You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Andersen <js...@pen.homeip.net> on 2006/12/01 07:00:20 UTC
My Credit rateing does TOO matter
How is it these spams slip under the radar with such low scores?
They seldom score about 3.1 in my setup even with network tests
and bayes (SA 3.1.7).
I wish I could find an effective block for them other than killing
off all geocities urls.
--
_____________________________________
John Andersen
Re: My Credit rateing does TOO matter
Posted by Nigel Frankcom <ni...@blue-canoe.net>.
On Fri, 01 Dec 2006 09:15:35 -0500, "Joe Zitnik" <JZ...@hfcc.net>
wrote:
>
>>>> On 12/1/2006 at 7:01 AM, Justin Mason <jm...@jmason.org> wrote:
>
>> Guys -- vague hints as to the contents of the mail really don't help.
>
>>
>> It's spam -- we're all getting thousands of spams a day, most of us
>(ok, I
>> for one at least) seem to be finding those going into the spam bins
>> without our help, and I'd say it's unlikely that many of us (ok, me
>> again ;) are going to go rooting through the trash there looking for
>> something that seems to match what you're hinting at.
>>
>> Why not just post a spample, or a link to one?
>>
>> --j.
>>
>> Joe Zitnik writes:
>>> >>> On 12/1/2006 at 5:22 AM, John Andersen <js...@pen.homeip.net>
>wrote:
>>> On Friday 01 December 2006 00:29, Loren Wilton wrote:
>>> > guess you're just lucky. I just went through the last month's
>spam
>>> and I
>>> > can't find anything with a subject about credit ratings.
>>>
>>> Oh, no, I didn't mean to suggest it was in the subject.
>>>
>>> Its usually some random subject. Then a paragraph starting with
>"your
>>> credit
>>> rating doesn't matter to us" with the usual misspellings, etc,
>followed
>>> by
>>> (usually) a geocities link and some random text at the end.
>>>
>>> --
>>> _____________________________________
>>> John Andersen
>>>
>>>
>>> I was wondering the same thing. Even given the random text, I
>would
>>> think between the default rules, and the fact that I've dumped a
>bunch
>>> in to bayes, that the spammy content would be enough to nail them
>for
>>> sure. I'm still seeing a significant number skate by.
>
>
>It wasn't really a vague hint, or rather, if you're receiving them, you
>know exactly the spam he's talking about. I wasn't asking for a
>solution, I was just commenting on the fact that, like John, I was
>surprised these spams would make it through. At least that's why I
>didn't post the contents or a link to the contents.
I'm glad you didn't or I'd have missed the thread. I have a content
filter running for those. I got sick and tired of checking hundreds
daily during my fp checks. Now I just root them at the MTA.
Prior to that SA was catching them though. Perhaps you are missing a
key rule or update?
Nigel
Re: My Credit rateing does TOO matter
Posted by Joe Zitnik <JZ...@hfcc.net>.
>>> On 12/1/2006 at 7:01 AM, Justin Mason <jm...@jmason.org> wrote:
> Guys -- vague hints as to the contents of the mail really don't help.
>
> It's spam -- we're all getting thousands of spams a day, most of us
(ok, I
> for one at least) seem to be finding those going into the spam bins
> without our help, and I'd say it's unlikely that many of us (ok, me
> again ;) are going to go rooting through the trash there looking for
> something that seems to match what you're hinting at.
>
> Why not just post a spample, or a link to one?
>
> --j.
>
> Joe Zitnik writes:
>> >>> On 12/1/2006 at 5:22 AM, John Andersen <js...@pen.homeip.net>
wrote:
>> On Friday 01 December 2006 00:29, Loren Wilton wrote:
>> > guess you're just lucky. I just went through the last month's
spam
>> and I
>> > can't find anything with a subject about credit ratings.
>>
>> Oh, no, I didn't mean to suggest it was in the subject.
>>
>> Its usually some random subject. Then a paragraph starting with
"your
>> credit
>> rating doesn't matter to us" with the usual misspellings, etc,
followed
>> by
>> (usually) a geocities link and some random text at the end.
