40.211 (unknown [65.204.40.211]) by xx.xxx.hu (Postfix) with SMTP id83F6C17018 Message-ID: <000601c8e6a4$053bc22c$c1d44282@bjoawxy> From: quot;kalle sandgorgquot; <art@bonne-route.com> To: <xxx@xxxx.hu> Subject: We caught you naked in the shower xxxx MIME-Version: 1.0 Content-Type: text/plain; charset=quot;iso-8859-1quot; Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 http://autodromomouras.com/view.exe WATCH:
  • 24. Subject*caught 0.9680 1 Subject*you 0.9843 1 Subject*shower 0.9747 1 Subject*naked 0.9791 1 level72: 0.9999 in 27 [ms]
  • 25. Kreatív írás Received: from abqr197.neoplus.adsl.tpnet.pl (abqr197.neoplus.adsl.tpnet.pl [83.8.85.197]) Received: from 141.156.31.140 (HELO merlin.cssiinc.com) by xx.xxxx.hu with ESMTP ({nChar[8-12]}nChar[4-6]}) From: quot;Louis Hernandezquot; <Louis@cssiinc.com> To: quot;Melvin Kingquot; <xx@xxxx.hu> Subject: Get a rod of colossal measurements! ------=_NextPart_6255_18D9_01C8ECCA.BFE87290 Content-Type: text/plain; charset=quot;windows-1250quot; Content-Transfer-Encoding: quoted-printable I thought I could not do anything with this small dimension until I tried this remedy! Make it get bigger, go for it! http://stillgen.com/ once, I didnt want to hit it again.would tell him, You dont look Jewish. Nothing made him feel happierones.
  • 26. FROM*louis 0.9314 1 FROM*hernandez 0.9771 1 HEADER*nchar 0.9946 1 windows-1250+meta 0.9051 1 Subject*get 0.9595 1 Subject*rod 0.9040 1 small+dimension 0.9040 1 made+him 0.9926 1 tried+this 0.9047 1 it!+font 0.9952 1 didnt+want 0.9942 1 until+tried 0.9952 1 you+dont 0.9958 1 mshtml+6.00.3790.1830 0.9952 1 6.00.3790.1830+name 0.9952 1 level93: 1.0000 in 33 [ms]
  • 27. Adobe + „eltört” URL Received: from (ipbf.tokyo.ocn.ne.jp [118.6.117.90]) From: quot;boote kirbyquot; <1kazman@jaring.my> To: <sj@xxxx.hu> Subject: to sj Get the great discounts on popular software today ! Windows XP Pro With SP2 - $59.95 Adobe Acrobat Pro 8 - $69.95 Office 2003 Pro - $59.95 Adobe Photoshop CS2 - $79.95 Microsoft Office 2004 for MAC $79.95 Adobe Acrobat 7 Professional for MAC $59.95 Adobe Creative Suite 2 Premium for MAC $229.95 - Visit our site: www.rahwosoft[DOT]com (copy this link and then replace quot;[DOT]quot; to quot;.quot;)
  • 28. great+discounts 0.9952 1 adobe+acrobat 0.9952 1 adobe+creative 0.9954 1 suite+premium 0.9952 1 creative+suite 0.9952 1 microsoft+office 0.9570 1 $59.95+adobe 0.9952 1 $79.95+adobe 0.9957 1 NO_SUBJECT* 0.9999 1 adobe+photoshop 0.9958 1 acrobat+professional 0.9932 1 photoshop+cs2 0.9952 1 office+pro 0.9948 1 premium+for 0.9952 1 ... our+site 0.9027 1 com+copy 0.9631 1 copy+this 0.9680 1 replace+dot 0.9631 1 level66: 1.0000 in 41 [ms]
  • 29. Image spam Received: from x.x.x.x.pldt.net (unknown [210.213.113.173]) From: =?koi8-r?B?8i7nLiDz1NLVxdc=?= <whitney@apr.com> To: =?koi8-r?B?4c3exc7Dxdc=?= <xxx@xxxx.hu> Subject: =?koi8-r?B?NyDU28suIOFxMXU08vPQ0sxc7JxSDP1CDv0sLJ?= <META http-equiv=Content-Type content=quot;text/html; charset=koi8-rquot;> <DIV align=center><FONT face=Arial color=#000000><img =src=quot;cid:000401c8$4b27d4bb@mohjuegquot; align=middle> =C6=D2=C1=CE=DB=C9=DA=CE=CF=C7=CF=20=D0=C1=CB=C5=D4=C1&nbsp; <STRONG><FONT color=#fa6105>&laquo;ORBY&raquo;:</FONT> C9=DE=C5=CE=CE=CF=C5 =D0=D2=C5=C4=CC=CF=D6=C5=CE=C9=C5 = Content-Type: image/jpeg; name=quot;orbi0.jpgquot; Content-Transfer-Encoding: base64
