You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Hackworth, Keith A" <Ke...@BELLSOUTH.COM> on 2004/03/26 22:06:01 UTC
how did this get through?!?!?
I need some suggestions building a rule for this one... Only thing that
hit was bayes - 40-44% probability of spam. Of course, I trained bayes
already.
I'm running Postfix/Amavisd (with Spamassassin module). Only cf file I
have is my local and bigevil.
Thanks,
Keith
Received: from localhost (localhost [127.0.0.1])
by email.realpages.com (Postfix) with ESMTP
id 9DE0048C09; Fri, 26 Mar 2004 15:33:46 -0500 (EST)
Received: from rwsmail.imvi.bellsouth.net (rwsmail [192.168.42.9])
by email.realpages.com (Postfix) with SMTP
id 0381048C0A; Fri, 26 Mar 2004 15:33:45 -0500 (EST)
Received: from email.realpages.com
(n-rwsmail.imvi.bellsouth.net [192.168.42.6])
by rwsmail.imvi.bellsouth.net (Post.Office MTA v3.5.3 release
223
ID# 0-52534L100S0V35) with ESMTP id net
for <do...@realpages.com>; Fri, 26 Mar 2004 15:35:07 -0500
Received: from localhost (localhost [127.0.0.1])
by email.realpages.com (Postfix) with ESMTP id 50B3048C11
for <do...@realpages.com>; Fri, 26 Mar 2004 15:33:41 -0500
(EST)
Received: from 24-241-32-106.charter.com (24-241-32-106.charter.com
[24.241.32.106])
by email.realpages.com (Postfix) with SMTP id 3B9C148C09
for <do...@realpages.com>; Fri, 26 Mar 2004 15:33:38 -0500
(EST)
Received: from astatine-y147.gerbil.guanajuato.com ([72.212.156.206]) by
ncy4-xw26.guanajuato.com with Microsoft SMTPSVC(5.0.2195.6824);
Fri, 26 Mar 2004 18:31:33 -0200
X-Message-Info: qpyO90gtm0RNTuMZ/VZ877CtnFOOyWBqioVDuKIJuk50H
From: Jimmie Nickerson <Ha...@futbolamericano.com>
To: domains@realpages.com
Subject: Secrets of ZOOfils revealed! New photos. Humans ffuccking
animals. Stallions penetrates human pusssies. snuff
Date: Fri, 26 Mar 2004 17:33:33 -0300 EST
Message-Id: <32...@thelma83-tr0.guanajuato.com>
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="--5349685091812236377"
X-Virus-Scanned: Virus scanned by RealPages.com
Return-Path: domains-request@realpages.com
X-OriginalArrivalTime: 26 Mar 2004 20:33:50.0281 (UTC)
FILETIME=[A58B2B90:01C41371]
----5349685091812236377
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable
----5349685091812236377--
-----Original Message-----
From: Jimmie Nickerson [mailto:Hattie@futbolamericano.com]
Sent: Friday, March 26, 2004 3:34 PM
To: domains@realpages.com
Subject: Secrets of ZOOfils revealed! New photos. Humans ffuccking
animals. Stallions penetrates human pusssies. snuff
Looks like you've come to a real ZOO here! Yeap! We have goats, we have
horses,
sheep, snakes, even dogs!
We have lots of animals here and we also have lots of girls who just
love
to have some ssexx with these creatures? How do they do it?
How do they suck those ccockss?
How do they ffucck with snakes? Snakes don't have cockss!!!
Guys! Our girls can do it with every creature they want!
They are ready for it! They are tired from men!
They do realize that wild animals are ffuck1ng like no man would ever
ffucck them.
Cause they are animals and they ffuckk just like everybody did thousands
and millions years ago!
Stunning images, videos, art series, lots of animals, yyoung horny girls
spreading their legs and ssuckingg cockkss!
