I get a lot of these spams, obviously by one software program

[Igor Chudov <ig...@chudov.com>]

example is here

http://igor.chudov.com/tmp/spam004.txt

I get a lot of these, always for different companies, but obviously
emailed by one spammer. 

I am on Ubuntu 8.04 using their stock spamassassin.

Are there some rulesets that I am missing?

i

Re: I get a lot of these spams, obviously by one software program

[mouss <mo...@netoyen.net>]

Igor Chudov a écrit :
> example is here
> 
> http://igor.chudov.com/tmp/spam004.txt
> 


Content analysis details:   (8.2 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 2.1 RCVD_IN_NJABL_SPAM     RBL: NJABL: sender is confirmed spam source
                            [216.117.203.6 listed in combined.njabl.org]
 2.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: awardsforum.com]
 3.5 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 0.1 DIET_1                 BODY: Lose Weight Spam
 0.0 COUNTRY_US             Relayed via US
 0.6 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)


The sample triggers URIBL_BLACK, but I guess the URI was listed after
you got the spam.

if you get many of these, pass them to sa-learn (so that you get
BAYES_99 instead of BAYES_50).


> I get a lot of these, always for different companies, but obviously
> emailed by one spammer. 
> 
> I am on Ubuntu 8.04 using their stock spamassassin.
> 

SA 3.2.4?

> Are there some rulesets that I am missing?
> 

unrelated to your sample, but do use sa-update to update the rules. also
add some channels, in particular sought.rules.yerp.org (JM_SOUGHT).