You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Evan Platt <ev...@espphotography.com> on 2004/06/27 19:25:29 UTC
Anyone have rules for this?
Searched the archive didn't see anything.. And no, I can't really upgrade
SA, it's integrated into my mail software (Merak)
Subject: $12882
Date: Sun, 27 Jun 2004 20:13:55 +0300
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Spam-Status: No, hits=1.90 required=5.00
tests=SUBJ_DOLLARS,BAD_CREDIT,BAYES_20,NO_RDNS2 version=2.61
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 2.61 (1.2.2) on espphotography.com
Hello,
I sent you an email a few days ago, because you now qualify for a new mortgage.
You could get $300,000 for as little as $700 a month!
Bad credit is no problem, you can pull cash out or refinance.
Please click on this link:
http://finance-planet.info/a1/ke.php?bks=71
Best Regards,
Steve Morris
---- system information ----
maintaining variation creating environment location formatting allow parties
identifier operation procedure running Internationalization which patterns
function
Use Task distinctions version yet model remote latest
Re: Anyone have rules for this?
Posted by Jeff Chan <je...@surbl.org>.
On Sunday, June 27, 2004, 10:25:29 AM, Evan Platt wrote:
> http://finance-planet-MUNGED.info/a1/ke.php?bks=71
FWIW finance-planet.info is on all four SURBL lists:
http://www.surbl.org/
> % grep finance-planet.info *bind
> ab.surbl.org.bind:finance-planet.info IN A 127.0.0.2
> multi.surbl.org.bind:finance-planet.info 600 IN A 127.0.0. 54
> multi.surbl.org.bind: 600 IN TXT "Blocked, finance-planet.info on lists [sc][ws][ob][ab], See: http://www.surbl.org/lists.html"
> ob.surbl.org.bind:finance-planet.info IN A 127.0.0.2
> sc.surbl.org.bind:finance-planet.info IN A 127.0.0.2
> ws.surbl.org.bind:finance-planet.info IN A 127.0.0.2
When your mail system eventually migrates to SpamAssassin 3 you
should be able to use SURBLs to block based on message body URIs,
assuming your developers keep the default support enabled
and use URIDNSBL.pm
http://spamassassin.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Anyone have rules for this?
Posted by Jon Trulson <jo...@radscan.com>.
On Fri, 9 Jul 2004, Kelson Vibber wrote:
> From: Kelson Vibber <ke...@speed.net>
> Date: Fri, 09 Jul 2004 16:52:43 -0700
> Subject: Re: Anyone have rules for this?
> To: spamassassin-users@incubator.apache.org
> X-Spam-Status: No, hits=-65.1 required=5.0 tests=AWL,BAYES_00,UPPERCASE_25_50,
> USER_IN_WHITELIST,USER_IN_WHITELIST_TO autolearn=no version=2.60
>
> At 04:29 PM 7/9/2004, Jon Trulson wrote:
> >On Sun, 27 Jun 2004, Evan Platt wrote:
> > > X-Spam-Status: No, hits=-54.1 required=5.0 tests=AWL,BAD_CREDIT,BAYES_10,
> > > FAKE_HELO_YAHOO,RCVD_IN_SORBS,USER_IN_WHITELIST,USER_IN_WHITELIST_TO
> > > autolearn=no version=2.60
> >
> > Use Bayes... Haven't been seeing these in my inbox for a few weeks
> >now.
>
> Huh? He *is* using Bayes - it's right there, BAYES_10. And there's no way
But apparently not trained well enough. As I said, I get BAYES_99
on these now.
> that training Bayes to get BAYES_99 on this can counteract
> USER_IN_WHITELIST_TO.
This is true, however, I did not see USER_IN_WHITELIST_TO in the
OP's original email... rather, I see:
... tests=SUBJ_DOLLARS,BAD_CREDIT,BAYES_20,NO_RDNS2 version=2.61
So... ?
--
Jon Trulson mailto:jon@radscan.com
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include <std/disclaimer.h>
"I am Nomad." -Nomad
Re: Anyone have rules for this?
Posted by Kelson Vibber <ke...@speed.net>.
At 04:29 PM 7/9/2004, Jon Trulson wrote:
>On Sun, 27 Jun 2004, Evan Platt wrote:
> > X-Spam-Status: No, hits=-54.1 required=5.0 tests=AWL,BAD_CREDIT,BAYES_10,
> > FAKE_HELO_YAHOO,RCVD_IN_SORBS,USER_IN_WHITELIST,USER_IN_WHITELIST_TO
> > autolearn=no version=2.60
>
> Use Bayes... Haven't been seeing these in my inbox for a few weeks
>now.
Huh? He *is* using Bayes - it's right there, BAYES_10. And there's no way
that training Bayes to get BAYES_99 on this can counteract
USER_IN_WHITELIST_TO.
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: Anyone have rules for this?
Posted by Jon Trulson <jo...@radscan.com>.
