Reply
Contributor
Posts: 8
Registered: ‎06-20-2006

Comcast spam email filter - letting through obvious spam

SUBJECT:  You've Won Subway for a W 

FROM:   The Right Pros.  [contact@ECampingLife.com]

TO:  "Blank" 

 

I have the Comcast spam filter set to on and emails with the above consistently come to my in box. 

 

I called Comcast and they said you have to talk to Nortons to set additional email filters. 

 

These look like obvious spam to me, why is the Comcast email filter so useless?  This filter used to be pretty good.  Has Comcast delegated this to Nortons.  Now we have to set additional filters with Nortons to do what Comcast should do?

 

Deb

Official Employee
cc_adame
Posts: 320
Registered: ‎09-13-2010

Re: Comcast spam email filter - letting through obvious spam

Hi Deb,

 

Would you please post the headers for that message (omitting any personal information such as your email address)?

 

Thanks,

 

Adam

--
Adam
Comcast National Engineering
Contributor
Posts: 8
Registered: ‎06-20-2006

Re: Comcast spam email filter - letting through obvious spam

[ Edited ]

Sure - Example #1 -  wingdings in SUBJECT & TO "blank"

 

Return-Path: teetotummidwinterlyofficiouniting@prothalamion.nicaaiwan.info
Received: from imta31.emeryville.ca.mail.comcast.net (LHLO
 imta31.emeryville.ca.mail.comcast.net) (76.96.30.41) by
 sz0035.ev.mail.comcast.net with LMTP; Mon, 16 May 2011 07:10:32 +0000 (UTC)
Received: from denunciasflabbier.com ([94.63.207.21])
 by imta31.emeryville.ca.mail.comcast.net with comcast
 id k7AV1g03M0UDzvA0X7AWc7; Mon, 16 May 2011 07:10:32 +0000
X-CAA-SPAM: F00000
X-Authority-Analysis: v=1.1 cv=ajJ5rvsquorhbllikbC2fpmUqV9y6g46114pOHb6Cg0=
 c=1 sm=1 a=y76LeHf4VNYA:10 a=jPJDawAOAc8A:10 a=45gxm+Zt9VvZ1d5mpckH1Q==:17
 a=IcEL6S5IS7-xa7TBNesA:9 a=PqttTimVKqVsPw17Sa8A:7 a=J-IArlpgtJQA:10
 a=45gxm+Zt9VvZ1d5mpckH1Q==:117
From: match.com <enjoinder.squares@gashing.empressement.concourses.nicaaiwan.info>
Subject: =?ISO-8859-1?Q?=0B=03=06=1A=12=12Br=0Bowse=20Photos=20of=20S=04in=1Bgle=19s=03=20=19in=20Your=20Area?=
X-ID: 56851|64fc5322085c95f129dea1cce805cf39
Content-Transfer-Encoding: 8bit
Content-Type: text/html

 

Example #2 - Wingdings in FROM

 

