You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ron McKeating <R....@lboro.ac.uk> on 2004/05/14 11:10:03 UTC
Punctuation
Is anybody else seeing these spams where free yyy is advertised. The
words are made up of punctuation characters, almost like an email sig.
Do any of the standard rule sets now catch these.
ROn
--
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
Re: Punctuation
Posted by Nick Leverton <nj...@leverton.org>.
On Fri, May 14, 2004 at 10:49:24AM +0100, Nick Leverton wrote:
> > Here is one of the ones that got blocked.
I missed that detail, sorry. Try what I suggested with one of the ones
that got through (we really need to see that one to find out why, not
one of the ones that it stopped).
Nick
Re: Punctuation
Posted by Nick Leverton <nj...@leverton.org>.
On Fri, May 14, 2004 at 10:29:15AM +0100, Ron McKeating wrote:
> OK, there were many many copies of this came in a deluge over the last
> couple of days. I was off on a course so only just found out about it.
> Here is one of the ones that got blocked. Each one was different in
> subtle ways and some got through (lots) and some got blocked.
>
> Here is the link
>
> http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
X-Spam-Status: Yes, hits=11.5 required=5.0 tests=BAYES_60,
FORGED_RCVD_NET_HELO,MISSING_MIMEOLE,PRIORITY_NO_NAME,
RCVD_IN_BL_SPAMCOP_NET,RCVD_NUMERIC_HELO autolearn=no version=2.63
That would have been stopped here, entirely on standard SA rulesets and
without help from Bayes (though I do have surbl, chickenpox, etc as well).
How exactly did your machine score it ? Pipe it through "spamassassin -t"
to see the rules and scores, make it "spamassassin -D -t" if you need
to see more detail of the workings (you can post the latter output here,
if it's still not clear).
Nick
Re: Punctuation
Posted by "R.J.McKeating" <R....@lboro.ac.uk>.
----- Original Message -----
From: "Matthias Fuhrmann" <Ma...@stud.uni-hannover.de>
To: "Spamassassin-Users" <sp...@incubator.apache.org>
Sent: Friday, May 14, 2004 10:38 AM
Subject: Re: Punctuation
> On Fri, 14 May 2004, Ron McKeating wrote:
<snip>
> > subtle ways and some got through (lots) and some got blocked.
> >
> > Here is the link
> >
> > http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
>
> i got this result:
>
> Content analysis details: (12.1 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> 1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
> 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
> [score: 0.5013]
> 1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and
100
> [cf: 100]
> 1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
> 4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
> 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
> [Blocked - see
> <http://www.spamcop.net/bl.shtml?140.112.203.242>]
> 1.2 PRIORITY_NO_NAME Message has priority setting, but no X-Mailer
> 1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no
X-MimeOLE
>
Yeah they vary a lot, but quite a lot get through. I was wondering if there
was a rule specifically to detect words made out of punctuation symbols. As
this one was quite successfull I suspect there will be copycat ones. Though
such a rule would catch a lot of signatures.
Ron
> regards,
> Matthias
>
Re: Punctuation
Posted by Ron McKeating <R....@lboro.ac.uk>.
On Fri, 2004-05-14 at 13:12, Ron McKeating wrote:
> <snip>>
>
> OK sorry about that was off to lunch. ran it through and results can be
> seen at
>
> http://www.sprocket.lboro.ac.uk/~ron/results.txt.
>
> Cheers all for your thoughts and input.
>
One other thing we put in the
> PRIORITY_NO_NAME,SITEVOILAFR autolearn=no version=2.63
>
>
> Rule this morning so ignore the extra 10 points that gives
>
> Ron
> > Nick
--
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
Re: Punctuation
Posted by Ron McKeating <R....@lboro.ac.uk>.
