You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Dimitri Yioulos <dy...@firstbhph.com> on 2006/03/17 14:29:45 UTC

This isn't being tagged

Hello to all.

I apologize for earlier posts on this subject; they were tagged by the list 
because I included the body of the spam which is being delivered to my users!  
So, there's hope that I can quash this.  I searched the archive, but didn't 
find anything (my search criteria may have been wrong).

Over the last few days, mail such as the following has not been tagged.  The 
subject is Re: Pharamacmky news.  The subject will change slightly, as in re: 
PharamaMzcy news.

I have sa 3.0.4-1 (had a bit of trouble w/ 3.1.0, haven't tried reinstalling 
yet) on a CentOS 3.6 box.  I'm using a number of SARE rulesets, as well as 
pyzor, razor, and dcc.  My MTA is semdmail--8.12.11-4.RHEL3.1.

Many thanks.

Dimitri

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: This isn't being tagged

Posted by Steve Thomas <li...@sthomas.net>.
These things are being properly detected for me. Here's the headers from
one I received this morning:

----------------------------------
Return-path: <cl...@aias.gr>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on titan.sthomas.net
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.5 required=5.0 tests=BAYES_99,HTML_90_100,
     HTML_MESSAGE,RCVD_IN_XBL,UNPARSEABLE_RELAY autolearn=no version=3.1.0
X-Spam-Report:
     * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
     * lines
     * 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
     * 0.0 HTML_MESSAGE BODY: HTML included in message
     * 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
     * [score: 1.0000]
     * 3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
     * [87.97.49.1 listed in sbl-xbl.spamhaus.org]
Envelope-to: [me]
Delivery-date: Fri, 17 Mar 2006 07:33:49 -0800
Received: from mail by titan.sthomas.net with spam-scanned (Exim 4.30)
     id 1FKGxY-0006Ao-CW
     for [me]; Fri, 17 Mar 2006 07:33:49 -0800
Received: from [87.97.49.1] (helo=aias.gr)
     by titan.sthomas.net with smtp (Exim 4.30)
     id 1FKGxX-0006Ai-O6
     for [me]; Fri, 17 Mar 2006 07:33:48 -0800
Message-ID: <00...@kgn78>
Reply-To: "Darius Clack" <cl...@aias.gr>
From: "Darius Clack" <cl...@aias.gr>
To: [me]
Subject: Re: PhU8aramacy news
Date: Fri, 17 Mar 2006 10:32:50 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
     boundary="----=_NextPart_000_0001_01C649AE.24185770"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

Re: This isn't being tagged

Posted by Dimitri Yioulos <dy...@firstbhph.com>.
On Friday March 17 2006 9:49 am, Loren Wilton wrote:
> Don't know why you are getting bayes_00, but we are working on some rules
> for these things that are looking pretty good.  Should be available fairly
> soon.
>
>         Loren

Thanks, Lauren.

Dimitri

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: This isn't being tagged

Posted by Loren Wilton <lw...@earthlink.net>.
Don't know why you are getting bayes_00, but we are working on some rules
for these things that are looking pretty good.  Should be available fairly
soon.

        Loren

Re: This isn't being tagged

Posted by Warren Howard <wa...@nature-soft.com>.
On 03/17/2006 06:59 PM, Dimitri Yioulos wrote:
> Hello to all.
> 
> I apologize for earlier posts on this subject; they were tagged by the list 
> because I included the body of the spam which is being delivered to my users!  
> So, there's hope that I can quash this.  I searched the archive, but didn't 
> find anything (my search criteria may have been wrong).
> 
> Over the last few days, mail such as the following has not been tagged.  The 
> subject is Re: Pharamacmky news.  The subject will change slightly, as in re: 
> PharamaMzcy news.
> 
> I have sa 3.0.4-1 (had a bit of trouble w/ 3.1.0, haven't tried reinstalling 
> yet) on a CentOS 3.6 box.  I'm using a number of SARE rulesets, as well as 
> pyzor, razor, and dcc.  My MTA is semdmail--8.12.11-4.RHEL3.1.
> 
> Many thanks.
> 
> Dimitri
> 

Hi,

Same problem for me (using Spamassassin 3.1.0). I keep feeding sa-learn
the "Re: PharamaCFcy news", always the same style of message but each
time slightly different, the drugs and prices are on the left and
rubbish like this dacgvishJybzjjt is on the right.  The spam mail itself
is in html and the source has lots of this

style
=3D "float: right"> f </span>a<span=20
style
=3D "float: right"> n </span>I<span=20
style
=3D "float: right"> w </span>i<span=20
style
=3D "float: right"> h </span>u<span=20
style
=3D "float: right"> r </span>m <FONT color=3D#F5421A>$1<span=20
style
=3D "float: right"> v </span>05</FONT> (3<span=20
style
=3D "float: right"> Z9 </span>0&nbsp;<span=20
style
=3D "float: right"> q </span>p<span=20
style
=3D "float: right"> w </span>i<span=20
style
=3D "float: right"> y </span>l<span=20
style

in it and no matter how much I feed to sa-learn I keep getting a Bayes
score of 00 (BAYES_00=-2.599).

I'm interested to know more about this type of SPAM and what people
suspect is happening.


Thanks,


Warren.