I have the Comcast spam filter set to on and emails with the above consistently come to my in box.
I called Comcast and they said you have to talk to Nortons to set additional email filters.
These look like obvious spam to me, why is the Comcast email filter so useless? This filter used to be pretty good. Has Comcast delegated this to Nortons. Now we have to set additional filters with Nortons to do what Comcast should do?
Sure - Example #1 - wingdings in SUBJECT & TO "blank"
Return-Path: email@example.com Received: from imta31.emeryville.ca.mail.comcast.net (LHLO imta31.emeryville.ca.mail.comcast.net) (188.8.131.52) by sz0035.ev.mail.comcast.net with LMTP; Mon, 16 May 2011 07:10:32 +0000 (UTC) Received: from denunciasflabbier.com ([184.108.40.206]) by imta31.emeryville.ca.mail.comcast.net with comcast id k7AV1g03M0UDzvA0X7AWc7; Mon, 16 May 2011 07:10:32 +0000 X-CAA-SPAM: F00000 X-Authority-Analysis: v=1.1 cv=ajJ5rvsquorhbllikbC2fpmUqV9y6g46114pOHb6Cg0= c=1 sm=1 a=y76LeHf4VNYA:10 a=jPJDawAOAc8A:10 a=45gxm+Zt9VvZ1d5mpckH1Q==:17 a=IcEL6S5IS7-xa7TBNesA:9 a=PqttTimVKqVsPw17Sa8A:7 a=J-IArlpgtJQA:10 a=45gxm+Zt9VvZ1d5mpckH1Q==:117 From: match.com <firstname.lastname@example.org> Subject: =?ISO-8859-1?Q?=0B=03=06=1A=12=12Br=0Bowse=20Photos=20of=20S=04in=1Bgle=19s=03=20=19in=20Your=20Area?= X-ID: 56851|64fc5322085c95f129dea1cce805cf39 Content-Transfer-Encoding: 8bit Content-Type: text/html
Example #2 - Wingdings in FROM
Return-Path: email@example.com Received: from imta11.emeryville.ca.mail.comcast.net (LHLO imta11.emeryville.ca.mail.comcast.net) (220.127.116.11) by sz0035.ev.mail.comcast.net with LMTP; Sun, 15 May 2011 17:28:41 +0000 (UTC) Received: from mta1474.mail.mud.yahoo.com ([18.104.22.168]) by imta11.emeryville.ca.mail.comcast.net with comcast id jtUg1g00M24BVfE0BtUgY5; Sun, 15 May 2011 17:28:41 +0000 X-CAA-SPAM: F00000 X-Authority-Analysis: v=1.1 cv=aIurWeKnMdS2duHFLngIYl3/INFMLPK1/cw/aPpAbcY= c=1 sm=1 a=T8LtfaS58T0A:10 a=C5bm_7Vu_xoA:10 a=er0Rx61hBecA:10 a=jPJDawAOAc8A:10 a=Qw7k45Kf9bAA:10 a=7yHRj6vIr27F63tHxL+Gew==:17 a=SSmOFEACAAAA:8 a=gBWQVfM3AAAA:8 a=CjxXgO3LAAAA:8 a=YEv8BfM-qTVJF0I4nCgA:9 a=BClWw3guzV8XFpH1D8IA:7 a=wPNLvfGTeEIA:10 a=csmeakhAoqwA:10 a=d_fPSmgxd3UA:10 a=rC2wZJ5BpNYA:10 a=7yHRj6vIr27F63tHxL+Gew==:117 Received: (qmail 85636 invoked by uid 6007); 15 May 2011 17:28:40 -0000 X-Yahoo-Forwarded: from ( email address removed) Return-Path: <firstname.lastname@example.org> Received-SPF: pass (mta1474.mail.mud.yahoo.com: domain of email@example.com designates 22.214.171.124 as permitted sender) ZWFwIEFpcmxpbmUgVGlja2V0cy4gQm9vayBOb3chICAgIAogICAgCiAgCiAg CiAgICAKICAgIAogIAogICAgCiAgICAKICAgIAogICAgCgogICAgQWlybGlu ZSB0aWNrZXRzIGdpdmUgeW91IHRoZQoKCWZyZWVkb20gb2YgYWR2ZW50dXJl LgogICAgCgogICAgCgogICAgRGlzY292ZXIgeW91cnNlbGYgYXMgeW91IGRp c2NvdmVyIHRoZSB3b3JsZC4KICAgIAoKICAgIAogICAgCiABMAEBAQE- X-YMailISG: XCFN9ascZAqOnmAHWiBXIqu3uKMKXiZia57Q_JNEN2hkCZHE PHg1DvjgCjOx2JgPf.g0efIDmDap8kzK2DNfS.iTNZGd.3p7nP0wTuB7pGAv fM82rCaRR0wK9vZM3BT.ktkTdA9RL9onIjvZ8JqYfNJoVUuHmGfkuGBW6bSb 9EtkCqKG3QCVvw2ijV1sifdSQS_JYyJ2q30M6LjOcnmehPRmUvC1_sYWo8fe WR5WIBued4BvW9PF5Dl0A4Ql4KxB6iiviXdIJAmUYUtBapSRUf.ZaNUoE2NA Z8c_hWTh0Mjgs7BcWFA68b29vkb_MY3DrbZ1psKWHJ1TcSi3WBo.EqYGSK7m _CGK3kfnjlrl34sAaLHjqBFTONvZJx0PRHib77MYxfJBq3UpRcNvoBbyGzTe CYpRo5cDSmz8P0VGxpatuwtv0iNnPzgv4YaG5Hp8W2XP3fP8G36seL2zH9es