On Fri, 2004-05-14 at 12:19, Nick Leverton wrote:
> On Fri, May 14, 2004 at 11:51:35AM +0100, Ron McKeating wrote:
>
> [ snip 58 unnecessarily quoted lines ]
>
> > OK I have changed it for one that got through same url
> >
> > http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
>
> That got stopped here:
>
> Spam-Status: Yes, hits=13.0 required=5.0 tests=BAYES_99,MISSING_MIMEOLE,
> PRIORITY_NO_NAME,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_SORBS,
> RCVD_IN_XBL,RCVD_IN_XBL_NOT_OPM autolearn=no version=2.63
>
> RCVD_IN_XBL is a rule I backported from SA 3.0 which looks like this
> (I know there are better ways to do it, but I was in a hurry :))
>
> # TODO This will be in SA 3.0.0, remove it then
> # From: "Jon Etkins" <eccles () mira ! net>
> # Date: 2004-03-09 16:45:58
> # XBL is the Spamhaus Exploits Block List: http://www.spamhaus.org/xbl/
> header RCVD_IN_XBL eval:check_rbl_txt('xbl', 'xbl.spamhaus.org.')
> describe RCVD_IN_XBL Received via a relay in Spamhaus XBL
> tflags RCVD_IN_XBL net
> # NB XBL duplicates OPM - we're keeping OPM for 2.63, so don't
> # score XBL unless it _isn't_ in OPM
> score RCVD_IN_XBL 0.001
> meta RCVD_IN_XBL_NOT_OPM RCVD_IN_XBL && ! RCVD_IN_OPM
> score RCVD_IN_XBL_NOT_OPM 2.5
>
> You've still been very shy as to what rules it did actually hit on your
> machine, etc :) So it's still hard to say how much else you'd need
> to change. You might need to delete and re-learn your bayes database
> if it's decided such mail is BAYES_00, for instance.
>
OK sorry about that was off to lunch. ran it through and results can be
seen at
http://www.sprocket.lboro.ac.uk/~ron/results.txt.
Cheers all for your thoughts and input.
> Nick
--
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
Re: Punctuation
Posted by Nick Leverton <nj...@leverton.org>.
On Fri, May 14, 2004 at 11:51:35AM +0100, Ron McKeating wrote:
[ snip 58 unnecessarily quoted lines ]
> OK I have changed it for one that got through same url
>
> http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
That got stopped here:
Spam-Status: Yes, hits=13.0 required=5.0 tests=BAYES_99,MISSING_MIMEOLE,
PRIORITY_NO_NAME,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_SORBS,
RCVD_IN_XBL,RCVD_IN_XBL_NOT_OPM autolearn=no version=2.63
RCVD_IN_XBL is a rule I backported from SA 3.0 which looks like this
(I know there are better ways to do it, but I was in a hurry :))
# TODO This will be in SA 3.0.0, remove it then
# From: "Jon Etkins" <eccles () mira ! net>
# Date: 2004-03-09 16:45:58
# XBL is the Spamhaus Exploits Block List: http://www.spamhaus.org/xbl/
header RCVD_IN_XBL eval:check_rbl_txt('xbl', 'xbl.spamhaus.org.')
describe RCVD_IN_XBL Received via a relay in Spamhaus XBL
tflags RCVD_IN_XBL net
# NB XBL duplicates OPM - we're keeping OPM for 2.63, so don't
# score XBL unless it _isn't_ in OPM
score RCVD_IN_XBL 0.001
meta RCVD_IN_XBL_NOT_OPM RCVD_IN_XBL && ! RCVD_IN_OPM
score RCVD_IN_XBL_NOT_OPM 2.5
You've still been very shy as to what rules it did actually hit on your
machine, etc :) So it's still hard to say how much else you'd need
to change. You might need to delete and re-learn your bayes database
if it's decided such mail is BAYES_00, for instance.
Nick
Re: Punctuation
Posted by Ron McKeating <R....@lboro.ac.uk>.
