Odd spam

[Jack Gostl <go...@argoscomp.com>]

I'm getting dozens of messages touting a stock called TTEN. The odd thing about the messages is that its getting assigned a Bayes score of zero. 

Are there any rules out there for this?

Thanks

Jack

Re: Odd spam

[Jack Gostl <go...@argoscomp.com>]

I guess I could do that, but these things usually only last a few days 
anyway. Always have to trade off against the risk of a non-spam message 
coming through. I was really surprised that the Bayes came up zero.



----- Original Message ----- 
From: "Ken A" <ka...@pacific.net>
To: "Jack Gostl" <go...@argoscomp.com>
Cc: "Spamass" <us...@spamassassin.apache.org>
Sent: Sunday, December 17, 2006 7:59 PM
Subject: Re: Odd spam


> Jack Gostl wrote:
>> I'm getting dozens of messages touting a stock called TTEN. The odd thing 
>> about the messages is that its getting assigned a Bayes score of zero. 
>> Are there any rules out there for this?
>>
>> Thanks
>>
>> Jack
>>
>
> For the stock spams that are just short text, they usually hit some SARE 
> stock rules, but not quite enough to be sure unless they also hit some 
> rbl, or razor or dcc, so I usually just push a quick rule like this into a 
> local_rules.cf file in /etc/mail/spamassassin/ and remove it later after 
> it stops hitting.
>
> body    LOCAL_STOCK_1_TTEN      /^TTEN/
> describe        LOCAL_STOCK_1_TTEN      TTEN stock spam
> score   LOCAL_STOCK_1_TTEN      5.5
>
> ymmv!
>
> Ken A
> Pacific.Net
> 

Re: Odd spam

[Ken A <ka...@pacific.net>]

Jack Gostl wrote:
> I'm getting dozens of messages touting a stock called TTEN. The odd thing about the messages is that its getting assigned a Bayes score of zero. 
> 
> Are there any rules out there for this?
> 
> Thanks
> 
> Jack
> 

For the stock spams that are just short text, they usually hit some SARE 
stock rules, but not quite enough to be sure unless they also hit some 
rbl, or razor or dcc, so I usually just push a quick rule like this into 
a local_rules.cf file in /etc/mail/spamassassin/ and remove it later 
after it stops hitting.

body    LOCAL_STOCK_1_TTEN      /^TTEN/
describe        LOCAL_STOCK_1_TTEN      TTEN stock spam
score   LOCAL_STOCK_1_TTEN      5.5

ymmv!

Ken A
Pacific.Net