Broken emails to undisclosed-recipients -- All the ... You Will Ever...

[John Ruttenberg <ru...@chezrutt.com>]

I've started to get some mails taht are pretty broken and are sent to
undisclosed-recipients and have this "All the ... You Will Ever ... " in the
body.  Examples at:

    http://www.chezrutt.com/rutt/spam_examples

The interesting thing about these is that spam-reporting one of them seems to
have no effect on the others.  Bayes happily learns it, and then scores it 99
the next time.  But it doesn't seem to effect the next one.

This is 2.63.

Re: Broken emails to undisclosed-recipients -- All the ... You Will Ever...

[Bob George <ma...@ttlexceeded.com>]

John Ruttenberg wrote:

> I've started to get some mails taht are pretty broken and are sent to
>  undisclosed-recipients and have this "All the ... You Will Ever ...
> " in the body.  Examples at:
> 
> http://www.chezrutt.com/rutt/spam_examples

These have been reported on-list a few times, including just a few
minutes ago.

> The interesting thing about these is that spam-reporting one of them
> seems to have no effect on the others.  Bayes happily learns it, and
> then scores it 99 the next time.  But it doesn't seem to effect the
> next one.
> 
> This is 2.63.

They're scoring very high here with a few of the add-on rule sets:

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
server.ttlexceeded.com
X-Spam-Level: *****************
X-Spam-Status: Yes, hits=17.2 required=5.0
tests=AWL,BAYES_99,BIZ_TLD,FCS_URI_NO
DOTS,HTML_IMAGE_ONLY_10,HTML_MESSAGE,LOCAL_DRUGS_ANXIETY,LOCAL_DRUGS_ANXIETY_MAL
EDYS,LOCAL_DRUGS_MALEDYSFUNCTION,LOCAL_DRUGS_MALEDYSFUNCTION_OBFU,L_IMPRNNCBL_2,
L_NOSUBJNOBODY,L_RCVD_IN_MANY,L_UNDISCLNOSUBJ,MY_SHRT_IMG,NO_REAL_NAME,RCVD_IN_B
L_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_SORBS,RM_rbt_Href3dHide autolearn=no
version=2.63

I'd suggest:

1. Keep training bayes! I just fed what you posted and it scored 99 
based on my existing training.
2. Get ahold of some of the add-on rule sets, specifically antidrug.cf 
With the network checks plus antidrug, they should be stopped even 
before bayes training.
3. Add the RCVD_IN_MANY (see other threads today) rule to bump up scores 
for messages listed in many RBLs.

SA and bayes aren't having any trouble detecting these.

- Bob