On Fri, 2004-05-14 at 10:57, Martin Hepworth wrote:
> Matthias
>
> OK so that one got caught score of 8.3 - what about one that didn;t
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Matthias Fuhrmann wrote:
> > On Fri, 14 May 2004, Ron McKeating wrote:
> >
> >
> >>On Fri, 2004-05-14 at 10:26, Martin Hepworth wrote:
> >>
> >>>Ron
> >>>
> >>>might be worthwhile puting up the email on a web page somewhere so those
> >>>expert in rule writing can peruse..
> >>>
> >>>you can forward it to me and I'll see if any of my rules fire.
> >>>
> >>
> >>OK, there were many many copies of this came in a deluge over the last
> >>couple of days. I was off on a course so only just found out about it.
> >>Here is one of the ones that got blocked. Each one was different in
> >>subtle ways and some got through (lots) and some got blocked.
> >>
> >>Here is the link
> >>
> >>http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
> >
> >
> > i got this result:
> >
> > Content analysis details: (12.1 points, 5.0 required)
> >
> > pts rule name description
> > ---- ----------------------
> > 1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
> > 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
> > [score: 0.5013]
> > 1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100
> > [cf: 100]
> > 1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
> > 4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
> > 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
> > [Blocked - see
> > <http://www.spamcop.net/bl.shtml?140.112.203.242>]
> > 1.2 PRIORITY_NO_NAME Message has priority setting, but no X-Mailer
> > 1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
> >
> > regards,
> > Matthias
OK I have changed it for one that got through same url
http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
--
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
Re: Punctuation
Posted by Martin Hepworth <ma...@solid-state-logic.com>.
Matthias
OK so that one got caught score of 8.3 - what about one that didn;t
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Matthias Fuhrmann wrote:
> On Fri, 14 May 2004, Ron McKeating wrote:
>
>
>>On Fri, 2004-05-14 at 10:26, Martin Hepworth wrote:
>>
>>>Ron
>>>
>>>might be worthwhile puting up the email on a web page somewhere so those
>>>expert in rule writing can peruse..
>>>
>>>you can forward it to me and I'll see if any of my rules fire.
>>>
>>
>>OK, there were many many copies of this came in a deluge over the last
>>couple of days. I was off on a course so only just found out about it.
>>Here is one of the ones that got blocked. Each one was different in
>>subtle ways and some got through (lots) and some got blocked.
>>
>>Here is the link
>>
>>http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
>
>
> i got this result:
>
> Content analysis details: (12.1 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> 1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
> 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
> [score: 0.5013]
> 1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100
> [cf: 100]
> 1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
> 4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
> 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
> [Blocked - see
> <http://www.spamcop.net/bl.shtml?140.112.203.242>]
> 1.2 PRIORITY_NO_NAME Message has priority setting, but no X-Mailer
> 1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
>
> regards,
> Matthias
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
Re: Punctuation
Posted by Matthias Fuhrmann <Ma...@stud.uni-hannover.de>.
On Fri, 14 May 2004, Ron McKeating wrote:
> On Fri, 2004-05-14 at 10:26, Martin Hepworth wrote:
> > Ron
> >
> > might be worthwhile puting up the email on a web page somewhere so those
> > expert in rule writing can peruse..
> >
> > you can forward it to me and I'll see if any of my rules fire.
> >
> OK, there were many many copies of this came in a deluge over the last
> couple of days. I was off on a course so only just found out about it.
> Here is one of the ones that got blocked. Each one was different in
> subtle ways and some got through (lots) and some got blocked.
>
> Here is the link
>
> http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
i got this result:
Content analysis details: (12.1 points, 5.0 required)
pts rule name description
---- ----------------------
1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
[score: 0.5013]
1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100
[cf: 100]
1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?140.112.203.242>]
1.2 PRIORITY_NO_NAME Message has priority setting, but no X-Mailer
1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
regards,
Matthias
Re: Punctuation
Posted by Ron McKeating <R....@lboro.ac.uk>.
On Fri, 2004-05-14 at 10:26, Martin Hepworth wrote:
> Ron
>
> might be worthwhile puting up the email on a web page somewhere so those
> expert in rule writing can peruse..
>
> you can forward it to me and I'll see if any of my rules fire.
