You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-user@james.apache.org by Bud Bach <ww...@ameritech.net> on 2007/03/12 16:10:41 UTC
specific spam
I'm running james 2.3 with the BayesianAnalysis filter. It is an awesome
combination except there are two fairly specific spam messages that seem to
get through no matter how many times I feed them to the engine, they still
seem to get though. The one is a for a type of drug (you know). The ad has
a rectangular colored box and they seed it with a bunch of random words.
The other one is a stock tip one that I can't seem to get rid of. Has
anyone figured out how to defeat these? -- Bud
Re: specific spam
Posted by Ahmed Mohombe <am...@yahoo.com>.
> a Greylist implementation exists in trunk
Are there any plans to release (soon) a version of James that would include the greylist and VUT?
These look like big features already - much more than it was added to previous versions.
Thanks in advance,
Ahmed.
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: specific spam
Posted by Norman Maurer <nm...@byteaction.de>.
Hi Bud,
a Greylist implementation exists in trunk
bye
Norman
Bud Bach schrieb:
> Sounds promising. Is there a James greylist implementation?
>
> Otherwise I have been a little lax on feeding ham...
>
> -- Bud
>
> -----Original Message-----
> From: David Legg [mailto:david.legg@searchevent.co.uk]
> Sent: Monday, March 12, 2007 6:26 PM
> To: James Users List
> Subject: Re: specific spam
>
> Mmm... that's interesting because our Bayesian analysis filter is
> working wonderfully. Sure, the odd one or two messages get through
> every now and then but training seems to work well. Don't forget you
> should train it with good messages as well as bad.
>
> There *are* patterns which the filter can detect. Every spam has a
> payload of some sort and more often than not the url of the payload
> remains fairly constant no matter how they try to disguise the lure text
> with images etc.
>
> On the other hand my ISP has just implemented Greylisting
> (http://projects.puremagic.com/greylisting/whitepaper.html) and although
> it is probably just a short term measure (maybe lasting a year or two
> until the spammers catch up) it has been dramatic in cutting down spam
> and has the benefit of needing no constant training.
>
>
>> not much hope on these with Bayesian Analysis IMO. There aren't any
>> patterns which such a filter can detect.
>> Would love to hear some ideas on how to detect them reliably, too.
>>
>>
>>> I'm running james 2.3 with the BayesianAnalysis filter. It is an
>>> awesome
>>> combination except there are two fairly specific spam messages that
>>> seem to
>>> get through no matter how many times I feed them to the engine,
>>>
>
> Regards,
> - David Legg
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
> For additional commands, e-mail: server-user-help@james.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
> For additional commands, e-mail: server-user-help@james.apache.org
>
>
--
Mit freundlichen Grüßen
i.A. Norman Maurer
Systemadministrator
ByteAction GmbH
Auf der Beune 83-85
64839 Münster
Phone: +49 (0) 60 71 92 16 - 21
Fax: +49 (0) 60 71 92 16 - 20
E-mail: nm@byteaction.de
Internet: www.byteaction.de
AG Darmstadt, HRB 33271
Ust-Id: DE206997247
GF: Thomas Volkert
------------------------------------------------------
Diese E-Mail enthält vertrauliche Informationen und ist nur für den in der E-Mail genannten Adressaten bestimmt. Für den Fall, dass der Empfänger dieser E-Mail nicht der in der E-Mail benannte Adressat ist, weisen wir darauf hin, dass das Lesen, Kopieren, die Wiedergabe, Verbreitung, Vervielfältigung, Bekanntmachung, Veränderung, Verteilung und/oder Veröffentlichung der E-Mail strengstens untersagt ist. Bitte verständigen Sie den Absender dieser E-Mail unter folgender Rufnummer +49 (0) 6071 / 9216-0, falls Sie irrtümlich diese E-Mail erhalten haben und löschen Sie diese E-Mail. Der Inhalt dieser E-Mail ist nur rechtsverbindlich, wenn er von unserer Seite schriftlich durch Brief oder Telefax bestätigt wird. Die Versendung von E-Mails an uns hat keine fristwahrende Wirkung.
