You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Carl Chipman <cc...@nomadics.com> on 2006/04/18 17:20:39 UTC
Help with Stupid Viagra/Calis spams
I'm getting a bunch of these
* V a l / u m $ l , 2 1*
M e r / d i a
X & n a x
S o m &
* C / a l i s $ 3 , 7 5*
A m b / e n
* V / a g r a $ 3 , 3 l*
http://www.desirominnam.com
going through my spam filters, and it's only being scored thusly:
X-Spam-Status: No, hits=3.6 required=6.0
tests=BAYES_50: 1.567,HTML_70_80: 0.039,HTML_MESSAGE: 0.001
X-Spam-Level: ***
Is there a ruleset I could use add that might increase the chance of
catching theses?
TIA,
Carl Chipman
RE: Help with Stupid Viagra/Calis spams
Posted by Don Levey <sp...@the-leveys.us>.
Let's put it this way - here are the rules your message hit on my system:
Carl Chipman wrote:
>
> Content analysis details: (8.2 points, 5.0 required)
>
> 3.5 SUBJECT_DRUG_GAP_VIA
> -4.9 BAYES_00
> 0.4 URIBL_AB_SURBL
> 1.5 URIBL_WS_SURBL
> 3.2 URIBL_OB_SURBL
> 4.3 URIBL_SC_SURBL
> 0.2 DRUGS_ERECTILE
-Don
Re: Help with Stupid Viagra/Calis spams
Posted by Loren Wilton <lw...@earthlink.net>.
> tests=BAYES_50:
> Is there a ruleset I could use add that might increase the chance of
> catching theses?
You can start by training Bayes that these are spam, it will help you a lot.
If you don't have the SARE rules, several of the files there will also help.
Loren
Re: Help with Stupid Viagra/Calis spams
Posted by Matt Kettler <mk...@evi-inc.com>.
Ramdas Phutane wrote:
> On 4/19/06, Matt Kettler <mk...@comcast.net> wrote:
>> Michael Monnerie wrote:
>>> On Dienstag, 18. April 2006 17:20 Carl Chipman wrote:
>>>
>>>> I'm getting a bunch of these
>>>> X-Spam-Status: No, hits=3.6 required=6.0
>>>> tests=BAYES_50: 1.567,HTML_70_80: 0.039,HTML_MESSAGE: 0.001
>>>>
>>> Your message gave me:
>>>
>>> X-Spam-Status: Yes, hits=17.75 tagged_above=-999 required=5
>>> tests=DRUGS_ERECTILE=0.1, RAZOR2_CF_RANGE_51_100=0.5,
>>> RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, URIBL_AB_SURBL=3.306,
>>> URIBL_BLACK=3, URIBL_OB_SURBL=2.617, URIBL_SBL=1.094,
>>> URIBL_SC_SURBL=3.6,
>>> URIBL_WS_SURBL=1.533
>>>
>>> So you should use some SARE rules: http://rulesemporium.com
>>>
>>
>> Why should Carl use SARE rules to catche this spam? None of the rules
>> you cite are SARE rules.. Not a single one.
>>
>> They're all standard SA 3.x rules, except URIBL_BLACK, which isn't from
>> SARE, it's from uribl.com.
>>
>>
>>
> Hi ,
>
> I had the same problem tried upgrading the SARE rules but still no result.
> Later I upgraded my Fred's Rules set & I am getting 9.x plus hits on such spam.
> http://www.rulesemporium.com/other-rules.htm
>
> Thanx & Regards
> Ram
>
Of course not.. none of the SARE rules cover these spams.
Really, from looking at the original problem, I'll need to create an
"antidrug31.cf" and "antidrug30.cf" that patches the drug rules. I need to add
"/" as a potential substitute for "i" and "&" as a substitute for "a".
Re: Help with Stupid Viagra/Calis spams
Posted by Ramdas Phutane <ra...@gmail.com>.