GJIrQWYDU2daiQmpz5s7aZBTcKIf04miNbUV1HDmKzGGKjx8VFXTEVA5uC4b CdKhkxdTYMAu9KHHop13Fn0JeHnb48q8gBhvbn41GqjvN3DpvvHB3wLuIFMQ rkk5mpyjbxrIgxfLX9VrR5biIl1Sh95GBMhPXmMG_Tqgr3gzVd388JfFzobI eZvev2_FPSxOELq8HWnBC0Ng8Mt1B8JrO.hCJxwNaKtcbf8hvKcd4_vLXwDP U7sOPGyuAvm8YmdQ4LBfL.9qzgt7LCXctCbnbunUzsBTUXFUoxFx4twdDddw oNc._8K4afzZ3.BFuCBCVzrKGO1dwI.8mGS441_KysS9RY4O2sPc69Ee2et1 WJwXVaXniGUqPFbdRENpA0iIOAtOlsYAK0bl4gMnzsApauw_74LKSuRcK29j xlZ.gXB0wjeFwF_Vq9L7USM47JQKDAGCiJSxegDT_Zub6MlZhh66S3E94M0_ d3knvWXbSIaBmTBNw0ZJgVqGU1tZvzvpuEd29Zp_S8CFsCBmK4DtoShyQhOE PDryLuwprL_v9_YMGHIlXCrNLrlu_4qwWiBEoOsmkUxI4jupo8lvTu5iCWMw .KuEmF6LhJvB.qEDSCpdXqWwmb3UPOllcQquYEdIY0kx.R4RvvULcCYXZOj7 d4xEWFnYywHCK4VFt83TDR5WY1ZTbqRUXjke9vvYGfHyBbtX6PsoES6gQ2UQ iSwUlVxVzdd1Q7FPp4SUPls2X5GOVUXXLiFsmlnIys21RtZKXMO2fhuF0iuI ZjXl3iuptLoMnrta314lPhGX65UTV1WRv_5feyJr4oe5pbt8fk7NB01D1_Cb 2xUdpHhmIcBiq0wI4TbDk5Ua3iUsJURkQiI43xf4HeiFWaIk6RcQOKikA63w VRyvx37TrPyY_2iLtvXGFBDZf3g3zfP8I0k93isFs_6Tp5DFzGy4BlaJu3C_ n.Sa6frhQlKe3jDmAqMEf7I6IRf4XrkYnNC4OMYIdhq.fCU9BAAJTeqM5NLU uOfAHgQnnnvnS2ay60YjvUS7YRuh85iQabtGb3ZupYb4bpuAGbbeQNmm0qd4 _1_izOGUhy4UWqkGTgeCjtUcujV2JjvbjhihkjBs3Knnj5xZ8VNqpSbHfGCJ 0HVFJZHY9k4Tp.J82T9Bp1qhPyQRmX3IURipED9_xnBHmkvocLtpR9dnRs.U MnwW31xHZIRcoTJpmXvQ9H10azEKtdfX2TU82YT2hrnp8bGsRqkYp3I.UPFf qX0fg1ycWqw79h7SSW9P8bLGyxrA_2xdPVnj0oTloQrRsS6UiNHHJB7PH9RC VyUiJGKCpgUCe2L6O3TJv4kL8NljJfmiid3pLjCMHKZTiezmFatNOgEx X-Originating-IP: [126.96.36.199] Authentication-Results: mta1474.mail.mud.yahoo.com from=ECampingLife.com; domainkeys=pass (ok); from=ECampingLife.com; dkim=pass (ok) Received: from 127.0.0.1 (EHLO webcrm.ECampingLife.com) (188.8.131.52) by mta1474.mail.mud.yahoo.com with SMTP; Sun, 15 May 2011 10:28:40 -0700 domainkey-signature: a=rsa-sha1; c=nofws; s=k1; d=ECampingLife.com; q=dns; h=message-id:reply-to:from:subject:date:to:mime-version:content-type; b=lhJh6ACAj0pFcQkkoYSezlBuAui+dlwSOb/B5JbFehcU1EQbCBeLISRzAe8KoXJMlI914NyMvt8oHPxW5ynevnzb9WD41yiDqOHypQRMG91czWQbUpUfcqkrkoLDJjjym7YIwEokKAgwx0tKx4dbF4tk3P7Dm9P5+uY3fCEcqss=; DKIM-Signature: v=1; a=rsa-sha1; d=ECampingLife.com; s=k1; c=relaxed/relaxed; q=dns/txt; t=1305480508; h=x-fbl:message-id:reply-to:from:subject:date:to:mime-version:content-type; bh=6SItWjxDSoLWgZnXhvvpf27wlms=; b=PIzI/vFgsmEtZVki0UQnoV8F2YFuggbP4W25AtGKQC1PEOaVJyK0+rsDV23EVoPVpyxoX97qyHvFYeROua10D4neezBWPdBZTdWObMp0HjD1T57U65zLhCkD431M8mrsATOdDCgvMuVDyxYWc0j0LVzGxxtHfirW2Wh9yk690aI= X-FBL: M2ViLjE2Ljk2MDAwMDAwYzQ1YjI4LjEzNTQ4Mzc4Ny0xNzk1MTQzNDMuYmFsbGRzPXlhaG9vLmNvbQ== Message-Id: <MFbhjfbededmghgFD@ECampingLife.com> Reply-To: <contact@ECampingLife.com> From: =?ISO-8859-1?Q?=16G=1Bovernment=20G=15rants=20=17?= <contact@ECampingLife.com> Subject: =?ISO-8859-1?Q?Apply for a government grant =A0=A0 =A0 =A0 =A0?= Date: Mon, 16 May 2011 17:01:42 GMT To: (email address removed) MIME-Version: 1.0 Content-Type: multipart/alternative;boundary="Part.387207831.1509107650"
These look like obvious spam to me. Why would the TO, FROM, AND SUBJECT be filled with wingdings and TO left "BlanK" if sender is not trying to get past spam filters. Thanks for you interest. I hope Comcast can improve the spam filter. Deb
