You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris Santerre <cs...@MerchantsOverseas.com> on 2005/03/02 19:57:53 UTC
RE: Typical spam not detected at all.. there is no rule for it :-
\
How about an eval that counts the number of '|' in a message. Over 4 and you
got yourself a spam :)
--Chris
>-----Original Message-----
>From: David Vel�squez [mailto:david@conexcol.com]
>Sent: Wednesday, March 02, 2005 1:46 PM
>To: spamassassin-users@incubator.apache.org
>Subject: Typical spam not detected at all.. there is no rule for it :-\
>
>
>Spam detection software, running on the system "co3.conexcol.com", has
>identified this incoming email as possible spam. The original message
>has been attached to this so you can view it (if it isn't
>spam) or label
>similar future email. If you have any questions, see
>abuse@conexcol.com for details.
>
>Content preview: US Oil and Gas Report Oi| C|imbs, Gains Soar We have
> the |eading track record for finding fast moving, Low-priced energy
> plays. Look at the moves made by our last 2 Hot Picks: SPRL
>.14 to .36
> in 12 days, up 157% PRVB .10 to .265 in 8 days, up 165% [...]
>
>Content analysis details: (-2.6 points, 5.0 required)
>
> pts rule name description
>---- ----------------------
>--------------------------------------------------
>-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0000]
>
Re: Typical spam not detected at all.. there is no rule for it :- \
Posted by Joe Kletch <jo...@kletch.com>.
Would a similar rule but looking for @ work to flag messages with say
10 addresses in the To: field?
Joe Kletch
On Mar 2, 2005, at 12:57 PM, Chris Santerre wrote:
> How about an eval that counts the number of '|' in a message. Over 4
> and you
> got yourself a spam :)
>
> --Chris
>
>> -----Original Message-----
>> From: David Velásquez [mailto:david@conexcol.com]
>> Sent: Wednesday, March 02, 2005 1:46 PM
>> To: spamassassin-users@incubator.apache.org
>> Subject: Typical spam not detected at all.. there is no rule for it
>> :-\
>>
>>
>> Spam detection software, running on the system "co3.conexcol.com", has
>> identified this incoming email as possible spam. The original message
>> has been attached to this so you can view it (if it isn't
>> spam) or label
>> similar future email. If you have any questions, see
>> abuse@conexcol.com for details.
>>
>> Content preview: US Oil and Gas Report Oi| C|imbs, Gains Soar We have
>> the |eading track record for finding fast moving, Low-priced energy
>> plays. Look at the moves made by our last 2 Hot Picks: SPRL
>> .14 to .36
>> in 12 days, up 157% PRVB .10 to .265 in 8 days, up 165% [...]
>>
>> Content analysis details: (-2.6 points, 5.0 required)
>>
>> pts rule name description
>> ---- ----------------------
>> --------------------------------------------------
>> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>> [score: 0.0000]
>>
Re: Typical spam not detected at all.. there is no rule for it :-\
Posted by David Velásquez <da...@conexcol.com>.
Notice that kind of "misspelings" should be Tripwire ruleset work... right?
The good news is I reported it and now it's detected:
Content analysis details: (7.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.1 BAYES_80 BODY: Bayesian spam probability is 80 to 95%
[score: 0.8973]
2.2 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[83.132.46.217 listed in sbl-xbl.spamhaus.org]
----- Original Message -----
From: "Chris Santerre" <cs...@MerchantsOverseas.com>
To: <sp...@incubator.apache.org>
Sent: Wednesday, March 02, 2005 1:57 PM
Subject: RE: Typical spam not detected at all.. there is no rule for it :-\
> How about an eval that counts the number of '|' in a message. Over 4 and
> you
> got yourself a spam :)
>
> --Chris
>
>>-----Original Message-----
>>From: David Velásquez [mailto:david@conexcol.com]
>>Sent: Wednesday, March 02, 2005 1:46 PM
>>To: spamassassin-users@incubator.apache.org
>>Subject: Typical spam not detected at all.. there is no rule for it :-\
>>
>>
>>Spam detection software, running on the system "co3.conexcol.com", has
>>identified this incoming email as possible spam. The original message
>>has been attached to this so you can view it (if it isn't
>>spam) or label
>>similar future email. If you have any questions, see
>>abuse@conexcol.com for details.
>>
>>Content preview: US Oil and Gas Report Oi| C|imbs, Gains Soar We have
>> the |eading track record for finding fast moving, Low-priced energy
>> plays. Look at the moves made by our last 2 Hot Picks: SPRL
>>.14 to .36
>> in 12 days, up 157% PRVB .10 to .265 in 8 days, up 165% [...]
>>
>>Content analysis details: (-2.6 points, 5.0 required)
>>
>> pts rule name description
>>---- ----------------------
>>--------------------------------------------------
>>-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>> [score: 0.0000]
>>
>
RE: Typical spam not detected at all.. there is no rule for it :- \
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Wednesday, March 02, 2005 1:57 PM -0500 Chris Santerre
<cs...@MerchantsOverseas.com> wrote:
> How about an eval that counts the number of '|' in a message. Over 4 and
> you got yourself a spam :)
Would FP on lots of source code examples, particularly those including
regex's.