You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Christopher Culver <cr...@christopherculver.com> on 2014/01/08 08:45:48 UTC
Proposing a new rule ("Lic. " sender plus .info domain)
For the last year or so, I’ve been deluged with Spanish-language spam
with a very predictable format: the sender name begins with "Lic. " and
the sender address is at an .info domain.
EXAMPLE SENDERS:
Lic. Mayra Miranda
Lic. Toledano
Lic. Carmen Quintanar
Lic. Lizárraga Mena
Lic. Lizárraga Mena
Lic. Mildreth Palma
EXAMPLE DOMAINS:
control@superecursos.info
acevedo@asistenciaejecutiva.info
nego@controltecnicas.info
prestaciones@hoteles2013.info
eficiencialogisticamx.info
fideicomisos@controlinterno.info
While some of the .info domains are reused from spam message to spam
message, allowing me to blacklist them, occasionally new domains
appear. Even with feeding thousands of these into the Bayesian database,
they still get only a spamassassin score of 3.0 out of 5.0 on my
system. Therefore, I believe a new rule is called for.
Is this type of spam common enough that a new rule can be pushed out to
all spamassassin users with sa-update raising the score on messages with
Spanish-language text, with sender names beginning with the substring
"Lic. " and coming from an .info domain?
Christopher Culver
Re: Proposing a new rule ("Lic. " sender plus .info domain)
Posted by RW <rw...@googlemail.com>.
On Wed, 08 Jan 2014 15:12:43 +0100
Axb wrote:
> On 01/08/2014 02:34 PM, Martin Gregorie wrote:
> > SPAMES describe Spanish info spam
> > SPAMES header From =~ /Lic\..*\.info/
> > SPAMES score 5
> >
>
> I'd do:
>
> header FROM_NAME_LIC From:name =~ /^Lic\./
>
> as Lic. is in the name and not in the email addr. and avoid the .*
> slowness.
I doubt the .* on a header is worst than the overhead of a second regex
test.
> and meta with
>
> header __FROM_INFO From =~ /\.info/
or better
header __FROM_INFO From:addr =~ /\.info$/
Re: Proposing a new rule ("Lic. " sender plus .info domain)
Posted by Benny Pedersen <me...@junc.eu>.
Axb skrev den 2014-01-08 15:12:
> header FROM_NAME_LIC From:name =~ /^Lic\./
> header __FROM_INFO From:addr =~ /\.info/
more correct imho :=)
Re: Proposing a new rule ("Lic. " sender plus .info domain)
Posted by Axb <ax...@gmail.com>.
On 01/08/2014 02:34 PM, Martin Gregorie wrote:
> On Wed, 2014-01-08 at 10:45 +0300, Christopher Culver wrote:
>> For the last year or so, I’ve been deluged with Spanish-language spam
>> with a very predictable format: the sender name begins with "Lic. " and
>> the sender address is at an .info domain.
>>
>> EXAMPLE SENDERS:
>>
>> Lic. Mayra Miranda
>> Lic. Toledano
>> Lic. Carmen Quintanar
>> Lic. Lizárraga Mena
>> Lic. Lizárraga Mena
>> Lic. Mildreth Palma
>>
>> EXAMPLE DOMAINS:
>>
>> control@superecursos.info
>> acevedo@asistenciaejecutiva.info
>> nego@controltecnicas.info
>> prestaciones@hoteles2013.info
>> eficiencialogisticamx.info
>> fideicomisos@controlinterno.info
>>
>> While some of the .info domains are reused from spam message to spam
>> message, allowing me to blacklist them, occasionally new domains
>> appear. Even with feeding thousands of these into the Bayesian database,
>> they still get only a spamassassin score of 3.0 out of 5.0 on my
>> system. Therefore, I believe a new rule is called for.
>>
>> Is this type of spam common enough that a new rule can be pushed out to
>> all spamassassin users with sa-update raising the score on messages with
>> Spanish-language text, with sender names beginning with the substring
>> "Lic. " and coming from an .info domain?
