You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Bowie Bailey <Bo...@BUC.com> on 2015/07/21 21:50:16 UTC
Spam surge
I am getting a bunch of spam that is hitting almost nothing except Bayes
and occasionally DCC. I can't seem to find any kind of pattern to key
on. The IP addresses, From addresses, Subject lines, URLs, etc are all
different. The URLS look normal and are generally .com domains. I'm
getting 20-30 per day on several of my email addresses.
Subjects are things like arthritis, cancer, medical alarms, tooth
whitening, vacation planning, A/C systems, etc.
Anyone else seeing this?
--
Bowie
Re: Spam surge
Posted by Reindl Harald <h....@thelounge.net>.
Am 21.07.2015 um 21:58 schrieb Reindl Harald:
>
> Am 21.07.2015 um 21:50 schrieb Bowie Bailey:
>> I am getting a bunch of spam that is hitting almost nothing except Bayes
>> and occasionally DCC. I can't seem to find any kind of pattern to key
>> on. The IP addresses, From addresses, Subject lines, URLs, etc are all
>> different. The URLS look normal and are generally .com domains. I'm
>> getting 20-30 per day on several of my email addresses.
>>
>> Subjects are things like arthritis, cancer, medical alarms, tooth
>> whitening, vacation planning, A/C systems, etc.
>>
>> Anyone else seeing this?
>
> yes, hence i wrote some months ago a webinterface for subject filters
>
> * starts with
> * ends with
> * contains
> * is equal
>
> * very low severity (0.5 points)
> * low severity (1.5 points)
> * medium severity (2.5 points)
> * high severity (3.5 points)
> * very high severity (4.5 points)
>
> the cron-script generating "local.cf" builds blocks like below and in
> the meantime the same was implemented for body filters
>
> # Body Begins Medium
> body CUST_BODY_8 /^(dear boss|god bless you|hi my dear beloved
> one good day|my beloved in god).*/i
> score CUST_BODY_8 2.5
> describe CUST_BODY_8 Begins Medium
uhm - that above was a body filter from the same logic
that's a sample for subjects
# Subject Ends Very Low
header __CUST_SUBJ_11 Subject =~ /.*(not\s+spam\.)$/i
meta CUST_SUBJ_11 (__HAS_SUBJECT && __CUST_SUBJ_11)
score CUST_SUBJ_11 0.5
describe CUST_SUBJ_11 Ends Very Low
Re: Spam surge
Posted by Reindl Harald <h....@thelounge.net>.
Am 21.07.2015 um 21:50 schrieb Bowie Bailey:
> I am getting a bunch of spam that is hitting almost nothing except Bayes
> and occasionally DCC. I can't seem to find any kind of pattern to key
> on. The IP addresses, From addresses, Subject lines, URLs, etc are all
> different. The URLS look normal and are generally .com domains. I'm
> getting 20-30 per day on several of my email addresses.
>
> Subjects are things like arthritis, cancer, medical alarms, tooth
> whitening, vacation planning, A/C systems, etc.
>
> Anyone else seeing this?
yes, hence i wrote some months ago a webinterface for subject filters
* starts with
* ends with
* contains
* is equal
* very low severity (0.5 points)
* low severity (1.5 points)
* medium severity (2.5 points)
* high severity (3.5 points)
* very high severity (4.5 points)
the cron-script generating "local.cf" builds blocks like below and in
the meantime the same was implemented for body filters
# Body Begins Medium
body CUST_BODY_8 /^(dear boss|god bless you|hi my dear beloved
one good day|my beloved in god).*/i
score CUST_BODY_8 2.5
describe CUST_BODY_8 Begins Medium
Re: Spam surge
Posted by Alex Regan <my...@gmail.com>.
Hi,
> I am getting a bunch of spam that is hitting almost nothing except Bayes
> and occasionally DCC. I can't seem to find any kind of pattern to key
> on. The IP addresses, From addresses, Subject lines, URLs, etc are all
> different. The URLS look normal and are generally .com domains. I'm
> getting 20-30 per day on several of my email addresses.
>
> Subjects are things like arthritis, cancer, medical alarms, tooth
> whitening, vacation planning, A/C systems, etc.
>
> Anyone else seeing this?
Yes, seeing them here too for at least the last two weeks.
Please let me know if someone is interested in a pastebin example to be
investigated or would like it sent to them...
thanks,
alex