You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Benny Pedersen <me...@junc.org> on 2009/07/15 08:36:06 UTC
lottery spams
INTERNATIONAL LOTTERY COMMISSION FROM THE DESK OF THE VICE
PRESIDENT INTERNATIONAL PROMOTIONS / PRIZE AWARD DEPARTMENT Plaza Romano
N°19 Planta 5, 28011, MADRID, SPAIN Attn: Lucky Winner, We wish to congratulate
you over your email success in our computer Balloting. Your email address
drew and has won you the sum of 615,810 Euros(Six Hundred and Fifteen Thousand
Eight Hundred and Ten Euros)in SPANISH INTERNATIONAL E-MAIL AWARD PROMOTION
PROGRAM 2009 in cash credited to file with WINNING REFERENCE NUMBER: ESP/WIN/008/05/10/MA;
BATCH NUMBER:EURO/1007/444/606/08; LUCKY NUMBER:23-7-2-6-12-9; SERIAL NUMBER:6594;
and PROMOTION DATE : 10th July 2009.All Participants were selected through
a computer ballot system drawn from over 300,000 companies and 600,000 individual
email addresses selected from the web. To claim your winning prize, you are
to contact your appointed agent directly as soon as possible for the immediate
release of your winnings, with your full names,telephone numbers and fax
(If available) below
--
xpoint
Report header (was: Re: [OT] lottery spams)
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Wed, 2009-07-15 at 08:30 -0400, Daniel Schaefer wrote:
> > > * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> > > * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)
> > > * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
> >
> > Is your header formatted like this in Thunderbird or are you using a
> > different MUA? If Thunderbird, how do you get it formatted like that?
That's the format of the Report header, or rather the _REPORT_ template.
In this case copied raw from a terminal, without any MUA involved. I
tested the body dump with a specially crafted file -- for some proper
Bayes results for this very text only (without any header tokens
poisoning the result), I could not use the message as posted to the
list.
Keep in mind that MUAs *might* re-flow headers. I believe TB does not in
raw source view, but Evolution unfortunately does.
> I think I may have answered my own question. Correct me if I'm wrong but
> you have report_safe = 1 or 2
Sure, anytime. You're wrong. :)
$ grep ^report_safe /etc/mail/spamassassin/local.cf
report_safe 0
The report_safe 0 setting results in the Report header added by default
for spam, equivalent to this setting:
add_header spam Report _REPORT_
If you want the Report header for all mail instead, regardless of your
report_safe setting, add it to local.cf with 'all' instead of 'spam'.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: [OT] lottery spams
Posted by Daniel Schaefer <da...@performanceadmin.com>.
>> * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
>> * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)
>> * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
>>
>>
> Is your header formatted like this in Thunderbird or are you using a
> different MUA? If Thunderbird, how do you get it formatted like that?
>
I think I may have answered my own question. Correct me if I'm wrong but
you have report_safe = 1 or 2
--
Dan Schaefer
Web Developer/Systems Analyst
Performance Administration Corp.
Re: [OT] lottery spams
Posted by Daniel Schaefer <da...@performanceadmin.com>.
> * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> * 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)
> * 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
>
>
Is your header formatted like this in Thunderbird or are you using a
different MUA? If Thunderbird, how do you get it formatted like that?
--
Dan Schaefer
Web Developer/Systems Analyst
Performance Administration Corp.
Re: lottery spams
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Wed, 2009-07-15 at 08:36 +0200, Benny Pedersen wrote:
[ munged, pasted lottery spam body removed ]
What the...?! You mean the general rules, chanted over and over again,
to NOT dump spam here, don't apply to you? You've been around long
enough, to know how to behave. Or, well, maybe /you/ don't...
Anyway, even without the headers, here's my score. What's your problem?
* 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* 1.2 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)
* 2.9 KAM_LOTTO1 Likely to be a e-Lotto Scam Email
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}