Return-Path: 3eb.4.135483787-179514343@ecampinglife.com
Received: from imta11.emeryville.ca.mail.comcast.net (LHLO
 imta11.emeryville.ca.mail.comcast.net) (76.96.30.22) by
 sz0035.ev.mail.comcast.net with LMTP; Sun, 15 May 2011 17:28:41 +0000 (UTC)
Received: from mta1474.mail.mud.yahoo.com ([66.94.239.95])
 by imta11.emeryville.ca.mail.comcast.net with comcast
 id jtUg1g00M24BVfE0BtUgY5; Sun, 15 May 2011 17:28:41 +0000
X-CAA-SPAM: F00000
X-Authority-Analysis: v=1.1 cv=aIurWeKnMdS2duHFLngIYl3/INFMLPK1/cw/aPpAbcY=
 c=1 sm=1 a=T8LtfaS58T0A:10 a=C5bm_7Vu_xoA:10 a=er0Rx61hBecA:10
 a=jPJDawAOAc8A:10 a=Qw7k45Kf9bAA:10 a=7yHRj6vIr27F63tHxL+Gew==:17
 a=SSmOFEACAAAA:8 a=gBWQVfM3AAAA:8 a=CjxXgO3LAAAA:8 a=YEv8BfM-qTVJF0I4nCgA:9
 a=BClWw3guzV8XFpH1D8IA:7 a=wPNLvfGTeEIA:10 a=csmeakhAoqwA:10
 a=d_fPSmgxd3UA:10 a=rC2wZJ5BpNYA:10 a=7yHRj6vIr27F63tHxL+Gew==:117
Received: (qmail 85636 invoked by uid 6007); 15 May 2011 17:28:40 -0000
X-Yahoo-Forwarded: from ( email address removed)
Return-Path: <3eb.4.135483787-179514343@ecampinglife.com>
Received-SPF: pass (mta1474.mail.mud.yahoo.com: domain of 3eb.4.135483787-179514343@ecampinglife.com designates 209.192.208.46 as permitted sender)
 ZWFwIEFpcmxpbmUgVGlja2V0cy4gQm9vayBOb3chICAgIAogICAgCiAgCiAg
 CiAgICAKICAgIAogIAogICAgCiAgICAKICAgIAogICAgCgogICAgQWlybGlu
 ZSB0aWNrZXRzIGdpdmUgeW91IHRoZQoKCWZyZWVkb20gb2YgYWR2ZW50dXJl
 LgogICAgCgogICAgCgogICAgRGlzY292ZXIgeW91cnNlbGYgYXMgeW91IGRp
 c2NvdmVyIHRoZSB3b3JsZC4KICAgIAoKICAgIAogICAgCiABMAEBAQE-
X-YMailISG: XCFN9ascZAqOnmAHWiBXIqu3uKMKXiZia57Q_JNEN2hkCZHE
 PHg1DvjgCjOx2JgPf.g0efIDmDap8kzK2DNfS.iTNZGd.3p7nP0wTuB7pGAv
 fM82rCaRR0wK9vZM3BT.ktkTdA9RL9onIjvZ8JqYfNJoVUuHmGfkuGBW6bSb
 9EtkCqKG3QCVvw2ijV1sifdSQS_JYyJ2q30M6LjOcnmehPRmUvC1_sYWo8fe
 WR5WIBued4BvW9PF5Dl0A4Ql4KxB6iiviXdIJAmUYUtBapSRUf.ZaNUoE2NA
 Z8c_hWTh0Mjgs7BcWFA68b29vkb_MY3DrbZ1psKWHJ1TcSi3WBo.EqYGSK7m
 _CGK3kfnjlrl34sAaLHjqBFTONvZJx0PRHib77MYxfJBq3UpRcNvoBbyGzTe
 CYpRo5cDSmz8P0VGxpatuwtv0iNnPzgv4YaG5Hp8W2XP3fP8G36seL2zH9es
 GJIrQWYDU2daiQmpz5s7aZBTcKIf04miNbUV1HDmKzGGKjx8VFXTEVA5uC4b
 CdKhkxdTYMAu9KHHop13Fn0JeHnb48q8gBhvbn41GqjvN3DpvvHB3wLuIFMQ
 rkk5mpyjbxrIgxfLX9VrR5biIl1Sh95GBMhPXmMG_Tqgr3gzVd388JfFzobI
 eZvev2_FPSxOELq8HWnBC0Ng8Mt1B8JrO.hCJxwNaKtcbf8hvKcd4_vLXwDP
 U7sOPGyuAvm8YmdQ4LBfL.9qzgt7LCXctCbnbunUzsBTUXFUoxFx4twdDddw
 oNc._8K4afzZ3.BFuCBCVzrKGO1dwI.8mGS441_KysS9RY4O2sPc69Ee2et1
 WJwXVaXniGUqPFbdRENpA0iIOAtOlsYAK0bl4gMnzsApauw_74LKSuRcK29j
 xlZ.gXB0wjeFwF_Vq9L7USM47JQKDAGCiJSxegDT_Zub6MlZhh66S3E94M0_
