You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Andrew Hearn <an...@aaisp.net.uk> on 2013/08/16 13:36:13 UTC
Low scoring pill spam
Hello,
I have a low scoring pills spam:
http://pastebin.com/q6nWqzMR
I only get the following on it:
* 1.0 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)
* [219.94.129.82 listed in bl.mailspike.net]
* 0.0 SUBJECT_FUZZY_CHEAP Attempt to obfuscate words in
Subject:
* 0.5 FROM_LOCAL_NOVOWEL From: localpart has series of
non-vowel letters
* -2.8 RP_MATCHES_RCVD Envelope sender domain matches handover
relay domain
* 0.0 RCVD_NOT_IN_IPREPDNS Sender not listed at
* http://www.chaosreigns.com/iprep/
Am I missing anything (apart from Bayes) that would help catch this?
Many thanks!
--
Andrew
Re: Low scoring pill spam
Posted by Benny Pedersen <me...@junc.eu>.
RW skrev den 2013-08-16 15:11:
>> I have a low scoring pills spam:
>> http://pastebin.com/q6nWqzMR
Content analysis details: (13.3 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.1 RELAY_STAR Relayed through RFC1918
0.5 RELAY_JP Relayed through JP
1.8 SUBJECT_FUZZY_CHEAP Attempt to obfuscate words in Subject:
1.5 MSG_ID_NE_JP origin msg id spamming
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel
letters
0.0 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)
[219.94.129.82 listed in bl.mailspike.net]
3.3 URIBL_BLACK Contains an URL listed in the URIBL
blacklist
[URIs: eatbok.com]
0.0 RP_MATCHES_RCVD Envelope sender domain matches handover
relay domain
0.0 T_HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail
domains are different
0.1 URI_ADMIN_PARTLY URI: contains admin
0.1 URI_IMAGES_PARTLY URI: contains images
0.1 STARS_ON_FORTY_SIX URI: contains 6 chars url at end
0.5 L_THREE_LINES BODY: has exactly three lines
1.5 L_LT6_LINE BODY: has less than six body lines
0.5 L_TWO_NE_LINES BODY: has exactly two NON EMPTY lines
1.5 L_LT6_NE_LINE BODY: has less than six NON EMPTY body
lines
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
1.3 SAGREY Adds score to spam from first-time senders
header MSG_ID_NE_JP Message-id =~ /ne\.jp/
describe MSG_ID_NE_JP origin msg id spamming
score MSG_ID_NE_JP 1.5 1.5 1.5 1.5
uri URI_ADMIN_PARTLY /.*\/admin\/.*/i
describe URI_ADMIN_PARTLY contains admin
score URI_ADMIN_PARTLY 0.1 0.1 0.1 0.1
uri URI_IMAGES_PARTLY /.*\/images\/.*/i
describe URI_IMAGES_PARTLY contains images
score URI_IMAGES_PARTLY 0.1 0.1 0.1 0.1
uri STARS_ON_FORTY_FIVE /\/[A-Za-z0-9]{5}\.[a-z]{3,4}/
describe STARS_ON_FORTY_FIVE contains 5 chars url at end
score STARS_ON_FORTY_FIVE 0.5 0.5 0.5 0.5
uri STARS_ON_FORTY_FOOR /\/[A-Za-z0-9]{4}\.[a-z]{3,4}/
describe STARS_ON_FORTY_FOOR contains 4 chars url at end
score STARS_ON_FORTY_FOOR 0.1 0.1 0.1 0.1
uri STARS_ON_FORTY_SIX /\/[A-Za-z0-9]{6}\.[a-z]{3,4}/
describe STARS_ON_FORTY_SIX contains 6 chars url at end
score STARS_ON_FORTY_SIX 0.1 0.1 0.1 0.1
and finaly nr_of_lines plugin
Re: Low scoring pill spam
Posted by RW <rw...@googlemail.com>.
On Fri, 16 Aug 2013 12:36:13 +0100
Andrew Hearn wrote:
> Hello,
>
> I have a low scoring pills spam:
> http://pastebin.com/q6nWqzMR
>
> I only get the following on it:
>
> * 1.0 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)
> * [219.94.129.82 listed in bl.mailspike.net]
> * 0.0 SUBJECT_FUZZY_CHEAP Attempt to obfuscate words in
> Subject:
> * 0.5 FROM_LOCAL_NOVOWEL From: localpart has series of
> non-vowel letters
> * -2.8 RP_MATCHES_RCVD Envelope sender domain matches handover
> relay domain
> * 0.0 RCVD_NOT_IN_IPREPDNS Sender not listed at
> * http://www.chaosreigns.com/iprep/
>
>
> Am I missing anything (apart from Bayes) that would help catch this?
>
> Many thanks!
>
Firstly score down RP_MATCHES_RCVD, which lets through a lot of spam
and makes no more sense than scoring SPF_PASS at that level.
Scoring Asian mail works for me, but isn't generally applicable.
I've not seen much of that form of subject obfuscation for years, but I
have found the following useful in the past:
header SUBJ_REPEAT_LETTERS Subject =~ /(?:(?:aa+|bb+|ccc+|ddd+|eee+|ff+|ggg+|hh+|ii+|jj+|kk+|lll+|mm+|nnn+|ooo+|ppp+|qq+|rrr+|sss+|ttt+|uu+|vv+|ww+|xx+|yy+|zz+).{0,30}){3}/i
describe SUBJ_REPEAT_LETTERS Tooo manyy repeateddd lettters
score 2.0