You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by kalin mintchev <ka...@el.net> on 2005/04/03 00:24:51 UTC
spam goes trough
hi all....
increasingly over the last month the filter has letting spam through. some
days is ok - some like last night really bad - i got 60 spam messages. i
have spamd running - nothing has changed. it does get some of the spam
still but crap like this is getting through. and on top of it it
autolearns it as ham?! how do i add this to my bayes db if i'm on a
vpopmail machine where every user has it's own user_prefs?
crap:
Return-Path: <au...@tenforward.com>
Delivered-To: kalin@el.net
Received: (qmail 61346 invoked by uid 1008); 2 Apr 2005 21:47:46 -0000
Delivered-To: timessquare.com-askus@timessquare.com
Received: (qmail 61171 invoked by uid 1008); 2 Apr 2005 21:47:40 -0000
Received: from unknown (HELO dnt-gw2-zagros.dnttm.ro) (193.226.88.153)
by mail.el.net with SMTP; 2 Apr 2005 21:47:40 -0000
Received: from ornately
(ILZS-207-772.future-online.net [69.6.2.73] (may be forged))
by silken.future-online.net (MOS 3.3.9-GR) with ESMTP id DEH05665
(AUTH ornately-05)
; Sat, 02 Apr 2005 16:43:08 -0500 (IST)
Date: Sat, 02 Apr 2005 20:39:08 -0100
From: "Rena Hodge" <au...@tenforward.com>
To: <ca...@timessquare.com>
Subject: This st0ck has everything going for it
Message-ID: <88...@ornately.future-online.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7Bit
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on chavo.el.net
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=3.0 tests=BAYES_00 autolearn=ham
version=3.0.2
--
Re: spam goes trough
Posted by Rocky Olsen <ro...@mindphone.org>.
I had the a problem with your below listed stock spam and others, most of them
also have a 'price' and a 'symbl' in the body. found the following rule
works well enough...even though it's pretty ugly
header __XMStockSGen Subject =~
/(?:[i|!1l]\W*(?:n|\|\\\|)\W*(?:v|\\\/)\W*[e3]\W*[5s\$]\W*[t7]|[e3]\W*q\W*[uy]\W*[i|!1l]\W*[t7]\W*y|[5s\$]\W*[t7]\W*(?:o|0|\(\))\W*[c<(]\W*(?:k|\|\<)|[t7]\W*r\W*[a\@4]\W*d(?:[e3]|[i|!1l]\W*(?:n|\|\\\|)\W*g)|[c<(]\W*(?:o|0|\(\))\W*(?:m|\|\\\/\|)\W*p\W*[a\@4]\W*(?:n|\|\\\|)(?:y|[i|!1l]\W*[e3]\W*[5s\$])|p\W*r\W*(?:o|0|\(\))\W*f\W*[i|!1l]\W*[t7]|p\W*(?:o|0|\(\))\W*r\W*[t7]\W*f\W*(?:o|0|\(\))\W*[i|!1l]\W*[i|!1l]\W*(?:o|0|\(\))|(?:[5s\$]\W*(?:m|\|\\\/\|)\W*[a\@4]\W*[i|!1l]\W*[i|!1l]|(?:m|\|\\\/\|)\W*[i|!1l]\W*[c<(]\W*r\W*(?:o|0|\(\)))\W*[c<(]\W*[a\@4]\W*p|(?:o|0|\(\))\W*(?:v|\\\/)\W*[e3]\W*r\W*[i|!1l]\W*(?:o|0|\(\))\W*(?:o|0|\(\))\W*(?:k|\|\<)|(?:w|\\\/\\\/)\W*[a\@4]\W*[i|!1l]\W*[i|!1l]\W*[5s\$]\W*[t7]\W*r\W*[e3]\W*[e3]\W*[t7]|(?:m|\|\\\/\|)\W*[a\@4]\W*r\W*(?:k|\|\<)\W*[e3]\W*[t7]|(?:h|\|-\|)\W*(?:o|0|\(\))\W*[t7]\W*p\W*[i|!1l]\W*[c<(]\W*(?:k|\|\<)\W*[5s\$])/i
rawbody __XMStockSymb /^[5s\$]\W*y\W*(?:m|\|\\\/\|)\W*b\W*(?:o|0|\(\))\W*[i|!1l]\W*\w{2,5}\s*$/i
rawbody __XMStockPrce /^p\W*r\W*[i|!1l]\W*[c<(]\W*[e3]\W*\d+(?:\.\w+)?\s*$/
meta XMStockSpam_05 (__XMStockSGen && __XMStockPrce && __XMStockSymb)
On Sat, Apr 02, 2005 at 05:24:51PM -0500, kalin mintchev wrote:
>
> hi all....
>
> increasingly over the last month the filter has letting spam through. some
> days is ok - some like last night really bad - i got 60 spam messages. i
> have spamd running - nothing has changed. it does get some of the spam
> still but crap like this is getting through. and on top of it it
> autolearns it as ham?! how do i add this to my bayes db if i'm on a
> vpopmail machine where every user has it's own user_prefs?
>
> crap:
>
> Return-Path: <au...@tenforward.com>
> Delivered-To: kalin@el.net
> Received: (qmail 61346 invoked by uid 1008); 2 Apr 2005 21:47:46 -0000
> Delivered-To: timessquare.com-askus@timessquare.com
> Received: (qmail 61171 invoked by uid 1008); 2 Apr 2005 21:47:40 -0000
> Received: from unknown (HELO dnt-gw2-zagros.dnttm.ro) (193.226.88.153)
> by mail.el.net with SMTP; 2 Apr 2005 21:47:40 -0000
> Received: from ornately
> (ILZS-207-772.future-online.net [69.6.2.73] (may be forged))
> by silken.future-online.net (MOS 3.3.9-GR) with ESMTP id DEH05665
> (AUTH ornately-05)
> ; Sat, 02 Apr 2005 16:43:08 -0500 (IST)
> Date: Sat, 02 Apr 2005 20:39:08 -0100
> From: "Rena Hodge" <au...@tenforward.com>
> To: <ca...@timessquare.com>
> Subject: This st0ck has everything going for it
> Message-ID: <88...@ornately.future-online.net>
> MIME-Version: 1.0
> Content-Type: text/plain; charset="UTF-8"
> Content-Transfer-Encoding: 7Bit
> X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on chavo.el.net
> X-Spam-Level:
> X-Spam-Status: No, score=-2.6 required=3.0 tests=BAYES_00 autolearn=ham
> version=3.0.2
>
> --
>
>
>
>
>
>
--
______________________________________________________________________
what's with today, today?
Email: rocky@mindphone.org
PGP: http://rocky.mindphone.org/rocky_mindphone.org.gpg