You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jonn R Taylor <jo...@taylortelephone.com> on 2006/02/05 15:34:30 UTC
webuserprefs
Hi all,
Is some one maintaining the user prefs still??? The last
version at sourceforge.net is not usable for 3.1. I
rewrote part of it, but was just wondering.
Jonn
RE: Little custom rule
Posted by Ruben Cardenal <ru...@ruben.cn>.
Yeah, all of them match the HTML_IMAGE_ONLY_12 rule, but not the rest of
them. As an initial measure I raised the score for that rule, but I
understand that's not the solution.
Ruben
> These are caught quite easily on my home system:
>
> Content analysis details: (42.1 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type=
> entry
> 2.0 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received:
> date
> 2.0 BIZ_TLD URI: Contains an URL in the BIZ top-level
> domain
> 1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of
> words
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99%
> [score: 0.9555]
> 1.0 M_K_N0N0_WORDS_BODY RAW: The body contains n0n0 words
> 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
> above 50%
> [cf: 100]
> 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
> 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
> [cf: 100]
> 2.2 DCC_CHECK Listed in DCC
> (http://rhyolite.com/anti-spam/dcc/)
> 3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
> [201.220.121.72 listed in sbl-
> xbl.spamhaus.org]
> 1.6 URIBL_SBL Contains an URL listed in the SBL blocklist
> [URIs: bambooo.MUNGED.biz]
> 3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL
> blocklist
> [URIs: bambooo.MUNGED.biz]
> 4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL
> blocklist
> [URIs: bambooo.MUNGED.biz]
> 2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
> blocklist
> [URIs: bambooo.MUNGED.biz]
> 3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL
> blocklist
> [URIs: bambooo.MUNGED.biz]
> 4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
> blocklist
> [URIs: bambooo.MUNGED.biz]
> 0.8 DIGEST_MULTIPLE Message hits more than one network digest
> check
> 1.6 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image
> 1.0 SAGREY Adds 1.0 to spam from first-time senders
>
> --
> Chris
> Registered Linux User 283774 http://counter.li.org
> 17:11:40 up 26 days, 22:58, 1 user, load average: 0.06, 0.15, 0.19
> Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk
Re: Little custom rule
Posted by Chris <cp...@earthlink.net>.
On Sunday 05 February 2006 2:25 pm, Ruben Cardenal wrote:
> Hi,
>
> In one of my servers (7200 accounts) I'm receiving tons of a spam that
> is mainly composed by an image and its subject is always "FW: blah" where
> "blah" is the destination account. This is, if the mail is sent to
> john@domain.com the subject is always "Fw: john"
>
> Can that be matched by a rule?
>
> Regards,
>
> Ruben
These are caught quite easily on my home system:
Content analysis details: (42.1 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type=
entry
2.0 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date
2.0 BIZ_TLD URI: Contains an URL in the BIZ top-level domain
1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99%
[score: 0.9555]
1.0 M_K_N0N0_WORDS_BODY RAW: The body contains n0n0 words
1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
2.2 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[201.220.121.72 listed in sbl-xbl.spamhaus.org]
1.6 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: bambooo.MUNGED.biz]
3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: bambooo.MUNGED.biz]
4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: bambooo.MUNGED.biz]
2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: bambooo.MUNGED.biz]
3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: bambooo.MUNGED.biz]
4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: bambooo.MUNGED.biz]
0.8 DIGEST_MULTIPLE Message hits more than one network digest check
1.6 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image
1.0 SAGREY Adds 1.0 to spam from first-time senders
--
Chris
Registered Linux User 283774 http://counter.li.org
17:11:40 up 26 days, 22:58, 1 user, load average: 0.06, 0.15, 0.19
Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk
RE: Little custom rule
Posted by Ruben Cardenal <ru...@ruben.cn>.
Hi again,
I added them and had to change the 1st "{" in the 1st rule for a "(" in
order spamd not to complain about it. Anyway, it doesn't work :(
Thanks anyway
Ruben
> -----Mensaje original-----
> De: Loren Wilton [mailto:lwilton@earthlink.net]
> Enviado el: lunes, 06 de febrero de 2006 1:23
> Para: users@spamassassin.apache.org
> Asunto: Re: Little custom rule
>
> > header __LW_BLAH1 ALL =~
> /\nTo:[^<\n]+<{[^\@]+)[^\n]+.*\nSubject:\s*Fw:
> > \1\b/i
> > header __LW_BLAH2 ALL =~ /\nSubject:\s*Fw:
> > (\w+)[^\n]*.*\nTo:[^<\n]+<\1\@/i
> > meta LW_BLAH __LW_BLAH1 || __LW_BLAH2
> > score LW_BLAH 1
>
> I see those lines wrapped. The first 4 lines above are really two lines.
