You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Evan Platt <ev...@espphotography.com> on 2006/11/21 21:33:36 UTC
Them spammers are getting smarter..
So used to be mail from Richard Smith, subject "Me again Richard".
Now they're using the last name, ie "Me again Smith"
I'm almost at the point of rejecting anything with the subject Me again..."
Off topic:
In postfix in header_checks, can I specity something at the START? ie if I say
/Me again/ Reject
I only want to reject
"Me again Smith" but not "Hey, it's Me again..."
Thanks. :)
Evan
Re: Them spammers are getting smarter..
Posted by Kelson <ke...@speed.net>.
Theo Van Dinter wrote:
> On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote:
>> So used to be mail from Richard Smith, subject "Me again Richard".
>> Now they're using the last name, ie "Me again Smith"
>
> FWIW, this is why it's pointless to try keeping up with those things.
> There's an infinite number of ways they can change around the
> subject/from/etc that there's no point in trying to keep up.
Yep. Given how easy it would be for them to do more random subjects,
I'm of the opinion that these are being offered up as decoys. Dangle an
obvious sign in front of the spamfighters, wait for us to grab it, then
snatch it away at the last minute.
It's just a way of tweaking us and keeping us busy.
Meanwhile, Bayes + SARE Stocks + header checks are catching these
easily, regardless of the subject. Admittedly I've bumped BAYES_99 up
to 4.7 points.
(On a side note, I have to laugh at the phrase, "Make it huge with
nanotechnology." Part of it is the huge/nano contrast, but "make it
huge" sounds more typical of another category of spam entirely...)
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Them spammers are getting smarter..
Posted by Ruggero Ferretti - BitDesign Snc <ru...@bitdesign.it>.
Anyhow, you can use:
/^Me again/
it looks for "Me again" at the beginning of the expression; it detects
"Me again", but also "Me again Richard", etc.
Theo Van Dinter wrote:
> On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote:
>> So used to be mail from Richard Smith, subject "Me again Richard".
>> Now they're using the last name, ie "Me again Smith"
>
> FWIW, this is why it's pointless to try keeping up with those things.
> There's an infinite number of ways they can change around the
> subject/from/etc that there's no point in trying to keep up.
>
Re: Them spammers are getting smarter..
Posted by Theo Van Dinter <fe...@apache.org>.
On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote:
> So used to be mail from Richard Smith, subject "Me again Richard".
> Now they're using the last name, ie "Me again Smith"
FWIW, this is why it's pointless to try keeping up with those things.
There's an infinite number of ways they can change around the
subject/from/etc that there's no point in trying to keep up.
--
Randomly Selected Tagline:
"Variety is the spice of life: one day ignore people, the next day annoy
them." - A cat's guide to life
Re: Them spammers are getting smarter..
Posted by Tony Finch <do...@dotat.at>.
On Tue, 21 Nov 2006, Evan Platt wrote:
> So used to be mail from Richard Smith, subject "Me again Richard". Now
> they're using the last name, ie "Me again Smith"
Their fake Received: line is still the same.
Tony.
--
f.a.n.finch <do...@dotat.at> http://dotat.at/
BAILEY: CYCLONIC BECOMING NORTHWESTERLY SEVERE GALE 9 TO VIOLENT STORM 11,
OCCASIONALLY HURRICANE FORCE 12 IN SOUTH, DECREASING 7 TO SEVERE GALE 9 LATER.
HIGH OR VERY HIGH. RAIN OR SQUALLY SHOWERS. MODERATE OR POOR.
Re: Them spammers are getting smarter..
Posted by Karl Auer <ka...@biplane.com.au>.
On Tue, 2006-11-21 at 12:33 -0800, Evan Platt wrote:
> In postfix in header_checks, can I specity something at the START? ie if I say
> /Me again/ Reject
>
> I only want to reject
> "Me again Smith" but not "Hey, it's Me again..."
Put a caret at the start of the pattern: "/^Me again/". To anchor at the
end of the line, put a dollar sign at the end of the pattern: "/Me again
$/".
Regards, K.
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer@biplane.com.au) +61-2-64957160 (h)
http://www.biplane.com.au/~kauer/ +61-428-957160 (mob)