You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by david <da...@suarapembaruan.co.id> on 2004/07/28 07:18:25 UTC
spammassassin didn't deteck
Dear all,
Can anybody help me, my spamassassin on mail server cann't detect this spam
mail....(hits only 0.8)
I already put spamassassin rules from sare imporeum to
/etc/mail/spamassassin directory...
Regards,
David Kandou
Return-Path: <gb...@chruszcz.de>
Delivered-To: davidkandou@suarapembaruan.com
Received: (qmail 13285 invoked by uid 509); 28 Jul 2004 04:35:34 -0000
Received: from gbarnes_wg@chruszcz.de by mail.suarapembaruan.co.id by uid
507 with qmail-scanner-1.22-st-qms
(clamdscan: 0.72. spamassassin: 2.63.
Clear:RC:0(62.143.132.253):SA:0(0.8/5.0):.
Processed in 2.27684 secs); 28 Jul 2004 04:35:34 -0000
X-Spam-Status: No, hits=0.8 required=5.0
X-Antivirus-MYDOMAIN-Mail-From: gbarnes_wg@chruszcz.de via
mail.suarapembaruan.co.id
X-Antivirus-MYDOMAIN: 1.22-st-qms
(Clear:RC:0(62.143.132.253):SA:0(0.8/5.0):. Processed in 2.27684 secs
Process 13268)
Received: from ip253.132.1511h-cud12k-01.ish.de (HELO mailbox.ch)
(62.143.132.253)
by mail.suarapembaruan.co.id with SMTP; 28 Jul 2004 04:35:32 -0000
Received: from 189.28.132.85 by smtp.chruszcz.de;
Wed, 28 Jul 2004 04:24:22 +0000
Message-ID: <4b...@mailbox.ch>
From: "Gloria Barnes" <gb...@chruszcz.de>
To: davidkandou@suarapembaruan.com
Subject: We give you $200 bonus at Casino Zeal!
Date: Wed, 28 Jul 2004 02:23:58 -0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Hi,
I have a special offer available for you at our casino.
$20 to try our internet casino, no deposit is necessary!
At the casino software's cashier enter bonus code: FR93P
$200 bonus on your first deposit!
At the casino software's cashier enter bonus code: FMJKU
Allow us to show you our quality operation, fast payouts,
generous bonuses, and super friendly around-the-clock
customer support.
Click here: http://bigbonus-casino.biz
Best regards,
Jamie Zawinsky
No thanks: http://bigbonus-casino.biz/u/
Re: spammassassin didn't deteck
Posted by Loren Wilton <lw...@earthlink.net>.
> Another possible rule suggested by Chris that will probably work well:
>
> header BONUS_AT Subhect =~ /bonus at\b/i
>
> Loren
Um, did I neglect to mention that I'm typing these rules into the replies
and they are UNTESTED? The one above obvously should be "Subject".
Loren
Re: spammassassin didn't deteck
Posted by Loren Wilton <lw...@earthlink.net>.
> Dear all,
>
> Can anybody help me, my spamassassin on mail server cann't detect this
spam
> mail....(hits only 0.8)
>
> I already put spamassassin rules from sare imporeum to
> /etc/mail/spamassassin directory...
Ah, the casino Zeal spams. I've had a few test rules out for them over the
last few days, but I don't believe they've had a chance to make it into the
official SARE rulesets yet.
This should be good for a few points until then on this specific spam:
header LW_ZELOUS_CASINO Subject =~ /\$200.*\bCasino\b/i
score LW_ZELOUS_CASINO 4.5
That and Bayes should nail them every time.
Another possible rule suggested by Chris that will probably work well:
header BONUS_AT Subhect =~ /bonus at\b/i
Loren
Re: spammassassin didn't deteck
Posted by Ryan Thompson <sp...@sasknow.com>.
david wrote to spamassassin-users@incubator.apache.org:
> Dear all,
>
> Can anybody help me, my spamassassin on mail server cann't detect this spam
> mail....(hits only 0.8)
>
> I already put spamassassin rules from sare imporeum to
> /etc/mail/spamassassin directory...
SURBL, Bayes, and DCC put this one well over the autolearn threshold for
me. Note that ALL_TRUSTED doesn't seem right, but that's probably
because whitespace got trashed when I sent this message through.
Content analysis details: (34.7 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.8 ALL_TRUSTED Did not pass through any untrusted hosts
1.2 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
4.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
2.0 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
4.0 URIBL_SBL Contains a URL listed in the SBL blocklist
[URIs: bigbonus-casino.biz]
5.0 URIBL_AB_SURBL Contains a URL listed in the AB SURBL blocklist
[URIs: bigbonus-casino.biz]
3.0 URIBL_WS_SURBL Contains a URL listed in the WS SURBL blocklist
[URIs: bigbonus-casino.biz]
4.0 URIBL_OB_SURBL Contains a URL listed in the OB SURBL blocklist
[URIs: bigbonus-casino.biz]
4.0 URIBL_SC_SURBL Contains a URL listed in the SC SURBL blocklist
[URIs: bigbonus-casino.biz]
0.0 CLICK_BELOW Asks you to click below
1.9 MSGID_DOLLARS Message-Id has pattern used in spam
6.5 RT_LNBH1 META: Spam index match, probability 1.000
- Ryan
--
Ryan Thompson <ry...@sasknow.com>
SaskNow Technologies - http://www.sasknow.com
901-1st Avenue North - Saskatoon, SK - S7K 1Y4
Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon
Toll-Free: 877-727-5669 (877-SASKNOW) North America