This is a first ever site zoo where every girl can ffuckk the creature
she wants!
http://zoo-action.com/r22/?plant
Just take a look, it's realy intresting! ;-)
--
just some 345 news from world's uprise
But some economists worry that structural changes in the job market,
including technological advances and a growing appetite for cheap
offshore labor, will keep hiring muted in 2004.
*****
"The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 113
Re: how did this get through?!?!?
Posted by Doug Brott <br...@redh.com>.
Jamie L. Penman-Smithson wrote:
>
>X-Spam-Status: Yes, hits=8.6 tag1=-999.0 tag2=3.0 kill=5.0
>tests=BAYES_50,
> L_RCVD_IN_MANY, PYZOR_CHECK, RCVD_IN_BL_SPAMCOP_NET,
> RCVD_IN_DSBL, RCVD_IN_NJABL, RCVD_IN_NJABL_PROXY, RCVD_IN_SORBS,
> RCVD_IN_SORBS_SOCKS
>X-Spam-Level: ********
>
>
>
>
>
I got three of these all within about 10 minutes of each other. The
first made it through, but the second two were blocked .. The only
difference was that by the second incarnation, it had been added to one
realtime blacklist and by the third incarnation it was on two separate
realtime blacklists. I deleted the messages, so I can't tell you which
lists hit when.
--
Doug Brott
Re: how did this get through?!?!?
Posted by "Jamie L. Penman-Smithson" <ja...@silverdream.org>.
On Fri, 2004-03-26 at 21:06, Hackworth, Keith A wrote:
> I need some suggestions building a rule for this one... Only thing that
> hit was bayes - 40-44% probability of spam. Of course, I trained bayes
> already.
>
> I'm running Postfix/Amavisd (with Spamassassin module). Only cf file I
> have is my local and bigevil.
<snip>
A similar spam come through on one of the mailing lists I subscribe to -
it got tagged as spam:
X-Spam-Status: Yes, hits=8.6 tag1=-999.0 tag2=3.0 kill=5.0
tests=BAYES_50,
L_RCVD_IN_MANY, PYZOR_CHECK, RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_DSBL, RCVD_IN_NJABL, RCVD_IN_NJABL_PROXY, RCVD_IN_SORBS,
RCVD_IN_SORBS_SOCKS
X-Spam-Level: ********
All of them are network checks however, so I assume that you didn't have
them turned on. If you get SA to learn it as spam, bayes should kick in
the next time something like this appears.
You could also try Chris's new anti-porn-spam rules...
HTH
--
-jamie <ja...@silverdream.org> | spamtrap: spam@silverdream.org
w: http://silverdream.org | p: sms@silverdream.org
pgp key @ http://silverdream.org/~jps/pub.key
20:30:02 up 6 days, 6:32, 2 users, load average: 0.42, 0.63, 0.91
Re: how did this get through?!?!?
Posted by aj...@stepan.com.
"Hackworth, Keith A" <Ke...@BELLSOUTH.COM> wrote on 03/26/2004
03:06:01 PM:
> I need some suggestions building a rule for this one... Only thing that
> hit was bayes - 40-44% probability of spam. Of course, I trained bayes
> already.
>
> I'm running Postfix/Amavisd (with Spamassassin module). Only cf file I
> have is my local and bigevil.
>
> Thanks,
> Keith
>
>
[snip]
Add some additional rules. Looks like Chris's new adult rules did the
trick on this one. It scored 7.5 at my site.
X-Spam-Report:
* 2.5 SARE_ADLTSUB6 Apparent spam seems to contain porn subject
* 1.5 INVALID_DATE Invalid Date: header (not RFC 2822)
* 0.6 J_CHICKENPOX_52 BODY: {5}Letter - punctuation - {2}Letter
* 1.7 SARE_OBFUFCK2 BODY: Apparent spam seems to contain porn
subject
* 0.6 SARE_BADGIRLS BODY: Contains phrasing used by spammers
* 0.7 SARE_ADULT1 BODY: Contains adult material
* -0.0 BAYES_44 BODY: Bayesian spam probability is 44 to 50%
* [score: 0.4994]
Andy