You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by nadim <na...@khemir.net> on 2005/01/08 03:15:14 UTC
blocking korean 1 image mails
HI,
Spam from Korea really s... because you can't even read it :-)
I don't think I am the only one getting korean spam lately. One single honest
mail to a korean friend and you end up in a good-to-spam list.
The spam I get consist of a one single image. Is there something I can do to
mark them?
Cheers, Nadim.
Re: blocking korean 1 image mails
Posted by Thomas Arend <ml...@arend-whv.info>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Am Samstag, 8. Januar 2005 03:15 schrieb nadim:
> HI,
>
[..]
> The spam I get consist of a one single image. Is there something I can do
> to mark them?
I got not so many of these. I inspected one an it got a high score of 31.5
points. Question back: Why are your messages not scored high enough?
Thomas
PS: Here is the detailed report from one.
Content analysis details: (31.5 points, 5.0 required)
pts rule name description
- ---- ---------------------- --------------------------------------------------
1.2 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
3.7 HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
4.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
0.1 RCVD_BY_IP Received by mail server with no name
1.3 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
0.5 TA_urlQuestionmark URI: URL contains ? after / <<<=== This is one of
my own rules.
0.0 HTML_TEXT_AFTER_HTML BODY: HTML contains text after HTML close tag
0.1 HTML_80_90 BODY: Message is 80% to 90% HTML
0.1 HTML_TEXT_AFTER_BODY BODY: HTML contains text after BODY close tag
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5056]
0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
[cf: 100]
0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words
1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
[<http://dsbl.org/listing?69.227.205.124>]
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[69.227.205.124 listed in sbl-xbl.spamhaus.org]
1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: kasboesdf.com]
0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: synonymous6hoechst.com kasboesdf.com]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: synonymous6hoechst.com]
3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: synonymous6hoechst.com kasboesdf.com]
4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: synonymous6hoechst.com kasboesdf.com]
0.0 UPPERCASE_25_50 message body is 25-50% uppercase
0.0 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary
>
> Cheers, Nadim.
- --
icq:133073900
http://www.t-arend.de
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFB35f1He2ZLU3NgHsRAgd2AJ4+2V7WotwkbvLa3odAxhmAa6ivggCfVdRt
XFoXUoBGSDzfD2oWFlMsGDE=
=49IW
-----END PGP SIGNATURE-----