On 4/19/06, Matt Kettler <mk...@comcast.net> wrote:
> Michael Monnerie wrote:
> > On Dienstag, 18. April 2006 17:20 Carl Chipman wrote:
> >
> >> I'm getting a bunch of these
> >> X-Spam-Status: No, hits=3.6 required=6.0
> >> tests=BAYES_50: 1.567,HTML_70_80: 0.039,HTML_MESSAGE: 0.001
> >>
> >
> > Your message gave me:
> >
> > X-Spam-Status: Yes, hits=17.75 tagged_above=-999 required=5
> > tests=DRUGS_ERECTILE=0.1, RAZOR2_CF_RANGE_51_100=0.5,
> > RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, URIBL_AB_SURBL=3.306,
> > URIBL_BLACK=3, URIBL_OB_SURBL=2.617, URIBL_SBL=1.094,
> > URIBL_SC_SURBL=3.6,
> > URIBL_WS_SURBL=1.533
> >
> > So you should use some SARE rules: http://rulesemporium.com
> >
>
>
> Why should Carl use SARE rules to catche this spam? None of the rules
> you cite are SARE rules.. Not a single one.
>
> They're all standard SA 3.x rules, except URIBL_BLACK, which isn't from
> SARE, it's from uribl.com.
>
>
>
Hi ,
I had the same problem tried upgrading the SARE rules but still no result.
Later I upgraded my Fred's Rules set & I am getting 9.x plus hits on such spam.
http://www.rulesemporium.com/other-rules.htm
Thanx & Regards
Ram
Re: Help with Stupid Viagra/Calis spams
Posted by Matt Kettler <mk...@comcast.net>.
Michael Monnerie wrote:
> On Dienstag, 18. April 2006 17:20 Carl Chipman wrote:
>
>> I'm getting a bunch of these
>> X-Spam-Status: No, hits=3.6 required=6.0
>> tests=BAYES_50: 1.567,HTML_70_80: 0.039,HTML_MESSAGE: 0.001
>>
>
> Your message gave me:
>
> X-Spam-Status: Yes, hits=17.75 tagged_above=-999 required=5
> tests=DRUGS_ERECTILE=0.1, RAZOR2_CF_RANGE_51_100=0.5,
> RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, URIBL_AB_SURBL=3.306,
> URIBL_BLACK=3, URIBL_OB_SURBL=2.617, URIBL_SBL=1.094,
> URIBL_SC_SURBL=3.6,
> URIBL_WS_SURBL=1.533
>
> So you should use some SARE rules: http://rulesemporium.com
>
Why should Carl use SARE rules to catche this spam? None of the rules
you cite are SARE rules.. Not a single one.
They're all standard SA 3.x rules, except URIBL_BLACK, which isn't from
SARE, it's from uribl.com.
Re: Help with Stupid Viagra/Calis spams
Posted by Michael Monnerie <mi...@it-management.at>.
On Dienstag, 18. April 2006 17:20 Carl Chipman wrote:
> I'm getting a bunch of these
> X-Spam-Status: No, hits=3.6 required=6.0
> tests=BAYES_50: 1.567,HTML_70_80: 0.039,HTML_MESSAGE: 0.001
Your message gave me:
X-Spam-Status: Yes, hits=17.75 tagged_above=-999 required=5
tests=DRUGS_ERECTILE=0.1, RAZOR2_CF_RANGE_51_100=0.5,
RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, URIBL_AB_SURBL=3.306,
URIBL_BLACK=3, URIBL_OB_SURBL=2.617, URIBL_SBL=1.094,
URIBL_SC_SURBL=3.6,
URIBL_WS_SURBL=1.533
So you should use some SARE rules: http://rulesemporium.com
mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660/4156531 .network.your.ideas.
// PGP Key: "lynx -source http://zmi.at/zmi3.asc | gpg --import"
// Fingerprint: 44A3 C1EC B71E C71A B4C2 9AA6 C818 847C 55CB A4EE
// Keyserver: www.keyserver.net Key-ID: 0x55CBA4EE