Re: percentage off spam
pclnz wrote: Wonder if anyone can help with a rule to combat thousands of spam I am receiving in our mail server every day I have tried to work out a .cf rule, but no luck so I am having to add series a new rules every day The spams have subject line like the below Best prices for friends. You save 77%. migration married t the f Good news, keith. This week we sell at -78%. Ewopyze For info: Everything at -79%. show poor on News for peter - popular brands 79% cheaper For user peter: get -75% to all prices. WholeSale craig! Buy at -82% today. etc etc The subject appear to change each day - is there a way of writing a rule that can accommodate this type of spam Insufficent data - please post a link to some complete samples. /Per Jessen, Zürich
Re: percentage off spam
Best prices for friends. You save 77%. migration married t the f Good news, keith. This week we sell at -78%. Ewopyze For info: Everything at -79%. show poor on News for peter - popular brands 79% cheaper For user peter: get -75% to all prices. WholeSale craig! Buy at -82% today. These match a lot of them: Subject =~ /\%.*(special|lower|sale|off|on|today)/i Subject =~ /(don.t miss|special|save|sale).*\%/i Subject =~ /-\d+\%/ You probably can't give more than 1 or 2 points or you'll fp. They keep changing too. The minus-percent just started recently. Joseph Brennan Columbia University Information Technology
Re: percentage off spam
I agree that full smaples are needed. The % Subject alone is not enough. But I would expect there is something 'common' to the body that would combine in a meta rule for decent score with minimal fp... So throw some examples up on pastebin. - C
Re: percentage off spam
--On Tuesday, May 18, 2010 10:59 AM -0400 Charles Gregory cgreg...@hwcn.org wrote: I agree that full smaples are needed. The % Subject alone is not enough. But I would expect there is something 'common' to the body that would combine in a meta rule for decent score with minimal fp... So throw some examples up on pastebin. Here's some: http://sewingwitch.com/ken/Stuff/foo.txt I'm currently catching them with this: header KP_PERCENT Subject =~ /\b-?[78][0-9]%/ describe KP_PERCENT 70-89 percent in subject scoreKP_PERCENT 1.0
Re: percentage off spam
On Tue, 18 May 2010, Kenneth Porter wrote: So throw some examples up on pastebin. Here's some: http://sewingwitch.com/ken/Stuff/foo.txt I'm currently catching them with this: header KP_PERCENT Subject =~ /\b-?[78][0-9]%/ describe KP_PERCENT 70-89 percent in subject scoreKP_PERCENT 1.0 Given how high these spams score already, this will work quite well. I also noticed that the 'view in a browser' line repeats consistently. I see some hits on RBL's and URIBL's. Perhaps those should score just a little bit higher? - C
RE: percentage off spam
Thanks so much - worked excellently Thanks to all who answered Cheers Peter -Original Message- From: Kenneth Porter [mailto:sh...@sewingwitch.com] Sent: Wednesday, 19 May 2010 7:00 a.m. To: users@spamassassin.apache.org Subject: Re: percentage off spam --On Tuesday, May 18, 2010 10:59 AM -0400 Charles Gregory cgreg...@hwcn.org wrote: I agree that full smaples are needed. The % Subject alone is not enough. But I would expect there is something 'common' to the body that would combine in a meta rule for decent score with minimal fp... So throw some examples up on pastebin. Here's some: http://sewingwitch.com/ken/Stuff/foo.txt I'm currently catching them with this: header KP_PERCENT Subject =~ /\b-?[78][0-9]%/ describe KP_PERCENT 70-89 percent in subject scoreKP_PERCENT 1.0