  • 30. Subject*koi8-r 0.9962 1 charset+koi8-r 0.9918 1 koi8-r+content-transfer-encoding 0.9915 1 koi8-r+meta 0.9993 1 div+bgcolor 0.9460 1 bgcolor+div 0.8803 1 raquo+font 0.0743 1 jjjjj+nbsp 0.9680 1 nbsp+jjj 0.9040 1 color+jjj 0.9040 1 jjj+jjjjj 0.9721 1 generator+style 0.8783 1 raquo+nbsp 0.9718 1 color+img 0.9761 1 strong+nbsp 0.9467 1 src+cid 0.8929 1 image+jpeg 0.8960 1 jpeg+content-transfer-encoding 0.9121 1 content-transfer-encoding+base64 0.8750 1 IMAGE* 0.9999 1 EMBED* 0.9999 1 level70: 1.0000 in 51 [ms]
  • 31. Received: from mary (24-183-185-151.charter.com [24.183.185.151]) Received: from [24.183.185.151] by f.mx.mail.yahoo.com; From: quot;Carey Brunsonquot;@xx.xxxx.hu To: <xx@xxxx.hu> Subject: Great variety of little helpers for your health. <szöveges rész az elején> ------=_NextPart_001_000F_01C8E6D2.031FDE80 Content-Type: text/html; charset=quot;iso-8859-2quot; Content-Transfer-Encoding: quoted-printable <p><a href=quot;http://suffixwit.com/quot; target=quot;_blankquot;> <strong><font size=3Dquot;+1quot;>CLICK HERE URL!!! </font></strong></a> <br /> ------=_NextPart_000_000E_01C8E6D2.031FDE80 Content-Type: image/gif; name=quot;10.gifquot; Content-Transfer-Encoding: base64
  • 32. HEADER*f.mx.mail.yahoo.com 0.9631 1 FROM*carey 0.9870 1 Subject*great 0.9964 1 Subject*little 0.9955 1 Subject*helpers 0.9631 1 Subject*your 0.8795 1 Subject*health. 0.9834 1 Subject*for+Subject*your 0.8975 1 center+bordercolor 0.9954 1 mshtml+6.00.2900.2670 0.9957 1 body+body 0.9961 1 body+table 0.9436 1 here+font 0.9149 1 border+href 0.8995 1 6.00.2900.2670+name 0.9957 1 content-type+meta 0.8783 1 head+title 0.9251 1 div+align 0.8783 1 size+click 0.9299 1 IMAGE* 0.9999 1 level97: 1.0000 in 33 [ms]
  • 33. „A töltelékszavak lerontják a felismerés hatékonyságát ...” “...Spamre nem jellem- ző szavakat tesznek bele, így fog átjutni a spamszűrőn. Ha taní- tod, akkor mérgezi az adatbázist, sokkal rosszabbul fog működ- ni.”
  • 34. Received:from dsldevice.lan (x.x.x.x.orange.es[85.60.30.163]) Subject: Give freedom to the desires <szöveges rész a lenti szósalátával> Content-Type: text/html; charset=quot;Windows-1252quot; Content-Transfer-Encoding: quoted-printable <META http-equiv=Content-Type content=quot;text/html; charset=Windows-1252quot;> <META content=3Dquot;MSHTML 6.00.2720.1081quot; name=GENERATOR> <STYLE></STYLE></HEAD> <BODY bgColor=#ffffff><DIV align=center><FONT face=Comic Sans MS size=3>A better way to give up smoking.</FONT></DIV><DIV align=center><FONT face=Comic Sans size=3>Your new source of great health.</FONT></DIV> <DIV><FONT face=Comic Sans MS size=3></FONT>&nbsp;&nbsp; </DIV><DIV align=center><FONT face=Comic Sans size=2><A href=quot;http://q.bay.livefilestore.com/y1py...9A/gqoet.htmquot;> Here!</A></FONT></DIV><BR><BR><BR><BR><BR> exporatory euroaquilo equilivent esthesises entogenous eurobridge ethermeter fBTERMINFO enterozoan februarius
  • 35. HEADER*dsldevice.lan 0.9944 1 FROM*charles 0.9845 1 Subject*give 0.9953 1 Subject*freedom 0.8816 1 Subject*desires 0.9902 1 windows-1252+meta 0.9981 1 charset+windows-1252 0.9799 1 windows-1252+content-transfer-encoding 0.9716 1 generator+style 0.8786 1 here!+font 0.9958 1 size+better 0.9952 1 size+your 0.8784 1 div+align 0.8776 1 quoted-printable+the 0.9769 1 bgcolor+div 0.8806 1 you+dreamt 0.9893 1 which+one 0.9963 1 health.+font 0.9808 1 URL*livefilestore.com 0.9771 1 level73: 1.0000 in 27 [ms]
