You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Micah Anderson <mi...@riseup.net> on 2008/11/11 15:37:18 UTC
Hard money conference spam
I'm getting probably 4-5 of these a day, the messages vary, so they
aren't the same, but they aren't firing on any specific rules related to
their 'hard money conference/webinar/seminar' etc. Does anyone have any
customized rules for these? I've been training my bayes on them, and its
starting to pick them up (at BAYES_40 now), but it could use some more
specific rules:
Content analysis details: (5.1 points, 8.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 FH_XMAIL_RND_833 Special X-Mailer Version
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.2305]
2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
1.0 RCVD_IN_BRBL RBL: Received via relay listed in Barracuda RBL
[66.29.0.197 listed in b.barracudacentral.org]
1.0 RCVD_IN_JMF_BR RBL: Sender listed in JMF-BROWN
[66.29.0.197 listed in hostkarma.junkemailfilter.com]
1.1 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
[URIs: hardmoney-event.com]
Return-Path: <n....@rutcommercial.com>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on spamd1.riseup.net
X-Spam-Level: ***
X-Spam-Status: No, score=3.9 required=5.0 tests=FH_XMAIL_RND_833,
RCVD_IN_JMF_BR,URIBL_BLACK,URIBL_RHS_DOB autolearn=no version=3.2.5
Delivered-To: micah@riseup.net
Received: from mx1.riseup.net (egret-vpn.riseup.net [10.8.0.3])
by cormorant.riseup.net (Postfix) with ESMTP id 602201C38CA8
for <mi...@riseup.net>; Mon, 10 Nov 2008 23:23:26 -0800 (PST)
Received: from ip197.rutcommercial.com (ip197.rutcommercial.com [66.29.0.197])
by mx1.riseup.net (Postfix) with SMTP id 10F4757002B
for <mi...@riseup.net>; Mon, 10 Nov 2008 23:23:10 -0800 (PST)
Date: Tue, 11 Nov 2008 02:10:03 -0500
From: "Larry Rivera" <la...@rutcommercial.com>
To: micah@riseup.net
Subject: thursday's hard money
MIME-Version: 1.0
X-Mailer: oer v8.3.3.1000.10001079
Reply-To: r.661.10001079@rutcommercial.com
Message-Id: <20...@rutcommercial.com>
Content-Type: text/plain;
charset="iso-8859-1"
X-Virus-Scanned: ClamAV 0.94/8607/Mon Nov 10 21:55:28 2008 on mx1.riseup.net
X-Virus-Status: Clean
Content-Length: 528
Hard Money National Event takes place on November 13th.
follow the following steps to register:
1. Visit our website http://hardmoney-event.com
2. click "attend a seminar" and register for the event.
3. We will confirm your registration the same day.
4. call us at 858-736-7788 for additional information.
If you wish to opt out of future messages, please go to
http://hardmoney-event.com/uns/ or, send us a letter to PBMSII, 5580 la jolla blvd #153 La Jolla, Ca 92037
--------------------------------------------
.
Re: Hard money conference spam
Posted by Micah Anderson <mi...@riseup.net>.
Rob McEwen <ro...@powerviewsystems.com> writes:
> Micah,
>
> In addition to the barracuda RBL, this IP is also listed on ivmSIP
> (since 10/21/08) and ivmSIP/24
Can you provide me with the local.cf details to be able to add the
ivm RBLs?
> Additionally, the domain "hardmoney-event DOT com" is blacklisted on
> both ivmURI and URIBL.COM
>
> At the very least, you should add uribl.com to your filtering since that
> list is free. Scoring with URIBL for this would have easily put that
> message "over the top" for you.
I understood URIBL to be enabled by default in SA, and updated via
sa-update, in fact I've got:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf
> SHORT ANSWER: Start using uribl.com's URI blacklist
Am I not using it already? Maybe I'm not, and the 25_uribl.cf doesn't
include it? If so, I would really like to know about this.
Thanks!
Micah
Re: Hard money conference spam
Posted by Rob McEwen <ro...@powerviewsystems.com>.
Micah,
In addition to the barracuda RBL, this IP is also listed on ivmSIP
(since 10/21/08) and ivmSIP/24
Additionally, the domain "hardmoney-event DOT com" is blacklisted on
both ivmURI and URIBL.COM
At the very least, you should add uribl.com to your filtering since that
list is free. Scoring with URIBL for this would have easily put that
message "over the top" for you.
SHORT ANSWER: Start using uribl.com's URI blacklist
-- Rob McEwen http://dnsbl.invaluement.com/ rob@invaluement.com +1 (478)
475-9032
Re: Hard money conference spam
Posted by Rob McEwen <ro...@invaluement.com>.
Micah,
In addition to the barracuda RBL, this IP is also listed on ivmSIP
(since 10/21/08) and ivmSIP/24
Additionally, the domain "hardmoney-event DOT com" is blacklisted on
both ivmURI and URIBL.COM
At the very least, you should add uribl.com to your filtering since that
list is free. Scoring with URIBL for this would have easily put that
message "over the top" for you.
SHORT ANSWER: Start using uribl.com's URI blacklist
--
Rob McEwen
http://dnsbl.invaluement.com/
rob@invaluement.com
+1 (478) 475-9032