You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ramprasad <ra...@netcore.co.in> on 2006/11/13 09:03:21 UTC

Flooded by pointless spam

I am no getting what the spammer intends to say here 
http://ecm.netcore.co.in/tmp/spam1.txt 


There is no meaningful message , no sales pitch , no stock
recommendation nothing at all 

Any ideas ? 


Thanks
Ram



Re: Flooded by pointless spam

Posted by Matt Kettler <mk...@verizon.net>.
Ramprasad wrote:
> I am no getting what the spammer intends to say here 
> http://ecm.netcore.co.in/tmp/spam1.txt 
>
>
> There is no meaningful message , no sales pitch , no stock
> recommendation nothing at all 
>
> Any ideas ? 
>
>
>   
Looks like it came from a spam tool that auto-generates bayes poison and
then appends it to a spam message template. Unfortunately for the
spammer, looks like this run was done with an empty template, so only
the poison text is present.

It's not that uncommon to see spam runs screwed up in ways that make
them useless. All it takes is a typo in the template...


Re: Flooded by pointless spam

Posted by Leander Koornneef <l....@ic-s.nl>.
On 13-nov-2006, at 9:03, Ramprasad wrote:

> I am no getting what the spammer intends to say here
> http://ecm.netcore.co.in/tmp/spam1.txt
>
>
> There is no meaningful message , no sales pitch , no stock
> recommendation nothing at all
>
> Any ideas ?

Hmm, preemptive Bayes and/or AWL poisoning perhaps?

By the way, it scores > required_score here:

===
Content analysis details:   (6.3 points, 5.0 required)

pts rule name              description
---- ----------------------  
--------------------------------------------------
2.8 RCVD_FORGED_WROTE      Forged 'Received' header found ('wrote:'  
spam)
3.5 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                             [score: 0.9999]
===

The RCVD_FORGED_WROTE score appears to come from
a rule that was received from sa-update. You should consider
upgrading your SA (or run sa-update if using a recent SA already).

Leander