You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Brooks Rimes <br...@rimesrv.net> on 2006/12/15 19:14:15 UTC
Newbie needs help with Spam/Spam Assassin
My email is through my website: www.rimesrv.net which is hosted on
www.totalchoicehosting.com and they use Spam Assassin for spam filtering. I
don't know a lot about SA.
Over the last weeks or a month my spam has increased dramatically. What is
particularly frustrating is that I get many in the same day with the same or
near identical subject and body. Today it is "RE:Report" - ten came in this
morning. See example below.
I'm careful where I put my email address. Apparently, not careful enough.
Many of these spams seem to be related to the stock market.
- is there a way to track these down and stop them?
- why doesn't Spam Assassin recognize all these with the same subject/body
as spam?
- any suggestions/advice?
- is there anywhere else to seek help?
Thanks very much.
Brooks
Return-path: <th...@aacr.org>
Envelope-to: brooks@rimesrv.net
Delivery-date: Fri, 15 Dec 2006 08:44:29 -0500
Received: from rimesrv by server38.tchmachines.com with local-bsmtp (Exim
4.52)
id 1GvDMN-0003Is-Pk
for brooks@rimesrv.net; Fri, 15 Dec 2006 08:44:29 -0500
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on
server38.tchmachines.com
X-Spam-Level: *
X-Spam-Status: No, score=1.4 required=5.0 tests=BAYES_00,RCVD_IN_NJABL_DUL,
RCVD_IN_SORBS_DUL autolearn=no version=3.1.7
Received: from alyon-252-1-24-3.w82-122.abo.wanadoo.fr ([82.122.55.3])
by server38.tchmachines.com with esmtp (Exim 4.52)
id 1GvDM6-00031f-5u
for brooks@rimesrv.net; Fri, 15 Dec 2006 08:44:20 -0500
Received: from 207.188.202.98 (HELO mail.aacr.org)
by rimesrv.net with esmtp (2T<7,0=-B52 +6)3(N)
id 0(,N:Y--5,/4Y-(A
for brooks@rimesrv.net; Fri, 15 Dec 2006 13:44:16 -0060
From: "Jesse Colvin" <th...@aacr.org>
To: <br...@rimesrv.net>
Subject: RE:Report
Date: Fri, 15 Dec 2006 13:44:16 -0060
Message-ID: <01...@thievishsinner>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
Thread-Index: Aca6Q7,8A'8X7H6,38/P140)+->,(1==
Re: Newbie needs help with Spam/Spam Assassin
Posted by Theo Van Dinter <fe...@apache.org>.
On Fri, Dec 15, 2006 at 01:14:15PM -0500, Brooks Rimes wrote:
> My email is through my website: www.rimesrv.net which is hosted on
> www.totalchoicehosting.com and they use Spam Assassin for spam filtering. I
> don't know a lot about SA.
FWIW, you'll want to talk to your provider. The amount of stuff you can do is
really up to them and how well they keep up with things.
> - is there a way to track these down and stop them?
not really.
> - why doesn't Spam Assassin recognize all these with the same subject/body
> as spam?
having the same/similar subjects doesn't mean something is spam, though it's a
possible spam sign. learning the message for bayes will make the spam
likelihood increase.
> - any suggestions/advice?
if it was your installation, I'd say run sa-update which has rules to deal
with the image/stock spams. however, as a user there's not a lot you can do
other than train bayes.
> - is there anywhere else to seek help?
talk to your provider.
--
Randomly Selected Tagline:
"Yea, it's gone." - Prof. Farr
Re: Newbie needs help with Spam/Spam Assassin
Posted by René Berber <r....@computer.org>.
Brooks Rimes wrote:
> My email is through my website: www.rimesrv.net which is hosted on
> www.totalchoicehosting.com and they use Spam Assassin for spam filtering. I
> don't know a lot about SA.
>
> Over the last weeks or a month my spam has increased dramatically. What is
> particularly frustrating is that I get many in the same day with the same or
> near identical subject and body. Today it is "RE:Report" - ten came in this
> morning. See example below.
>
> I'm careful where I put my email address. Apparently, not careful enough.
> Many of these spams seem to be related to the stock market.
>
> - is there a way to track these down and stop them?
Spamcop is one way to _try_ to stop them.
> - why doesn't Spam Assassin recognize all these with the same subject/body
> as spam?
SA uses many "rules" to recognize spam, both subject and body, plus relay
history, heuristics, and other.
> - any suggestions/advice?
>
> - is there anywhere else to seek help?
Yes, your host doesn't seem to know SA, look below... But if you want to take
matters into your own hands you could install something like SpamAware (an
Outlook plugin -- I assume you use Outlook since Thunderbird has its own
built-in filter).
[snip]
> X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on
> server38.tchmachines.com
> X-Spam-Level: *
> X-Spam-Status: No, score=1.4 required=5.0 tests=BAYES_00,RCVD_IN_NJABL_DUL,
> RCVD_IN_SORBS_DUL autolearn=no version=3.1.7
Compare that to this:
X-Spam-Status: Yes, hits=10.4, required=4.0, autolearn=no
X-Spam-Report: * 2.0 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after
Received: date * 1.7 SARE_MLB_Stock1 BODY: SARE_MLB_Stock1 * 1.7
SARE_MLB_Stock2 BODY: SARE_MLB_Stock2 * 0.8 SARE_LWSHORTT BODY:
SARE_LWSHORTT * 1.7 SARE_MLB_Stock6 BODY: Obfuscated ticker symbols * 2.6
This score was done by SpamAware with SARE rules added (on a message with the
same subject).
