"strategic oil" spam

[Jonathan Nichols <jn...@pbp.net>]

http://www.pbp.net/~jnichols/textfiles/spam_060606.txt

Here's an example of one. TONS of these have been slipping through. I 
have pretty much every single ruleset that RulesDuJour will install, 
plus Bayes, etc.

My big question - is there now a ruleset that lists stock ticker 
symbols? I'm thinking that something like that might be a good idea 
because of all these pump-n-dump penny stock spams.

I'm about to add 5pts for the word "strategic" since the only people I 
know that use it are military, managers, or spammers. :P

Re: "strategic oil" spam

[Theo Van Dinter <fe...@apache.org>]

On Tue, Jun 06, 2006 at 03:19:12PM -0700, Jonathan Nichols wrote:
> Here's an example of one. TONS of these have been slipping through. I 
> have pretty much every single ruleset that RulesDuJour will install, 
> plus Bayes, etc.

Well...

X-Spam-Status: No, score=5.253 tagged_above=-999 required=6
 tests=[DNS_FROM_RFC_ABUSE=0.479, RCVD_IN_XBL=3.114, SARE_LWSYMFMT=1.66]
X-Spam-Score: 5.253

You increased the required score to 6.  It would've been caught using
the default of 5.  With 3.1.2 and sa-update it gets above 6:

[9389] dbg: check: is spam? score=6.819 required=5
[9389] dbg: check: tests=BAYES_50,DCC_CHECK,DNS_FROM_RFC_ABUSE,MISSING_HB_SEP,MISSING_SUBJECT,TO_CC_NONE,UNPARSEABLE_RELAY

> My big question - is there now a ruleset that lists stock ticker 
> symbols? I'm thinking that something like that might be a good idea 
> because of all these pump-n-dump penny stock spams.

IMO, chasing the symbols themselves is a lost cause.  You end up with
something like a nigerian set of rules for a bajillion different phrases, then
a meta to try tieing them all together.  It's a pain to manage, typically
prone to FPs, hard to keep up with, and most importantly a resource hog and
time suck.

That said, I've seen several attempts at a symbol list.  There's one in
testing at the moment iirc.

-- 
Randomly Generated Tagline:
"It is not the strongest of the species that survives, not the most
 intelligent, but the one most responsive to change."    - Charles Darwin