This e-mail contains information which is privileged and is intended only for the Addressee named in the e-mail. In case that the recipient of this e-mail is not the named addressee, we would like to inform you that it is strictly prohibited to read, to reproduce, to disseminate, to copy, to disclose, to modify, to distribute and/or to publish this e-mail. If you have received this e-mail in error, please call the sender under following telephone number +49 (0) 6071 / 9216-0 and delete this e-mail. The content of this e-mail is not legally binding unless confirmed by letter or telefax. E-mails which are sent to us do not constitute compliance with any time limits or deadlines.
------------------------------------------------------
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
RE: specific spam
Posted by Bud Bach <ww...@ameritech.net>.
Sounds promising. Is there a James greylist implementation?
Otherwise I have been a little lax on feeding ham...
-- Bud
-----Original Message-----
From: David Legg [mailto:david.legg@searchevent.co.uk]
Sent: Monday, March 12, 2007 6:26 PM
To: James Users List
Subject: Re: specific spam
Mmm... that's interesting because our Bayesian analysis filter is
working wonderfully. Sure, the odd one or two messages get through
every now and then but training seems to work well. Don't forget you
should train it with good messages as well as bad.
There *are* patterns which the filter can detect. Every spam has a
payload of some sort and more often than not the url of the payload
remains fairly constant no matter how they try to disguise the lure text
with images etc.
On the other hand my ISP has just implemented Greylisting
(http://projects.puremagic.com/greylisting/whitepaper.html) and although
it is probably just a short term measure (maybe lasting a year or two
until the spammers catch up) it has been dramatic in cutting down spam
and has the benefit of needing no constant training.
> not much hope on these with Bayesian Analysis IMO. There aren't any
> patterns which such a filter can detect.
> Would love to hear some ideas on how to detect them reliably, too.
>
>> I'm running james 2.3 with the BayesianAnalysis filter. It is an
>> awesome
>> combination except there are two fairly specific spam messages that
>> seem to
>> get through no matter how many times I feed them to the engine,
Regards,
- David Legg
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: specific spam
Posted by David Legg <da...@searchevent.co.uk>.
Mmm... that's interesting because our Bayesian analysis filter is
working wonderfully. Sure, the odd one or two messages get through
every now and then but training seems to work well. Don't forget you
should train it with good messages as well as bad.
There *are* patterns which the filter can detect. Every spam has a
payload of some sort and more often than not the url of the payload
remains fairly constant no matter how they try to disguise the lure text
with images etc.
On the other hand my ISP has just implemented Greylisting
(http://projects.puremagic.com/greylisting/whitepaper.html) and although
it is probably just a short term measure (maybe lasting a year or two
until the spammers catch up) it has been dramatic in cutting down spam
and has the benefit of needing no constant training.
> not much hope on these with Bayesian Analysis IMO. There aren't any
> patterns which such a filter can detect.
> Would love to hear some ideas on how to detect them reliably, too.
>
>> I'm running james 2.3 with the BayesianAnalysis filter. It is an
>> awesome
>> combination except there are two fairly specific spam messages that
>> seem to
>> get through no matter how many times I feed them to the engine,
Regards,
- David Legg
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: specific spam
Posted by Norman Maurer <nm...@byteaction.de>.
Hi,
i fully agree... Greylisting is a "killer" ;-)
bye
Norman
David Legg schrieb:
> Mmm... that's interesting because our Bayesian analysis filter is
> working wonderfully. Sure, the odd one or two messages get through
> every now and then but training seems to work well. Don't forget you
> should train it with good messages as well as bad.
>
> There *are* patterns which the filter can detect. Every spam has a
> payload of some sort and more often than not the url of the payload
> remains fairly constant no matter how they try to disguise the lure
> text with images etc.