  • 36. Received: from x-x-x-x.aaa.com.br (unknown[200.138.161.196]) From: quot;Mckenzie Lavinderquot; <wwinflation@dialusformurder.com> To: quot;xxxquot; <xxx@xxxx.hu> Subject: Actually you do not try them? Content-Type: text/plain; charset=quot;iso-8859-15quot; <szöveges rész összefüggéstelen szavakból álló mondatokkal> <A href=quot;http://qtk8q.bay.livefilestore.com/yw/imjl.htmquot;> <IMG alt=quot;As sunkenquot; hspace=0 src=quot;http://cufbtg.bay.livefilestore.com/y1pBw...g/jskd.jpgquot; align=baseline border=0></A></DIV> <DIV align=left><FONT face=Bookman Old Style size=1>But sold? Is by consequence indistinguishable. Is therefore It viewer. For counteract. At to broaden. on by supplementary seriously sentiment. avoid at twist. my what, dangerous the pipes.</FONT></DIV> <DIV align=left><FONT face=Bookman Old Style size=1>Which disappear. He is ignorant, repose. you timetable faculty. That easy it welch appellant. by go prescribed broken misguided. mistress the mindless. prophet social a hive. To be violate master.</FONT></DIV>
  • 37. Subject*actually 0.9863 1 Subject*you 0.9843 2 Subject*not 0.9956 2 Subject*try 0.9952 1 Subject*them 0.9924 1 charset+iso-8859-15 0.9808 1 align+baseline 0.9808 1 border+div 0.9416 1 URL*livefilestore.com 0.9771 1 hspace=0+src 0.9480 1 div+align 0.8776 1 bgcolor+div 0.8810 1 generator+style 0.8786 1 baseline+border 0.9838 1 size+but 0.9952 1 size+which 0.9528 1 level78: 1.0000 in 58 [ms]
  • 38. Magyar nyelvű spam Received:from 3lyw4 (x.x.x.x.vodafone.hu[89.223.208.212]) From: =?ISO-8859-1?Q?Anikó?= <balogh.aniko@vipmail.hu> Subject: Nyerj LCD TV-t! To: sj@xxxx.hu Content-Type: text/plain; charset=quot;ISO-8859-1quot; Reply-To: balogh.aniko@vipmail.hu Hello! Szívesen néznéd Te is a filmeket egy nagyképernyos LCD TV-n, de nincs rá pénzed? Akkor nyerj egyet! Csak egy sms-t kell elküldened, és máris jó esélyed van rá, hogy jelképes áron vásárolhasd meg álmaid nagyképernyos plazmatv-jét! Nézd meg ezt az oldalt, megéri! http://www.matutinyersz.eu/
  • 39. FROM*vipmail.hu 0.9877 1 FROM*anikó 0.9631 1 HEADER*3lyw4 0.9888 1 egy+sms-t 0.9631 1 van+hogy 0.0202 1 phrase: 0.8139 RBL checking: 212.208.223.89.zen.spamhaus.org surbl check for matutinyersz.eu (0) took 0 ms FROM*vipmail.hu 0.9877 2 FROM*anikó 0.9631 2 HEADER*3lyw4 0.9888 2 egy+sms-t 0.9631 1 filmeket 0.9718 1 van+hogy 0.0202 1 van 0.1005 1 sms-t 0.9631 1 hogy 0.1005 1 mix: 0.8703 megéri! 0.9631 1 caught by rbl RBL0*89.223.208.212 0.9999 1 level76: 0.9797 in 28 [ms]
  • 40. Received: from mx2.xxxx.hu (mx2.xxxx.hu [195.xx.xx.xx]) Received: from 192.168.1.1(x.x.x.x.pool.tvnet.hu[85.238.82.84]) From: quot;Molnár Zsoltquot; <molnarzsolt2007@gmail.com> To: <xx@xxxx.hu> Subject: Címlista Tisztelt Hölgyem/ Uram! Megrendelhető nálam az alábbi email címlista: - 200.000 magyarországi vállalkozás email címe, tetszés szerinti csoportosításban (összesítve, illetve számos kategória külön is). - 400.000 magyarországi magán email cím. Továbbá el tudom vállalni az email kampány lebonyolítását (kiküldés), valamint tudok ajánlani email címeket gyűjtő, valamint hírlevél kiküldő programot. Valamennyi címlistát idén, 2008. januárjában allítottam össze, a hibaszázalék mindössze 5-10 százalék, vagyis aktuálisabb, mint szinte valamennyi más hasonló adatbázis. Üdvözlettel, Molnár Zsolt