On Sun, 27 Jun 2004, Evan Platt wrote:
> From: Evan Platt <ev...@espphotography.com>
> Date: Sun, 27 Jun 2004 10:25:29 -0700
> Subject: Anyone have rules for this?
> To: spamassassin-users@incubator.apache.org
> X-Spam-Status: No, hits=-54.1 required=5.0 tests=AWL,BAD_CREDIT,BAYES_10,
> FAKE_HELO_YAHOO,RCVD_IN_SORBS,USER_IN_WHITELIST,USER_IN_WHITELIST_TO
> autolearn=no version=2.60
>
> Searched the archive didn't see anything.. And no, I can't really upgrade
> SA, it's integrated into my mail software (Merak)
>
> Subject: $12882
> Date: Sun, 27 Jun 2004 20:13:55 +0300
[...]
Use Bayes... Haven't been seeing these in my inbox for a few weeks
now.
--
Jon Trulson mailto:jon@radscan.com
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include <std/disclaimer.h>
"I am Nomad." -Nomad
Re: Anyone have rules for this?
Posted by Loren Wilton <lw...@earthlink.net>.
Hum, I hadn't bothered making rules for those specifically because they are
getting caught by other local rules. But those wouldn't be applicable in
your case, so something like the following UNTESTED rules would probably
work. Um, versino 2.61. Did that have metas? I don't recall. If it did,
the first set will work for you. If not, use the second set.
header __LW_SUB_DOLLARS Subject =~ /^\$\d{1,7}\s*$/
body __LW_HELLO_MORT /\nHello,\s*\nI sent you an email a few days ago,
because you now qualify for a new mortgage\.\s*\n/
meta LW_MORT_SPAM (__LW_SUB_DOLLARS && __LW_HELLO_MORT)
describe LW_MORT_SPAM You won a new mortgage!
score LW_MORT_SPAM 4.8
Non-meta:
header LW_SUB_DOLLARS Subject =~ /^\$\d{1,7}\s*$/
body LW_HELLO_MORT /\nHello,\s*\nI sent you an email a few days ago,
because you now qualify for a new mortgage\.\s*\n/
score LW_SUB_DOLLARS 1
score LW_HELLO_MORT 4
Loren
----- Original Message -----
From: "Evan Platt" <ev...@espphotography.com>
To: <sp...@incubator.apache.org>
Sent: Sunday, June 27, 2004 10:25 AM
Subject: Anyone have rules for this?
> Searched the archive didn't see anything.. And no, I can't really upgrade
> SA, it's integrated into my mail software (Merak)
>
> Subject: $12882
> Date: Sun, 27 Jun 2004 20:13:55 +0300
> MIME-Version: 1.0
> Content-Type: text/plain;
> charset="iso-8859-1"
> Content-Transfer-Encoding: 8bit
> X-Spam-Status: No, hits=1.90 required=5.00
> tests=SUBJ_DOLLARS,BAD_CREDIT,BAYES_20,NO_RDNS2 version=2.61
> X-Spam-Level: *
> X-Spam-Checker-Version: SpamAssassin 2.61 (1.2.2) on espphotography.com
>
> Hello,
> I sent you an email a few days ago, because you now qualify for a new
mortgage.
> You could get $300,000 for as little as $700 a month!
> Bad credit is no problem, you can pull cash out or refinance.
>
> Please click on this link:
> http://finance-planet.info/a1/ke.php?bks=71
>
> Best Regards,
> Steve Morris
>
>
> ---- system information ----
> maintaining variation creating environment location formatting allow
parties
>
> identifier operation procedure running Internationalization which patterns
> function
> Use Task distinctions version yet model remote latest
>
Re: Anyone have rules for this?
Posted by Jeff Chan <je...@surbl.org>.
On Sunday, June 27, 2004, 9:44:39 PM, Evan Platt wrote:
> At 11:46 AM 6/27/2004, you wrote:
>> The sa-blacklist contains this domain, so would have added 1-3
>>points to that spam. http://www.stearns.org/sa-blacklist and
>>http://www.surbl.org .
> Both appear to only work with 2.63, correct?
SURBLs can be used with 2.63 and 3.0 as described at:
http://www.surbl.org/
I presume the regular expressions in sa-blacklist can
be used with most SA versions. (Most of the domains
in sa-blacklist are in the corresponding SURBL version,
ws.surbl.org.)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Anyone have rules for this?
Posted by Evan Platt <ev...@espphotography.com>.
At 11:46 AM 6/27/2004, you wrote:
> The sa-blacklist contains this domain, so would have added 1-3
>points to that spam. http://www.stearns.org/sa-blacklist and
>http://www.surbl.org .
Both appear to only work with 2.63, correct?
> Are you training SA with Bayes? That would have added up to 5
>points as well.
Not sure if I can - SA is integrated into Merak Mail Server. I'll do some
searching and see if I can.
Thanks.
Evan
Re: Anyone have rules for this?
Posted by Loren Wilton <lw...@earthlink.net>.