>
OK, there were many many copies of this came in a deluge over the last
couple of days. I was off on a course so only just found out about it.
Here is one of the ones that got blocked. Each one was different in
subtle ways and some got through (lots) and some got blocked.
Here is the link
http://www.sprocket.lboro.ac.uk/~ron/bademail.txt
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Ron McKeating wrote:
> > On Fri, 2004-05-14 at 10:13, Martin Hepworth wrote:
> >
> >>Ron
> >>
> >>the chicken pox set should catch these - www.rulesemporium.org
> >>
> >
> > We have the chicken pox ruleset but they still got through. We update it
> > each morning. Is this a very recent addition to the rules ?
> >
> > Ron
> >
> >
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>
> >>Ron McKeating wrote:
> >>
> >>>Is anybody else seeing these spams where free yyy is advertised. The
> >>>words are made up of punctuation characters, almost like an email sig.
> >>>Do any of the standard rule sets now catch these.
> >>>
> >>>ROn
> >>
> >>**********************************************************************
> >>
> >>This email and any files transmitted with it are confidential and
> >>intended solely for the use of the individual or entity to whom they
> >>are addressed. If you have received this email in error please notify
> >>the system manager.
> >>
> >>This footnote confirms that this email message has been swept
> >>for the presence of computer viruses and is believed to be clean.
> >>
> >>**********************************************************************
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
--
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
Re: Punctuation
Posted by Martin Hepworth <ma...@solid-state-logic.com>.
Ron
might be worthwhile puting up the email on a web page somewhere so those
expert in rule writing can peruse..
you can forward it to me and I'll see if any of my rules fire.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Ron McKeating wrote:
> On Fri, 2004-05-14 at 10:13, Martin Hepworth wrote:
>
>>Ron
>>
>>the chicken pox set should catch these - www.rulesemporium.org
>>
>
> We have the chicken pox ruleset but they still got through. We update it
> each morning. Is this a very recent addition to the rules ?
>
> Ron
>
>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Ron McKeating wrote:
>>
>>>Is anybody else seeing these spams where free yyy is advertised. The
>>>words are made up of punctuation characters, almost like an email sig.
>>>Do any of the standard rule sets now catch these.
>>>
>>>ROn
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
Re: Punctuation
Posted by Ron McKeating <R....@lboro.ac.uk>.
On Fri, 2004-05-14 at 10:13, Martin Hepworth wrote:
> Ron
>
> the chicken pox set should catch these - www.rulesemporium.org
>
We have the chicken pox ruleset but they still got through. We update it
each morning. Is this a very recent addition to the rules ?
Ron
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Ron McKeating wrote:
> > Is anybody else seeing these spams where free yyy is advertised. The
> > words are made up of punctuation characters, almost like an email sig.
> > Do any of the standard rule sets now catch these.
> >
> > ROn
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
--
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329
Re: Punctuation
Posted by Martin Hepworth <ma...@solid-state-logic.com>.
Ron
the chicken pox set should catch these - www.rulesemporium.org
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Ron McKeating wrote:
> Is anybody else seeing these spams where free yyy is advertised. The
> words are made up of punctuation characters, almost like an email sig.
> Do any of the standard rule sets now catch these.
>
> ROn
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
Re: Punctuation
Posted by Bob Mortimer <Bo...@mortimer.nildram.co.uk>.
On Friday 14 May 2004 10:10, Ron McKeating wrote:
> Is anybody else seeing these spams where free yyy is advertised. The
> words are made up of punctuation characters, almost like an email sig.
> Do any of the standard rule sets now catch these.
Yep, my installation has caught loads, none have slipped thorugh here so far:
X-Spam-Status: Yes, hits=14.4 tagged_above=-99.0 required=4.9 tests=BAYES_99,
MSGID_FROM_MTA_HEADER, PYZOR_CHECK, RAZOR2_CF_RANGE_51_100, RAZOR2_CHECK,
RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DSBL, RCVD_IN_SORBS
Bob