>
> On the other hand my ISP has just implemented Greylisting
> (http://projects.puremagic.com/greylisting/whitepaper.html) and
> although it is probably just a short term measure (maybe lasting a
> year or two until the spammers catch up) it has been dramatic in
> cutting down spam and has the benefit of needing no constant training.
>
>> not much hope on these with Bayesian Analysis IMO. There aren't any
>> patterns which such a filter can detect.
>> Would love to hear some ideas on how to detect them reliably, too.
>>
>>> I'm running james 2.3 with the BayesianAnalysis filter. It is an
>>> awesome
>>> combination except there are two fairly specific spam messages that
>>> seem to
>>> get through no matter how many times I feed them to the engine,
>
> Regards,
> - David Legg
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
> For additional commands, e-mail: server-user-help@james.apache.org
>
> !EXCUBATOR:1,45f5e1af39072024057320!
--
Mit freundlichen Grüßen
i.A. Norman Maurer
Systemadministrator
ByteAction GmbH
Auf der Beune 83-85
64839 Münster
Phone: +49 (0) 60 71 92 16 - 21
Fax: +49 (0) 60 71 92 16 - 20
E-mail: nm@byteaction.de
Internet: www.byteaction.de
AG Darmstadt, HRB 33271
Ust-Id: DE206997247
GF: Thomas Volkert
------------------------------------------------------
Diese E-Mail enthält vertrauliche Informationen und ist nur für den in der E-Mail genannten Adressaten bestimmt. Für den Fall, dass der Empfänger dieser E-Mail nicht der in der E-Mail benannte Adressat ist, weisen wir darauf hin, dass das Lesen, Kopieren, die Wiedergabe, Verbreitung, Vervielfältigung, Bekanntmachung, Veränderung, Verteilung und/oder Veröffentlichung der E-Mail strengstens untersagt ist. Bitte verständigen Sie den Absender dieser E-Mail unter folgender Rufnummer +49 (0) 6071 / 9216-0, falls Sie irrtümlich diese E-Mail erhalten haben und löschen Sie diese E-Mail. Der Inhalt dieser E-Mail ist nur rechtsverbindlich, wenn er von unserer Seite schriftlich durch Brief oder Telefax bestätigt wird. Die Versendung von E-Mails an uns hat keine fristwahrende Wirkung.
This e-mail contains information which is privileged and is intended only for the Addressee named in the e-mail. In case that the recipient of this e-mail is not the named addressee, we would like to inform you that it is strictly prohibited to read, to reproduce, to disseminate, to copy, to disclose, to modify, to distribute and/or to publish this e-mail. If you have received this e-mail in error, please call the sender under following telephone number +49 (0) 6071 / 9216-0 and delete this e-mail. The content of this e-mail is not legally binding unless confirmed by letter or telefax. E-mails which are sent to us do not constitute compliance with any time limits or deadlines.
------------------------------------------------------
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: specific spam
Posted by Michael Weissenbacher <mw...@dermichi.com>.
Hi,
not much hope on these with Bayesian Analysis IMO. There aren't any
patterns which such a filter can detect. The newest ones even use text
which is slightly rotated and are made up of several frames using
animated gif's.
Would love to hear some ideas on how to detect them reliably, too.
Michael
-----Ursprüngliche Nachricht-----
Von: Bud Bach
Gesendet: 2007-03-12 16:10
> I'm running james 2.3 with the BayesianAnalysis filter. It is an awesome
> combination except there are two fairly specific spam messages that seem to
> get through no matter how many times I feed them to the engine, they still
> seem to get though. The one is a for a type of drug (you know). The ad has
> a rectangular colored box and they seed it with a bunch of random words.
> The other one is a stock tip one that I can't seem to get rid of. Has
> anyone figured out how to defeat these? -- Bud
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org