Whoa-new spam today

[John Fleming <jo...@wa9als.com>]

I got 4-5 spams overnight that scored very low, and one didn't hit a single 
rule.

2 of them hit either SARE_MSGID_D10D4 or SARE_MSGID_IP, but one didn't hit 
anything.  They are just a mixture of nonsense and misspelled words, with a 
single URL.

They all came through the Debian mailing list, so I assume a bunch of Bayes 
ham training allowed coming through that list to "help" the spammer?  Any 
suggestions?

Here's a snippet of one:

Hello, handsome!

Having tried pills and realizing the importance of sustaining regular
blood levels of the formula through consistent regular dosing, I realized
my life was far too busy to keep track. With this product I simply
slap it on and let it do it.s thing, no muss or fuss.
This patch truly rocks as without having to stress about how often of how 
many
pills to take, I.ve acquired a size which makes me feel confident.
Abstainer. A weak man who yields to the temptation of denying himself a 
pleasure.
Braden
http://geocities.com/pailbzeopzxskcecvizkchhdzngoddi

X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on Luke.wa9als.com
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham
 version=3.0.2

Thanks, John



-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.9.17 - Release Date: 4/19/2005

Re: Whoa-new spam today

[Jeff Chan <je...@surbl.org>]

On Tuesday, April 19, 2005, 4:07:28 AM, John Fleming wrote:
> I got 4-5 spams overnight that scored very low, and one didn't hit a single 
> rule.

> 2 of them hit either SARE_MSGID_D10D4 or SARE_MSGID_IP, but one didn't hit 
> anything.  They are just a mixture of nonsense and misspelled words, with a 
> single URL.

> They all came through the Debian mailing list, so I assume a bunch of Bayes 
> ham training allowed coming through that list to "help" the spammer?  Any 
> suggestions?

> Here's a snippet of one:

> Hello, handsome!

> Having tried pills and realizing the importance of sustaining regular
> blood levels of the formula through consistent regular dosing, I realized
> my life was far too busy to keep track. With this product I simply
> slap it on and let it do it.s thing, no muss or fuss.
> This patch truly rocks as without having to stress about how often of how 
> many
> pills to take, I.ve acquired a size which makes me feel confident.
> Abstainer. A weak man who yields to the temptation of denying himself a 
> pleasure.
> Braden
> http://geocities.com/pailbzeopzxskcecvizkchhdzngoddi

If those are advertising an actual site on geocities, then please
report them to:

  geo-abuse@yahoo-inc.com

so Yahoo can shut them down.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/

Re: Whoa-new spam today

[Kelson <ke...@speed.net>]

John Fleming wrote:
> I got 4-5 spams overnight that scored very low, and one didn't hit a 
> single rule.

Hmm, the message looked familiar, and I checked my spam folder.  Sure 
enough, there was one in there.  The first 6 lines were identical to the 
one you posted, though the pithy saying, closing, and URL were different.

> They all came through the Debian mailing list, so I assume a bunch of 
> Bayes ham training allowed coming through that list to "help" the 
> spammer?  Any suggestions?

Mine came straight to me, so it tripped BAYES_99 easily.  I've bumped up 
the score on the Bayes rules a bit, so that, RCVD_NUMERIC_HELO, and 
RCVD_BY_IP landed it a score of 5.3.

Depending on how consistent the rest of them are, it might be possible 
to track some of the phrases.

-- 
Kelson Vibber
SpeedGate Communications <www.speed.net>