> But so far all the ones I've seen have included a URI to a web
> site, which we can block on using SURBLs.......... ;-)
One of four web sites, to be even more precise. And I bet SURBL probably
catches all four.
But I was thinking of rules for the people (like me) that don't run network
checks for one reason or other.
Loren
Re: Anyone have rules for this?
Posted by Jeff Chan <je...@surbl.org>.
On Sunday, June 27, 2004, 6:16:15 PM, Loren Wilton wrote:
>> I've been getting these also. The subject is always a $ followed by a
>> string of five numbers. It sounds like that's the best way to address
>> these.
> No its not. It varies from 3 to 6 digits after the $ sign.
> The body text also varies, as does whether its sent plain text or html.
But so far all the ones I've seen have included a URI to a web
site, which we can block on using SURBLs.......... ;-)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Anyone have rules for this?
Posted by Loren Wilton <lw...@earthlink.net>.
> I've been getting these also. The subject is always a $ followed by a
> string of five numbers. It sounds like that's the best way to address
> these.
No its not. It varies from 3 to 6 digits after the $ sign.
The body text also varies, as does whether its sent plain text or html.
Loren
Re: Anyone have rules for this?
Posted by Richard Ozer <ro...@ois-online.com>.
I've been getting these also. The subject is always a $ followed by a
string of five numbers. It sounds like that's the best way to address
these.
RO
----- Original Message -----
From: "William Stearns" <ws...@pobox.com>
To: "Evan Platt" <ev...@espphotography.com>
Cc: "ML-spamassassin-talk" <sp...@incubator.apache.org>;
"William Stearns" <ws...@pobox.com>
Sent: Sunday, June 27, 2004 11:46 AM
Subject: Re: Anyone have rules for this?
Good afternoon, Evan,
On Sun, 27 Jun 2004, Evan Platt wrote:
> Searched the archive didn't see anything.. And no, I can't really upgrade
> SA, it's integrated into my mail software (Merak)
>
> Subject: $12882
> Date: Sun, 27 Jun 2004 20:13:55 +0300
> MIME-Version: 1.0
> Content-Type: text/plain;
> charset="iso-8859-1"
> Content-Transfer-Encoding: 8bit
> X-Spam-Status: No, hits=1.90 required=5.00
> tests=SUBJ_DOLLARS,BAD_CREDIT,BAYES_20,NO_RDNS2 version=2.61
> X-Spam-Level: *
> X-Spam-Checker-Version: SpamAssassin 2.61 (1.2.2) on espphotography.com
>
> Hello,
> I sent you an email a few days ago, because you now qualify for a new
mortgage.
> You could get $300,000 for as little as $700 a month!
> Bad credit is no problem, you can pull cash out or refinance.
>
> Please click on this link:
> http://finance-planet.info/a1/ke.php?bks=71
The sa-blacklist contains this domain, so would have added 1-3
points to that spam. http://www.stearns.org/sa-blacklist and
http://www.surbl.org .
Are you training SA with Bayes? That would have added up to 5
points as well.
Cheers,
- Bill
---------------------------------------------------------------------------
"All programs evolve until they can send email."
-- Richard Letts
"Except Microsoft Exchange."
-- Art
(found on the Snort web site)
--------------------------------------------------------------------------
William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f,
rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org
--------------------------------------------------------------------------
Re: Anyone have rules for this?
Posted by William Stearns <ws...@pobox.com>.
Good afternoon, Evan,
On Sun, 27 Jun 2004, Evan Platt wrote:
> Searched the archive didn't see anything.. And no, I can't really upgrade
> SA, it's integrated into my mail software (Merak)
>
> Subject: $12882
> Date: Sun, 27 Jun 2004 20:13:55 +0300
> MIME-Version: 1.0
> Content-Type: text/plain;
> charset="iso-8859-1"
> Content-Transfer-Encoding: 8bit
> X-Spam-Status: No, hits=1.90 required=5.00
> tests=SUBJ_DOLLARS,BAD_CREDIT,BAYES_20,NO_RDNS2 version=2.61
> X-Spam-Level: *
> X-Spam-Checker-Version: SpamAssassin 2.61 (1.2.2) on espphotography.com
>
> Hello,
> I sent you an email a few days ago, because you now qualify for a new mortgage.
> You could get $300,000 for as little as $700 a month!
> Bad credit is no problem, you can pull cash out or refinance.
>
> Please click on this link:
> http://finance-planet.info/a1/ke.php?bks=71
The sa-blacklist contains this domain, so would have added 1-3
points to that spam. http://www.stearns.org/sa-blacklist and
http://www.surbl.org .
Are you training SA with Bayes? That would have added up to 5
points as well.
Cheers,
- Bill
---------------------------------------------------------------------------
"All programs evolve until they can send email."
-- Richard Letts
"Except Microsoft Exchange."
-- Art
(found on the Snort web site)
--------------------------------------------------------------------------
William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f,
rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org
--------------------------------------------------------------------------