Thanks Deb for asking this question. I just hit the help forums seeing if anyone else was dealing with this besides myself. I see I'm not the only one. Not only am I getting the same type of spam daily with the strange characters in the subject line but I get them one right on top of the other. I actually have a total of 85 addys in my spam folder. I hate to say this but I don't get even close to the same amount of spam in my gmail account and you'd assume I would as I use it for both work and purchasing on line so there is more access to that email. I'm pretty vigilant and am curious why this is happening with my comcast email. I use it primarily for family and friends but out of nowhere I started getting ad's, oddball emails with strange characters and coupons. I was wondering if outlook had something to do with it? Sometimes I am getting so much spam outlook crashes.
You all are welcome and thanks for taking the time to post support. It took my Outlook some time but it now catches most of these and moves them to JUNK, but Comcast continues to let them go to my INBOX. Again I say Comcast spam filter had been doing a good job, but not now. Spammers have figured out a way to out fox the spam filter at Comcast, I hope they improve it soon. What say you Adam?
You're correct that these messages are not currently be caught by our filters - I'm looking into why they're taking so long to catch up. We do apologize for the inconvenience.
It can be tricky, as these messages are never quite the same. Never the same ip address and something's always changed in the body, even if it's an additional period it would change the signature of the message as a whole.
That said, we're always working on improving our filters... something we will never stop working on. Thank you for bringing this to our attention and providing the header information.
-- Adam Comcast National Engineering // Customer Protection Team
I also have been getting an increasing amount of this type of spam in my Comcast email box. As I configure and run spamassassin for several servers at work, I just thought I would point out that all of these mails have non-ISO 8859 Latin1 characters in the Subject line. That should make them easy to discriminate!
It's now 2015 and I been getting the same spam as described years ago. The subject begins with a row of wingdings. I get two or three a day. The sender is a little changed each time. Perhaps if I could change the font in Outlook rules and alerts to wingdings I might be able to screen better. It would seem to me that a pro could block subjects with wingdings.
The best thing to do is keep marking them as spam so the filters will "learn". It takes a while. The reason you are getting them is that, as you say--------the sender keeps changing, which makes it hard for the filtering software to keep up with it. Spammers know this and use it to their advantage.
I am not a Comcast employee, I am a paying customer just like you! I am an XFINITY Forum Expert and I am here to help. For information on the program click here. We ask that you post publicly so people with similar questions may benefit from the conversation.
Was your question answered? Mark it as an accepted solution!
I am not a Comcast employee. I am a paying customer just like you! I am an XFINITY Forum Expert and I am here to help. We ask that you post publicly so people with similar questions may benefit.
Was your question answered? Mark it as an accepted solution!
I am not a Comcast employee.
Was your question answered? Mark it as a solution!