>>
>> --
>> _____________________________________
>> John Andersen
>>
>>
>> I was wondering the same thing. Even given the random text, I
would
>> think between the default rules, and the fact that I've dumped a
bunch
>> in to bayes, that the spammy content would be enough to nail them
for
>> sure. I'm still seeing a significant number skate by.
It wasn't really a vague hint, or rather, if you're receiving them, you
know exactly the spam he's talking about. I wasn't asking for a
solution, I was just commenting on the fact that, like John, I was
surprised these spams would make it through. At least that's why I
didn't post the contents or a link to the contents.
Re: My Credit rateing does TOO matter
Posted by Joe Zitnik <JZ...@hfcc.net>.
>>> On 12/1/2006 at 5:22 AM, John Andersen <js...@pen.homeip.net> wrote:
On Friday 01 December 2006 00:29, Loren Wilton wrote:
> guess you're just lucky. I just went through the last month's spam
and I
> can't find anything with a subject about credit ratings.
Oh, no, I didn't mean to suggest it was in the subject.
Its usually some random subject. Then a paragraph starting with "your
credit
rating doesn't matter to us" with the usual misspellings, etc, followed
by
(usually) a geocities link and some random text at the end.
--
_____________________________________
John Andersen
I was wondering the same thing. Even given the random text, I would
think between the default rules, and the fact that I've dumped a bunch
in to bayes, that the spammy content would be enough to nail them for
sure. I'm still seeing a significant number skate by.
Re: My Credit rateing does TOO matter
Posted by John Andersen <js...@pen.homeip.net>.
On Friday 01 December 2006 00:29, Loren Wilton wrote:
> guess you're just lucky. I just went through the last month's spam and I
> can't find anything with a subject about credit ratings.
Oh, no, I didn't mean to suggest it was in the subject.
Its usually some random subject. Then a paragraph starting with "your credit
rating doesn't matter to us" with the usual misspellings, etc, followed by
(usually) a geocities link and some random text at the end.
--
_____________________________________
John Andersen
Re: My Credit rateing does TOO matter
Posted by Loren Wilton <lw...@earthlink.net>.
I guess you're just lucky. I just went through the last month's spam and I
can't find anything with a subject about credit ratings. The lowest scoring
spam I got at around 8.5 points was the following. I *think* it may be a
stock spam, but it is so mangled I'm not absolutely sure:
Re: tip 650=20
V u MC q I
V z emic Announ d ces $9 M A y quisit a ion of Nu x scrib z e Which
Brings Combined Technology To Change The Educational
And Med b ic j al Industries!
C g ompany : Ve e mic t s
S v ymb v ol : V o MC h I
Status : Ho b t Technology Rel k ea n se
Pr k ic d e : $ 0, k 60
5 Day T e arge a t: $ 1. p 80
What these two co h mpan m ies do is am u azi o ng. V z MC b I p u rovid
a es
Re: My Credit rateing does TOO matter
Posted by John Andersen <js...@pen.homeip.net>.
On Thursday 30 November 2006 21:11, Daryl C. W. O'Shea wrote:
> John Andersen wrote:
> > How is it these spams slip under the radar with such low scores?
> > They seldom score about 3.1 in my setup even with network tests
> > and bayes (SA 3.1.7).
>
> I don't think I've seen such a spam pass as ham, although you've been
> quite vague.
Other than a fat fingering of the keyboard, I thought it was pretty clear.
I was talking about the "your credit rating doesn't matter to us" spams.
They never score ABOVE 3.1 here until they find their way to sorbs..
They never hit Razor due to the gibberish at the end.
They usually get tagged by bayes, but bayes alone just gets them near 3.
They sneak past SURBL.
--
_____________________________________
John Andersen
Re: My Credit rateing does TOO matter
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
John Andersen wrote:
> How is it these spams slip under the radar with such low scores?
> They seldom score about 3.1 in my setup even with network tests
> and bayes (SA 3.1.7).
I don't think I've seen such a spam pass as ham, although you've been
quite vague.
> I wish I could find an effective block for them other than killing
> off all geocities urls.
Perhaps the WebRedirect plugin is catching these if they've got links to
Geocities sites.
Daryl