You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Bart Verwilst <li...@verwilst.be> on 2005/07/05 11:24:39 UTC
Subject does not get scored
Hellow!
I'm receiving mail with "XANA, L0RAAZEPAM, \/ALUUM, \/llGRA, CAALlS,
LEVlTRRA, MER1DllA, ALPRAZZ0LAM, TRAMAD0OL, AMBllEN repeated wife" as
subject, and while it gives several scores, none of them has anything to
do with the topic. Only because it's HTML mail, received from an ip, ...
Shouldn't the subject line trigger some tags on its own too?
Thanks in advance!
--
Bart Verwilst
Linux R&D Engineer
Hostbasket NV
Re: Subject does not get scored
Posted by Matt Kettler <mk...@evi-inc.com>.
Bart Verwilst wrote:
> Hellow!
>
> I'm receiving mail with "XANA, L0RAAZEPAM, \/ALUUM, \/llGRA, CAALlS,
> LEVlTRRA, MER1DllA, ALPRAZZ0LAM, TRAMAD0OL, AMBllEN repeated wife" as
> subject, and while it gives several scores, none of them has anything to
> do with the topic. Only because it's HTML mail, received from an ip, ...
> Shouldn't the subject line trigger some tags on its own too?
I know, I got the same spam and it skipped by my filter too, and I wrote most of
the drugs rules...
Yes it should match.. all of the body text rules are run against the subject
line as well, by default.
However, all of the above words are carefully crafted to avoid the DRUGS_* rules.
Each one of them is obfuscated in a way beyond what the drugs rules currently
expect.
For example: \/llGRA
The DRUGS_ERECTILE rule can recognize the \/ for v, and the l for i, but it
doesn't recognize l as a substitute for a...
Here's two patches you can add to local.cf (or any other file) to at least fix
the erectile drugs... they'll automatically over-ride the default sub-rules from
20_drugs.cf. Be sure to remove line wraps.. each of those should only be one
line long.
body __DRUGS_ERECTILE1
/(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[a4ij1!|l\xCC-\xCF\xEC-\xEF][_\W]{0,3}[ila40\xC0-\xC6\xE0-\xE6@][_\W]{0,3}[x
yz]?[gj][_\W]{0,3}rr?[_\W]{0,3}[a40\xC0-\xC6\xE0-\xE6@][_\W]{0,3}x?[_\W]{0,3}(?:\b|\s)/i
body __DRUGS_ERECTILE3
/(?:\A|[\s\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])[_\W]{0,3}C[_\W]{0,3}[a4ij1!|l\xCC-\xCF\xEC-\xEF][_\W]{0,3}[ila40\xC0
-\xC6\xE0-\xE6@][_\W]{0,3}l?[l!|1][_\W]{0,3}[ij1!|l\xCC-\xCF\xEC-\xEF][_\W]{0,3}s[_\W]{0,3}(?:\b|\s)/i
Re: (6.0) Subject does not get scored
Posted by Chris Thielen <cm...@someone.dhs.org>.
Hi Bart,
This scored 6 on my install because of chickenpox and some local obfu
rules. I'll attach my local obfu ruleset which you may extract the
respective rules from, however, do NOT use all the rules as some of the
shorter ones are known to FP :) I've just never gone through and
cleaned them out since I'm quite happy with my (single user) install as is.
Chris Thielen
Bart Verwilst wrote:
>Spam detection software, running on the system "ns1.sandgnat.com", has
>identified this incoming email as possible spam. The original message
>has been attached to this so you can view it (if it isn't spam) or label
>similar future email. If you have any questions, see
>the administrator of that system for details.
>
>Content preview: Hellow! I'm receiving mail with "XANA, L0RAAZEPAM,
> \/ALUUM, \/llGRA, CAALlS, LEVlTRRA, MER1DllA, ALPRAZZ0LAM, TRAMAD0OL,
> AMBllEN repeated wife" as subject, and while it gives several scores,
> none of them has anything to do with the topic. Only because it's HTML
> mail, received from an ip, ... Shouldn't the subject line trigger some
> tags on its own too? [...]