 d3knvWXbSIaBmTBNw0ZJgVqGU1tZvzvpuEd29Zp_S8CFsCBmK4DtoShyQhOE
 PDryLuwprL_v9_YMGHIlXCrNLrlu_4qwWiBEoOsmkUxI4jupo8lvTu5iCWMw
 .KuEmF6LhJvB.qEDSCpdXqWwmb3UPOllcQquYEdIY0kx.R4RvvULcCYXZOj7
 d4xEWFnYywHCK4VFt83TDR5WY1ZTbqRUXjke9vvYGfHyBbtX6PsoES6gQ2UQ
 iSwUlVxVzdd1Q7FPp4SUPls2X5GOVUXXLiFsmlnIys21RtZKXMO2fhuF0iuI
 ZjXl3iuptLoMnrta314lPhGX65UTV1WRv_5feyJr4oe5pbt8fk7NB01D1_Cb
 2xUdpHhmIcBiq0wI4TbDk5Ua3iUsJURkQiI43xf4HeiFWaIk6RcQOKikA63w
 VRyvx37TrPyY_2iLtvXGFBDZf3g3zfP8I0k93isFs_6Tp5DFzGy4BlaJu3C_
 n.Sa6frhQlKe3jDmAqMEf7I6IRf4XrkYnNC4OMYIdhq.fCU9BAAJTeqM5NLU
 uOfAHgQnnnvnS2ay60YjvUS7YRuh85iQabtGb3ZupYb4bpuAGbbeQNmm0qd4
 _1_izOGUhy4UWqkGTgeCjtUcujV2JjvbjhihkjBs3Knnj5xZ8VNqpSbHfGCJ
 0HVFJZHY9k4Tp.J82T9Bp1qhPyQRmX3IURipED9_xnBHmkvocLtpR9dnRs.U
 MnwW31xHZIRcoTJpmXvQ9H10azEKtdfX2TU82YT2hrnp8bGsRqkYp3I.UPFf
 qX0fg1ycWqw79h7SSW9P8bLGyxrA_2xdPVnj0oTloQrRsS6UiNHHJB7PH9RC
 VyUiJGKCpgUCe2L6O3TJv4kL8NljJfmiid3pLjCMHKZTiezmFatNOgEx
X-Originating-IP: [209.192.208.46]
Authentication-Results: mta1474.mail.mud.yahoo.com  from=ECampingLife.com; domainkeys=pass (ok);  from=ECampingLife.com; dkim=pass (ok)
Received: from 127.0.0.1  (EHLO webcrm.ECampingLife.com) (209.192.208.46)
  by mta1474.mail.mud.yahoo.com with SMTP; Sun, 15 May 2011 10:28:40 -0700
domainkey-signature: a=rsa-sha1; c=nofws; s=k1; d=ECampingLife.com; q=dns;
 h=message-id:reply-to:from:subject:date:to:mime-version:content-type;
 b=lhJh6ACAj0pFcQkkoYSezlBuAui+dlwSOb/B5JbFehcU1EQbCBeLISRzAe8KoXJMlI914NyMvt8oHPxW5ynevnzb9WD41yiDqOHypQRMG91czWQbUpUfcqkrkoLDJjjym7YIwEokKAgwx0tKx4dbF4tk3P7Dm9P5+uY3fCEcqss=;
DKIM-Signature: v=1; a=rsa-sha1; d=ECampingLife.com; s=k1;
 c=relaxed/relaxed; q=dns/txt; t=1305480508;
 h=x-fbl:message-id:reply-to:from:subject:date:to:mime-version:content-type;
 bh=6SItWjxDSoLWgZnXhvvpf27wlms=;
 b=PIzI/vFgsmEtZVki0UQnoV8F2YFuggbP4W25AtGKQC1PEOaVJyK0+rsDV23EVoPVpyxoX97qyHvFYeROua10D4neezBWPdBZTdWObMp0HjD1T57U65zLhCkD431M8mrsATOdDCgvMuVDyxYWc0j0LVzGxxtHfirW2Wh9yk690aI=
X-FBL: M2ViLjE2Ljk2MDAwMDAwYzQ1YjI4LjEzNTQ4Mzc4Ny0xNzk1MTQzNDMuYmFsbGRzPXlhaG9vLmNvbQ==
Message-Id: <MFbhjfbededmghgFD@ECampingLife.com>
Reply-To: <contact@ECampingLife.com>
From: =?ISO-8859-1?Q?=16G=1Bovernment=20G=15rants=20=17?= <contact@ECampingLife.com>
Subject: =?ISO-8859-1?Q?Apply for a government grant  =A0=A0 =A0 =A0 =A0?=
Date: Mon, 16 May 2011 17:01:42 GMT
To: (email address removed)
MIME-Version: 1.0
Content-Type: multipart/alternative;boundary="Part.387207831.1509107650"