--
René Berber
Re: Newbie needs help with Spam/Spam Assassin
Posted by aubreyl <au...@emailacs.com>.
.rp wrote:
>> My email is through my website: www.rimesrv.net which is hosted on
>> www.totalchoicehosting.com and they use Spam Assassin for spam
>> filtering. I don't know a lot about SA.
>>
>> Over the last weeks or a month my spam has increased dramatically.
>> What is particularly frustrating is that I get many in the same day
>> with the same or near identical subject and body. Today it is
>> "RE:Report" - ten came in this morning. See example below.
>>
>> I'm careful where I put my email address. Apparently, not careful
>> enough. Many of these spams seem to be related to the stock market.
>>
>>
> You may have fallen to a dictionary attack, ie: they didn't know you where
> there they just threw a bunch of names at your mailserver.
>
>
>> - any suggestions/advice?
>>
>>
> get an email filter for your email client as well , so that it filters what your
> mailserver does not.
>
>
Not sure what your question is. It sounds like you do not host your own
email, and have no say-so in how it gets filtered. If you are getting a
lot of spam, then I would consider getting someone else to host my email.
Like mentioned above, you could filter the try to filter messages at the
end-client. You could get software from http://www.spamfighter.com/.
((It's microsoft certified)) I've never used it, but perhaps you could,
and let us all know how it goes?
The only other thing I can think, is for you to host your own email, and
run spamassassin. You could then learn email according to your own
domain needs, and not have to worry about 99% of spam.
-=Aubrey=-
Re: Newbie needs help with Spam/Spam Assassin
Posted by ".rp" <pr...@moveupdate.com>.
> My email is through my website: www.rimesrv.net which is hosted on
> www.totalchoicehosting.com and they use Spam Assassin for spam
> filtering. I don't know a lot about SA.
>
> Over the last weeks or a month my spam has increased dramatically.
> What is particularly frustrating is that I get many in the same day
> with the same or near identical subject and body. Today it is
> "RE:Report" - ten came in this morning. See example below.
>
> I'm careful where I put my email address. Apparently, not careful
> enough. Many of these spams seem to be related to the stock market.
>
You may have fallen to a dictionary attack, ie: they didn't know you where
there they just threw a bunch of names at your mailserver.
> - any suggestions/advice?
>
get an email filter for your email client as well , so that it filters what your
mailserver does not.
RE: Newbie needs help with Spam/Spam Assassin
Posted by Bret Miller <br...@wcg.org>.
> - why doesn't Spam Assassin recognize all these with the same
> subject/body as spam?
Did you train your bayes database on one or more of these messages to
tell it they were spam? It scored bayes_00 meaning it thinks it's not
spam.
>
> - any suggestions/advice?
www.rulesemporium.com. Get the 70_sare_stocks.cf rule set and update it
regularly.
Bret
>
> - is there anywhere else to seek help?
>
> Thanks very much.
>
> Brooks
>
> Return-path: <th...@aacr.org>
> Envelope-to: brooks@rimesrv.net
> Delivery-date: Fri, 15 Dec 2006 08:44:29 -0500
> Received: from rimesrv by server38.tchmachines.com with
> local-bsmtp (Exim
> 4.52)
> id 1GvDMN-0003Is-Pk
> for brooks@rimesrv.net; Fri, 15 Dec 2006 08:44:29 -0500
> X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on
> server38.tchmachines.com
> X-Spam-Level: *
> X-Spam-Status: No, score=1.4 required=5.0
> tests=BAYES_00,RCVD_IN_NJABL_DUL,
> RCVD_IN_SORBS_DUL autolearn=no version=3.1.7
> Received: from alyon-252-1-24-3.w82-122.abo.wanadoo.fr ([82.122.55.3])
> by server38.tchmachines.com with esmtp (Exim 4.52)
> id 1GvDM6-00031f-5u
> for brooks@rimesrv.net; Fri, 15 Dec 2006 08:44:20 -0500
> Received: from 207.188.202.98 (HELO mail.aacr.org)
> by rimesrv.net with esmtp (2T<7,0=-B52 +6)3(N)
> id 0(,N:Y--5,/4Y-(A
> for brooks@rimesrv.net; Fri, 15 Dec 2006 13:44:16 -0060
> From: "Jesse Colvin" <th...@aacr.org>
> To: <br...@rimesrv.net>
> Subject: RE:Report
> Date: Fri, 15 Dec 2006 13:44:16 -0060
> Message-ID: <01...@thievishsinner>
> MIME-Version: 1.0
> Content-Type: text/plain;
> charset="us-ascii"
> Content-Transfer-Encoding: 7bit
> X-Priority: 3 (Normal)
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Office Outlook, Build 11.0.5510
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
> Thread-Index: Aca6Q7,8A'8X7H6,38/P140)+->,(1==
>
>