>>
> I for one have never seen this type of spam, but that doesn't mean much:
> a lot of sites get types of spam I never see and vice versa. However,
> that's why SA lets you write local rules. In this case something like:
>
> SPAMES describe Spanish info spam
> SPAMES header From =~ /Lic\..*\.info/
> SPAMES score 5
>
I'd do:
header FROM_NAME_LIC From:name =~ /^Lic\./
as Lic. is in the name and not in the email addr. and avoid the .* slowness.
and meta with
header __FROM_INFO From =~ /\.info/
Re: Proposing a new rule ("Lic. " sender plus .info domain)
Posted by Martin Gregorie <ma...@gregorie.org>.
On Wed, 2014-01-08 at 10:45 +0300, Christopher Culver wrote:
> For the last year or so, I’ve been deluged with Spanish-language spam
> with a very predictable format: the sender name begins with "Lic. " and
> the sender address is at an .info domain.
>
> EXAMPLE SENDERS:
>
> Lic. Mayra Miranda
> Lic. Toledano
> Lic. Carmen Quintanar
> Lic. Lizárraga Mena
> Lic. Lizárraga Mena
> Lic. Mildreth Palma
>
> EXAMPLE DOMAINS:
>
> control@superecursos.info
> acevedo@asistenciaejecutiva.info
> nego@controltecnicas.info
> prestaciones@hoteles2013.info
> eficiencialogisticamx.info
> fideicomisos@controlinterno.info
>
> While some of the .info domains are reused from spam message to spam
> message, allowing me to blacklist them, occasionally new domains
> appear. Even with feeding thousands of these into the Bayesian database,
> they still get only a spamassassin score of 3.0 out of 5.0 on my
> system. Therefore, I believe a new rule is called for.
>
> Is this type of spam common enough that a new rule can be pushed out to
> all spamassassin users with sa-update raising the score on messages with
> Spanish-language text, with sender names beginning with the substring
> "Lic. " and coming from an .info domain?
>
I for one have never seen this type of spam, but that doesn't mean much:
a lot of sites get types of spam I never see and vice versa. However,
that's why SA lets you write local rules. In this case something like:
SPAMES describe Spanish info spam
SPAMES header From =~ /Lic\..*\.info/
SPAMES score 5
should kill any mail from anybody using Lic as a title and posting from
the .info domain.
Disclaimer: The regex has been tested with "grep -P" but I haven't
tested the rule in SA, so it must be syntax checked and tested against
both spam and ham before putting it live.
I prefer to use meta-rules that match two or more body text phrases to
detect spam, e.g. a rule that matches one or more sales come-ons and one
or more product names or types, e.g. "lowest price for new" and
"Comfi-sleep pillow". My suggested rule will catch anybody using Lic as
a title and posting from .info domains, so you'd better be *very* sure
that you never get legitimate mail from anybody like this before using
it as shown. It would be better to use it as one of the subrules in a
meta-rule that won't fire unless it also matches some combination of
Spanish body text phrases that do not appear in your ham stream.
Martin
Re: Proposing a new rule ("Lic. " sender plus .info domain)
Posted by John Hardin <jh...@impsec.org>.
On Wed, 8 Jan 2014, Christopher Culver wrote:
> For the last year or so, I’ve been deluged with Spanish-language spam
> with a very predictable format: the sender name begins with "Lic. " and
> the sender address is at an .info domain.
I've been having good results with such a rule in my local install.
Unfortunately it seems not too many others are getting the same spams, as
it isn't doing too well in masscheck:
http://ruleqa.spamassassin.org/?daterev=20140107-r1556147-n&rule=%2F_LIC
You're welcome to pull the rules directly from my sandbox if you like, or
I could see about forcing publication. How are those spams scoring absent
such a rule?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Of the twenty-two civilizations that have appeared in history,
nineteen of them collapsed when they reached the moral state the
United States is in now. -- Arnold Toynbee
-----------------------------------------------------------------------
9 days until Benjamin Franklin's 308th Birthday