 

These look like obvious spam to me.  Why would the TO, FROM, AND SUBJECT be filled with wingdings and TO left "BlanK" if sender is not trying to get past spam filters.  Thanks for you interest.  I hope Comcast can improve the spam filter.  Deb

 

 

New Visitor
Posts: 1
Registered: ‎07-09-2009

Re: Comcast spam email filter - letting through obvious spam

I am having the same issue, usually 3-5 emails a day with wingdings in the subject and often nothing in the body of the email.

Contributor
Contributor
Posts: 24
Registered: ‎10-13-2003

Re: Comcast spam email filter - letting through obvious spam

[ Edited ]

Thanks Deb for asking this question.  I just hit the help forums seeing if anyone else was dealing with this besides myself.   I see I'm not the only one.   Not only am I getting the same type of spam daily with the strange characters in the subject line but I get them one right on top of the other.  I actually have a total of 85 addys in my spam folder.  I hate to say this but I don't get even close to the same amount of spam in my gmail account and you'd assume I would as I use it for both work and purchasing on line so there is more access to that email.  I'm pretty vigilant and am curious why this is happening with my comcast email.  I use it primarily for family and friends but out of nowhere I started getting ad's, oddball emails with strange characters and coupons.  I was wondering if outlook had something to do with it?  Sometimes I am getting so much spam outlook crashes.

Contributor
Posts: 8
Registered: ‎06-20-2006

Re: Comcast spam email filter - letting through obvious spam

You all are welcome and thanks for taking the time to post support.  It took my Outlook some time but it now catches most of these and moves them to JUNK, but Comcast continues to let them go to my INBOX.  Again I say Comcast spam filter had been doing a good job, but not now.  Spammers have figured out a way to out fox the spam filter at Comcast, I hope they improve it soon.   What say you Adam? 

Official Employee
cc_adame
Posts: 320
Registered: ‎09-13-2010

Re: Comcast spam email filter - letting through obvious spam

Ballds,

 

You're correct that these messages are not currently be caught by our filters - I'm looking into why they're taking so long to catch up. We do apologize for the inconvenience.

 

It can be tricky, as these messages are never quite the same. Never the same ip address and something's always changed in the body, even if it's an additional period it would change the signature of the message as a whole.

 

That said, we're always working on improving our filters... something we will never stop working on. Thank you for bringing this to our attention and providing the header information.

 

 

-Adam

 

 

 

--
Adam
Comcast National Engineering
Contributor
Posts: 8
Registered: ‎06-20-2006

Re: Comcast spam email filter - letting through obvious spam

Thank you Adam.  I look forward to the improved Comcast filter.   Deb

New Visitor
guru66
Posts: 1
Registered: ‎05-29-2010

Re: Comcast spam email filter - letting through obvious spam

Hi Adam,

  I also have been getting an increasing amount of this type of spam in my Comcast email box.  As I configure and run spamassassin for several servers at work, I just thought I would point out that all of these mails have non-ISO 8859 Latin1 characters in the Subject line.  That should make them easy to discriminate!

 

Thanks!


Email Expert
CCCarole
Posts: 28,873
Registered: ‎05-21-2006

Re: Comcast spam email filter - letting through obvious spam

Post was removed to a secure area because it contains personal information.