You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Dan Mahoney, System Admin" <da...@prime.gushi.org> on 2005/09/06 22:41:39 UTC
Re: [sa-list] Re: OTC stock spam
On Thu, 26 May 2005, Loren Wilton wrote:
> I'm not going to try running that, but I've got a pile of rules that catch
> stock scams like that. SARE has a good bunch of them, the better ones of
> course.
>
> Here, the most recent spam I got was a stock spam. It hit:
>
> 1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
> 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
> 0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
> 1.7 SARE_FWDLOOK BODY: Forward looking statements about stocks
> 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
> 1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
> 1.1 FB_SAVE_PERSC BODY: /sav(?:e|ing).{1,45}p[re][re]scription/i
> 2.0 LW_OTCBB BODY: Reference to stock
> 1.0 LW_1933 BODY: Reference to Securities Act
> 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
> 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
> 2.7 NOT_ADVISOR BODY: Not registered investment advisor
> 0.3 SARE_MILLIONSOF BODY: Millions of something.
> 0.1 HTML_MESSAGE BODY: HTML included in message
> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> [score: 1.0000]
> 0.9 FM_NO_STYLE FM_NO_STYLE
Loren,
Where can I find those LW_* rules? Or are they part of your private
collection?
-Dan
--
"Don't try to out-wierd me. I get stranger things than you free with my
breakfast cereal."
-Button seen at I-CON XVII (and subsequently purchased)
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
Re: [sa-list] Re: OTC stock spam
Posted by jdow <jd...@earthlink.net>.
From: "Dan Mahoney, System Admin" <da...@prime.gushi.org>
> On Thu, 26 May 2005, Loren Wilton wrote:
>
>> I'm not going to try running that, but I've got a pile of rules that
>> catch
>> stock scams like that. SARE has a good bunch of them, the better ones of
>> course.
>>
>> Here, the most recent spam I got was a stock spam. It hit:
>>
>> 1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
>> 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
>> 0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
>> 1.7 SARE_FWDLOOK BODY: Forward looking statements about stocks
>> 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
>> 1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
>> 1.1 FB_SAVE_PERSC BODY: /sav(?:e|ing).{1,45}p[re][re]scription/i
>> 2.0 LW_OTCBB BODY: Reference to stock
>> 1.0 LW_1933 BODY: Reference to Securities Act
>> 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
>> 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
>> 2.7 NOT_ADVISOR BODY: Not registered investment advisor
>> 0.3 SARE_MILLIONSOF BODY: Millions of something.
>> 0.1 HTML_MESSAGE BODY: HTML included in message
>> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
>> [score: 1.0000]
>> 0.9 FM_NO_STYLE FM_NO_STYLE
>
> Loren,
>
> Where can I find those LW_* rules? Or are they part of your private
> collection?
They are part of his own collection. The "loan" and some other money
terms rules tend to misfire as he and I have them. (We each have our
own mortgage rules.)
Re: [sa-list] Re: OTC stock spam
Posted by qqqq <qq...@usermail.com>.
Loren,
Will you post your LW Stox based rules? I think we would all like to see them.
QQQQ
----- Original Message -----
From: "Dan Mahoney, System Admin" <da...@prime.gushi.org>
To: "Loren Wilton" <lw...@earthlink.net>
Cc: <us...@spamassassin.apache.org>
Sent: Tuesday, September 06, 2005 2:41 PM
Subject: Re: [sa-list] Re: OTC stock spam
| On Thu, 26 May 2005, Loren Wilton wrote:
|
| > I'm not going to try running that, but I've got a pile of rules that catch
| > stock scams like that. SARE has a good bunch of them, the better ones of
| > course.
| >
| > Here, the most recent spam I got was a stock spam. It hit:
| >
| > 1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
| > 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
| > 0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
| > 1.7 SARE_FWDLOOK BODY: Forward looking statements about stocks
| > 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
| > 1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
| > 1.1 FB_SAVE_PERSC BODY: /sav(?:e|ing).{1,45}p[re][re]scription/i
| > 2.0 LW_OTCBB BODY: Reference to stock
| > 1.0 LW_1933 BODY: Reference to Securities Act
| > 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
| > 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
| > 2.7 NOT_ADVISOR BODY: Not registered investment advisor
| > 0.3 SARE_MILLIONSOF BODY: Millions of something.
| > 0.1 HTML_MESSAGE BODY: HTML included in message
| > 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
| > [score: 1.0000]
| > 0.9 FM_NO_STYLE FM_NO_STYLE
|
| Loren,
|
| Where can I find those LW_* rules? Or are they part of your private
| collection?
|
| -Dan
|
| --
|
| "Don't try to out-wierd me. I get stranger things than you free with my
| breakfast cereal."
|
| -Button seen at I-CON XVII (and subsequently purchased)
|
| --------Dan Mahoney--------
| Techie, Sysadmin, WebGeek
| Gushi on efnet/undernet IRC
| ICQ: 13735144 AIM: LarpGM
| Site: http://www.gushi.org
| ---------------------------
|
|
Re: [sa-list] Re: OTC stock spam
Posted by jdow <jd...@earthlink.net>.
He's more aggressive than I am. For him spam is 4.6. For me it's 5.0 and
I only score BAYES_99 at 5.0 points.
{^_-}
----- Original Message -----
From: "Dan Mahoney, System Admin" <da...@prime.gushi.org>
> On Tue, 6 Sep 2005, M.Lewis wrote:
>
>> Also what did you use to get the report?
>
> The report shows up in most setups in any spam email. Considering this
> one scored the way it did, I'm pretty sure it scored as spam.