>
>Content analysis details: (6.0 points, 5.0 required)
>
> pts rule name description
>---- ---------------------- --------------------------------------------------
>-0.0 SPF_PASS SPF: sender matches SPF record
> 0.6 J_CHICKENPOX_34 BODY: {3}Letter - punctuation - {4}Letter
> 0.6 J_CHICKENPOX_18 BODY: {1}Letter - punctuation - {8}Letter
> 1.8 LOBO_MBN BODY: Obfuscated 'ambien' in body
> 0.6 J_CHICKENPOX_73 BODY: {7}Letter - punctuation - {3}Letter
> 1.8 LOBO_LVTR BODY: Obfuscated 'levitra' in body
> 0.6 J_CHICKENPOX_62 BODY: {6}Letter - punctuation - {2}Letter
> 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
> [score: 0.5011]
>
>
>
>
>
> ------------------------------------------------------------------------
>
> Subject:
> Subject does not get scored
> From:
> Bart Verwilst <li...@verwilst.be>
> Date:
> Tue, 05 Jul 2005 11:24:39 +0200
> To:
> users@spamassassin.apache.org
>
> To:
> users@spamassassin.apache.org
>
> Return-path:
> <us...@spamassassin.apache.org>
>
> Envelope-to:
> cmt-spamassassin@someone.dhs.org
> Delivery-date:
> Tue, 05 Jul 2005 04:25:24 -0500
> Received:
> from hermes.apache.org ([209.237.227.199]:50911 helo=mail.apache.org)
> by ns1.sandgnat.com with smtp (Exim 4.50) id 1Dpjg8-0003e8-JD for
> cmt-spamassassin@someone.dhs.org; Tue, 05 Jul 2005 04:25:20 -0500
> Received:
> (qmail 36227 invoked by uid 500); 5 Jul 2005 09:24:49 -0000
> Mailing-List:
> contact users-help@spamassassin.apache.org; run by ezmlm
> Precedence:
> bulk
> list-help:
> <ma...@spamassassin.apache.org>
> list-unsubscribe:
> <ma...@spamassassin.apache.org>
> List-Post:
> <ma...@spamassassin.apache.org>
> List-Id:
> <users.spamassassin.apache.org>
> Delivered-To:
> mailing list users@spamassassin.apache.org
> Received:
> (qmail 36214 invoked by uid 99); 5 Jul 2005 09:24:49 -0000
> Received:
> from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49) by
> apache.org (qpsmtpd/0.29) with ESMTP; Tue, 05 Jul 2005 02:24:49 -0700
> X-ASF-Spam-Status:
> No, hits=0.0 required=10.0 tests=
> X-Spam-Check-By:
> apache.org
> Received-SPF:
> neutral (asf.osuosl.org: local policy)
> Received:
> from [195.130.132.44] (HELO poros.telenet-ops.be) (195.130.132.44) by
> apache.org (qpsmtpd/0.29) with ESMTP; Tue, 05 Jul 2005 02:24:48 -0700
> Received:
> from localhost (localhost.localdomain [127.0.0.1]) by
> poros.telenet-ops.be (Postfix) with SMTP id 284E23BC0DE for
> <us...@spamassassin.apache.org>; Tue, 5 Jul 2005 11:24:40 +0200 (MEST)
> Received:
> from [192.168.15.101] (unknown [212.123.1.32]) by poros.telenet-ops.be
> (Postfix) with ESMTP id 179843BC055 for
> <us...@spamassassin.apache.org>; Tue, 5 Jul 2005 11:24:40 +0200 (MEST)
> Message-ID:
> <42...@verwilst.be>
> User-Agent:
> Mozilla Thunderbird 1.0.2 (Windows/20050317)
> X-Accept-Language:
> en-us, en
> MIME-Version:
> 1.0
> Content-Type:
> text/plain; charset=ISO-8859-1; format=flowed
> Content-Transfer-Encoding:
> 7bit
> X-Virus-Checked:
> Checked by ClamAV on apache.org
>
>
> Hellow!
>
> I'm receiving mail with "XANA, L0RAAZEPAM, \/ALUUM, \/llGRA, CAALlS,
> LEVlTRRA, MER1DllA, ALPRAZZ0LAM, TRAMAD0OL, AMBllEN repeated wife" as
> subject, and while it gives several scores, none of them has anything
> to do with the topic. Only because it's HTML mail, received from an
> ip, ... Shouldn't the subject line trigger some tags on its own too?
>
> Thanks in advance!
Re: Subject does not get scored
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Bart,
Tuesday, July 5, 2005, 2:24:39 AM, you wrote:
BV> Hellow!
BV> I'm receiving mail with "XANA, L0RAAZEPAM, \/ALUUM, \/llGRA, CAALlS,
BV> LEVlTRRA, MER1DllA, ALPRAZZ0LAM, TRAMAD0OL, AMBllEN repeated wife" as
BV> subject, and while it gives several scores, none of them has anything to
BV> do with the topic. Only because it's HTML mail, received from an ip, ...
BV> Shouldn't the subject line trigger some tags on its own too?
1) You don't indicate which version of SpamAssassin you're using.
2) You don't indicate whether you're using any custom rules files.
While your sample subject heading includes some new variations that
our V-word tests may not catch, there are rules within SARE's
obfuscation rule set files that should hit on those spellings.
Bob Menschel