You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by pclnz <pe...@web1.co.nz> on 2010/05/18 03:13:07 UTC
percentage off spam
Wonder if anyone can help with a rule to combat thousands of spam I am
receiving in our mail server every day
I have tried to work out a .cf rule, but no luck so I am having to add
series a new rules every day
The spams have subject line like the below
Best prices for friends. You save 77%. migration married t the f
Good news, keith. This week we sell at -78%. Ewopyze
For info: Everything at -79%. show poor on
News for peter - popular brands 79% cheaper
For user peter: get -75% to all prices.
WholeSale craig! Buy at -82% today.
etc etc
The subject appear to change each day - is there a way of writing a rule
that can accommodate this type of spam
I have updated using sa-update - does not stop them
Thanks in advance
Peter
--
View this message in context: http://old.nabble.com/percentage-off-spam-tp28590493p28590493.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: percentage off spam
Posted by Per Jessen <pe...@computer.org>.
pclnz wrote:
>
> Wonder if anyone can help with a rule to combat thousands of spam I am
> receiving in our mail server every day
>
> I have tried to work out a .cf rule, but no luck so I am having to add
> series a new rules every day
>
> The spams have subject line like the below
>
> Best prices for friends. You save 77%. migration married t the f
> Good news, keith. This week we sell at -78%. Ewopyze
> For info: Everything at -79%. show poor on
> News for peter - popular brands 79% cheaper
> For user peter: get -75% to all prices.
> WholeSale craig! Buy at -82% today.
>
> etc etc
>
> The subject appear to change each day - is there a way of writing a
> rule that can accommodate this type of spam
Insufficent data - please post a link to some complete samples.
/Per Jessen, Zürich
Re: percentage off spam
Posted by Charles Gregory <cg...@hwcn.org>.
On Tue, 18 May 2010, Kenneth Porter wrote:
>> So throw some examples up on pastebin.
> Here's some:
> <http://sewingwitch.com/ken/Stuff/foo.txt>
>
> I'm currently catching them with this:
> header KP_PERCENT Subject =~ /\b-?[78][0-9]%/
> describe KP_PERCENT 70-89 percent in subject
> score KP_PERCENT 1.0
Given how high these spams score already, this will work quite well.
I also noticed that the 'view in a browser' line repeats consistently.
I see some hits on RBL's and URIBL's. Perhaps those should score just a
little bit higher?
- C
RE: percentage off spam
Posted by Peter Lowish <pe...@web1.co.nz>.
Thanks so much - worked excellently
Thanks to all who answered
Cheers
Peter
-----Original Message-----
From: Kenneth Porter [mailto:shiva@sewingwitch.com]
Sent: Wednesday, 19 May 2010 7:00 a.m.
To: users@spamassassin.apache.org
Subject: Re: percentage off spam
--On Tuesday, May 18, 2010 10:59 AM -0400 Charles Gregory
<cg...@hwcn.org> wrote:
> I agree that full smaples are needed.
> The % Subject alone is not enough.
> But I would expect there is something 'common' to the body
> that would combine in a meta rule for decent score with minimal fp...
>
> So throw some examples up on pastebin.
Here's some:
<http://sewingwitch.com/ken/Stuff/foo.txt>
I'm currently catching them with this:
header KP_PERCENT Subject =~ /\b-?[78][0-9]%/
describe KP_PERCENT 70-89 percent in subject
score KP_PERCENT 1.0
Re: percentage off spam
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Tuesday, May 18, 2010 10:59 AM -0400 Charles Gregory
<cg...@hwcn.org> wrote:
> I agree that full smaples are needed.
> The % Subject alone is not enough.
> But I would expect there is something 'common' to the body
> that would combine in a meta rule for decent score with minimal fp...
>
> So throw some examples up on pastebin.
Here's some:
<http://sewingwitch.com/ken/Stuff/foo.txt>
I'm currently catching them with this:
header KP_PERCENT Subject =~ /\b-?[78][0-9]%/
describe KP_PERCENT 70-89 percent in subject
score KP_PERCENT 1.0
Re: percentage off spam
Posted by Charles Gregory <cg...@hwcn.org>.
I agree that full smaples are needed.
The % Subject alone is not enough.
But I would expect there is something 'common' to the body
that would combine in a meta rule for decent score with minimal fp...
So throw some examples up on pastebin.
- C
Re: percentage off spam
Posted by Joseph Brennan <br...@columbia.edu>.
> Best prices for friends. You save 77%. migration married t the f
> Good news, keith. This week we sell at -78%. Ewopyze
> For info: Everything at -79%. show poor on
> News for peter - popular brands 79% cheaper
> For user peter: get -75% to all prices.
> WholeSale craig! Buy at -82% today.
These match a lot of them:
Subject =~ /\%.*(special|lower|sale|off|on|today)/i
Subject =~ /(don.t miss|special|save|sale).*\%/i
Subject =~ /-\d+\%/
You probably can't give more than 1 or 2 points or you'll fp.
They keep changing too. The minus-percent just started recently.
Joseph Brennan
Columbia University Information Technology