  • 41. Subject*címlista 0.9564 1 uram!+megrendelhető 0.9564 1 megrendelhető+nálam 0.9564 1 részletes+tájékoztatót 0.9564 1 email+címlista 0.9564 1 valamennyi+címlistát 0.9564 1 tudok+ajánlani 0.9040 1 küldök+illetve 0.9564 1 email+címem 0.9564 1 vállalkozás+email 0.9564 1 magyarországi+magán 0.9564 1 bármilyen+felmerülő 0.9564 1 alábbi+email 0.9564 1 tájékoztatót+küldök 0.9564 1 illetve+válaszolok 0.9564 1 hasonló+adatbázis. 0.9564 1 válaszolok+bármilyen 0.9564 1 számos+kategória 0.9564 1 címlista+200.000 0.9564 1 magyarországi+vállalkozás 0.9564 1 Üdvözlettel+molnár 0.9564 1 molnár+zsolt 0.9564 1
  • 42. Received: from mobilier1 (dslXXXX.pool.t-online.hu [78.92.82.147]) From: Kontra =?ISO-8859-1?Q?György?= <flexen2@freemail.hu> To: <xx@xxxx.hu> Subject: =?ISO-8859-1?Q?Bemutatkozás?= X-DCC--Metrics: mail02a.mail.t-online.hu 0; Body=1 Fuz1=1 Fuz2=1 <html><head><title>Tisztelt Hölgyem</title></head><body> <p align=quot;leftquot;>Tisztelt Hölgyem/Uram! <br>Kérem engedje meg hogy, bemutatkozzunk pár másodperc alatt. <br> Tekintse meg szórólapunkat, és ha felkeltettük érdeklõdését tekintse meg web oldalunkat és keressen fel személyesen vagy telefonon. </p> <a href=quot;http://www.mobilier.huquot;>Tekintse meg aktuális akciónkat!</ a></p><a href=quot;http://www.mobilier.huquot;><img border=quot;0quot; src= quot;http://www.freeweb.hu/mobilier115/szoro1.jpgquot; width=quot;439quot; height=quot;621quot;></a><p align=quot;leftquot;>Köszönjük a türelmét!<br> Üdvözlettel: Kontra György<br> Az Ön e-mail címe valamely nyilvános, mindenki által elérhetõ adatbázisból származik. Ez az e-mail nem minősül spamnek, hanem a 2001. évi CVIII. Törvény 14. §-ban elõírt &quot;hozzájárulás&quot; kérés az informáláshoz. Amennyiben a továbbiakban nem kíván ilyen üzenetet kapni, kérjük, jelezze ezt egy válasz e-mailben. Ha levelünkkel zavartuk, elnézést kérünk.<br>
  • 43. HEADER*78.92.82.147 0.9631 1 HEADER*mobilier1 0.9631 1 FROM*Kontra =?ISO-8859-1?Q?Gy=F6rgy?= <flexen2@freemail.hu> 0.9631 1 Subject*bemutatkozás 0.9631 1 microsoft+frontpage 0.9953 1 frontpage.editor.document+meta 0.9631 1 content+frontpage.editor.document 0.9952 1 content-language+content 0.9499 1 title+tisztelt 0.9631 1 keressen+fel 0.9631 1 engedje+meg 0.9822 1 hogy+bemutatkozzunk 0.9631 1 oldalunkat+href 0.9631 1 windows-1250+title 0.9631 1 URL*mobilier.hu 0.9631 1 URL*freeweb.hu 0.9631 1 kérjük+jelezze 0.9040 1 alatt.+tekintse 0.9631 1 jelezze+ezt 0.9631 1 web+oldalunkat 0.9631 1 e-mail+nem 0.9631 1 spamnek+hanem 0.9631 1 hanem+2001. 0.9845 1 2001.+évi 0.9845 1 évi+cviii. 0.9845 1 cviii.+törvény 0.9747 1 törvény+14. 0.9747 1
  • 44. Bayes mérgezés Date: Tue, 15 Jul 2008 10:57:20 +0100 From: quot;Annequot; <m@teszt.hu> To: quot;Vickiequot; <sj@xxxx.hu> X-Abcde: ajaja ahah aua akakaka akaka Subject: Re: attack on spam filters I agree with you!<br> <font color=”white”>ajaj ajaju azaha azazazz akak</font> <!-- jaja ajajaj ajah uzauaz u azuua zuazau ahaha -->
  • 45. Hogyan lehet legyőzni a statisztikai spamszűrőket?