> There is one space after the "Fw:" at the end of those wrapped lines, then
> the stuff on the second line.
>
> Loren
Re: Little custom rule
Posted by Loren Wilton <lw...@earthlink.net>.
> header __LW_BLAH1 ALL =~ /\nTo:[^<\n]+<{[^\@]+)[^\n]+.*\nSubject:\s*Fw:
> \1\b/i
> header __LW_BLAH2 ALL =~ /\nSubject:\s*Fw:
> (\w+)[^\n]*.*\nTo:[^<\n]+<\1\@/i
> meta LW_BLAH __LW_BLAH1 || __LW_BLAH2
> score LW_BLAH 1
I see those lines wrapped. The first 4 lines above are really two lines.
There is one space after the "Fw:" at the end of those wrapped lines, then
the stuff on the second line.
Loren
RE: Little custom rule
Posted by Ruben Cardenal <ru...@ruben.cn>.
Yes, the "To" also has the username of the account. I'll give a try to your
proposal shortly at work. Thanks
Ruben
> -----Mensaje original-----
> De: Loren Wilton [mailto:lwilton@earthlink.net]
> Enviado el: lunes, 06 de febrero de 2006 0:40
> Para: users@spamassassin.apache.org
> Asunto: Re: Little custom rule
>
> > mainly composed by an image and its subject is always "FW: blah" where
> > "blah" is the destination account. This is, if the mail is sent to
> > john@domain.com the subject is always "Fw: john"
> >
> > Can that be matched by a rule?
>
> Depends. Does the "to" also have the username of the account? If so, you
> could do a moderately ugly pair of rules and a meta:
>
> header __LW_BLAH1 ALL =~ /\nTo:[^<\n]+<{[^\@]+)[^\n]+.*\nSubject:\s*Fw:
> \1\b/i
> header __LW_BLAH2 ALL =~ /\nSubject:\s*Fw:
> (\w+)[^\n]*.*\nTo:[^<\n]+<\1\@/i
> meta LW_BLAH __LW_BLAH1 || __LW_BLAH2
> score LW_BLAH 1
>
> This is assuming that the To address is of the form me@there rather than
> any
> of the half dozen other legit formats. There are ways to deal with that
> to,
> but they get *really* messy.
>
> Loren
>
> BTW, the above is off the top of my head and untested. It may not even
> lint, much less work.
Re: Little custom rule
Posted by Loren Wilton <lw...@earthlink.net>.
> mainly composed by an image and its subject is always "FW: blah" where
> "blah" is the destination account. This is, if the mail is sent to
> john@domain.com the subject is always "Fw: john"
>
> Can that be matched by a rule?
Depends. Does the "to" also have the username of the account? If so, you
could do a moderately ugly pair of rules and a meta:
header __LW_BLAH1 ALL =~ /\nTo:[^<\n]+<{[^\@]+)[^\n]+.*\nSubject:\s*Fw:
\1\b/i
header __LW_BLAH2 ALL =~ /\nSubject:\s*Fw:
(\w+)[^\n]*.*\nTo:[^<\n]+<\1\@/i
meta LW_BLAH __LW_BLAH1 || __LW_BLAH2
score LW_BLAH 1
This is assuming that the To address is of the form me@there rather than any
of the half dozen other legit formats. There are ways to deal with that to,
but they get *really* messy.
Loren
BTW, the above is off the top of my head and untested. It may not even
lint, much less work.
Little custom rule
Posted by Ruben Cardenal <ru...@ruben.cn>.
Hi,
In one of my servers (7200 accounts) I'm receiving tons of a spam that is
mainly composed by an image and its subject is always "FW: blah" where
"blah" is the destination account. This is, if the mail is sent to
john@domain.com the subject is always "Fw: john"
Can that be matched by a rule?
Regards,
Ruben
Re: webuserprefs
Posted by jdow <jd...@earthlink.net>.
From: "Jonn R Taylor" <jo...@taylortelephone.com>
> Hi all,
>
> Is some one maintaining the user prefs still??? The last
> version at sourceforge.net is not usable for 3.1. I
> rewrote part of it, but was just wondering.
It's probably meant as a model. As such it should have comments about what
works for various releases. But as for actually USING it - it's user_prefs
not sysadmins_prefs.
{^_-}