>
> -Dan
>
>
>>
>> Dan Mahoney, System Admin wrote:
>>> On Thu, 26 May 2005, Loren Wilton wrote:
>>>
>>>> I'm not going to try running that, but I've got a pile of rules that
>>>> catch
>>>> stock scams like that. SARE has a good bunch of them, the better ones
>>>> of
>>>> course.
>>>>
>>>> Here, the most recent spam I got was a stock spam. It hit:
>>>>
>>>> 1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
>>>> 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
>>>> 0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
>>>> 1.7 SARE_FWDLOOK BODY: Forward looking statements about
>>>> stocks
>>>> 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
>>>> 1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
>>>> 1.1 FB_SAVE_PERSC BODY:
>>>> /sav(?:e|ing).{1,45}p[re][re]scription/i
>>>> 2.0 LW_OTCBB BODY: Reference to stock
>>>> 1.0 LW_1933 BODY: Reference to Securities Act
>>>> 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
>>>> 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
>>>> 2.7 NOT_ADVISOR BODY: Not registered investment advisor
>>>> 0.3 SARE_MILLIONSOF BODY: Millions of something.
>>>> 0.1 HTML_MESSAGE BODY: HTML included in message
>>>> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
>>>> 100%
>>>> [score: 1.0000]
>>>> 0.9 FM_NO_STYLE FM_NO_STYLE
>>>
>>>
>>> Loren,
>>>
>>> Where can I find those LW_* rules? Or are they part of your private
>>> collection?
>>>
>>> -Dan
Re: [sa-list] Re: OTC stock spam
Posted by "Dan Mahoney, System Admin" <da...@prime.gushi.org>.
On Tue, 6 Sep 2005, M.Lewis wrote:
> Also what did you use to get the report?
The report shows up in most setups in any spam email. Considering this
one scored the way it did, I'm pretty sure it scored as spam.
-Dan
>
> Dan Mahoney, System Admin wrote:
>> On Thu, 26 May 2005, Loren Wilton wrote:
>>
>>> I'm not going to try running that, but I've got a pile of rules that catch
>>> stock scams like that. SARE has a good bunch of them, the better ones of
>>> course.
>>>
>>> Here, the most recent spam I got was a stock spam. It hit:
>>>
>>> 1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
>>> 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
>>> 0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
>>> 1.7 SARE_FWDLOOK BODY: Forward looking statements about stocks
>>> 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
>>> 1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
>>> 1.1 FB_SAVE_PERSC BODY: /sav(?:e|ing).{1,45}p[re][re]scription/i
>>> 2.0 LW_OTCBB BODY: Reference to stock
>>> 1.0 LW_1933 BODY: Reference to Securities Act
>>> 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
>>> 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
>>> 2.7 NOT_ADVISOR BODY: Not registered investment advisor
>>> 0.3 SARE_MILLIONSOF BODY: Millions of something.
>>> 0.1 HTML_MESSAGE BODY: HTML included in message
>>> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
>>> [score: 1.0000]
>>> 0.9 FM_NO_STYLE FM_NO_STYLE
>>
>>
>> Loren,
>>
>> Where can I find those LW_* rules? Or are they part of your private
>> collection?
>>
>> -Dan
>>
>> --
>>
>> "Don't try to out-wierd me. I get stranger things than you free with my
>> breakfast cereal."
>>
>> -Button seen at I-CON XVII (and subsequently purchased)
>>
>> --------Dan Mahoney--------
>> Techie, Sysadmin, WebGeek
>> Gushi on efnet/undernet IRC
>> ICQ: 13735144 AIM: LarpGM
>> Site: http://www.gushi.org
>> ---------------------------
>>
>>
>>
>
--
"Little tramp sits in her room all day, sewing dolls! Children
misbehaving in the basement, and one in the walls, doing his business God
knows where! You children will be the death of me, *sniff*."
'Mommy', The People Under The Stairs
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
Re: [sa-list] Re: OTC stock spam
Posted by "M.Lewis" <_S...@cajuninc.com>.
Also what did you use to get the report?
Dan Mahoney, System Admin wrote:
> On Thu, 26 May 2005, Loren Wilton wrote:
>
>> I'm not going to try running that, but I've got a pile of rules that
>> catch
>> stock scams like that. SARE has a good bunch of them, the better ones of
>> course.
>>
>> Here, the most recent spam I got was a stock spam. It hit:
>>
>> 1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
>> 0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
>> 0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
>> 1.7 SARE_FWDLOOK BODY: Forward looking statements about stocks
>> 0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
>> 1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
>> 1.1 FB_SAVE_PERSC BODY: /sav(?:e|ing).{1,45}p[re][re]scription/i
>> 2.0 LW_OTCBB BODY: Reference to stock
>> 1.0 LW_1933 BODY: Reference to Securities Act
>> 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
>> 0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
>> 2.7 NOT_ADVISOR BODY: Not registered investment advisor
>> 0.3 SARE_MILLIONSOF BODY: Millions of something.
>> 0.1 HTML_MESSAGE BODY: HTML included in message
>> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
>> [score: 1.0000]
>> 0.9 FM_NO_STYLE FM_NO_STYLE
>
>
> Loren,
>
> Where can I find those LW_* rules? Or are they part of your private
> collection?
>
> -Dan
>
> --
>
> "Don't try to out-wierd me. I get stranger things than you free with my
> breakfast cereal."
>
> -Button seen at I-CON XVII (and subsequently purchased)
>
> --------Dan Mahoney--------
> Techie, Sysadmin, WebGeek
> Gushi on efnet/undernet IRC
> ICQ: 13735144 AIM: LarpGM
> Site: http://www.gushi.org
> ---------------------------
>
>
>