Re: Bogus Dollar Amounts

2010-02-25 Thread ram
On Wed, Feb 24, 2010 at 8:44 PM, Dennis B. Hopp dh...@coreps.com wrote: I have been seeing a few spam mails slip past that talk about being able to get bogus dollar amounts. What I mean by that is it will give a large value in the e-mail but where there should be a comma it puts a period. I

Re: Bogus Dollar Amounts

2010-02-25 Thread Mike Cardwell
On 25/02/2010 12:01, ram wrote: I have been seeing a few spam mails slip past that talk about being able to get bogus dollar amounts. What I mean by that is it will give a large value in the e-mail but where there should be a comma it puts a period. I put an example of one

Re: Bogus Dollar Amounts

2010-02-25 Thread Martin Gregorie
On Thu, 2010-02-25 at 17:31 +0530, ram wrote: http://pastebin.com/SXuGELUS Are there any rules that can detect this? The only rules this hit on mine are: 1.900 DCC_CHECK 1.449 RCVD_IN_BRBL_LASTEXT 1.000 RCVD_IN_BRBL -0.001 SPF_PASS -0.010 T_RP_MATCHES_RCVD -1.900 BAYES_00

Re: Bogus Dollar Amounts

2010-02-25 Thread Kai Schaetzl
Ram wrote on Thu, 25 Feb 2010 17:31:04 +0530: how can i stop those kind of emails 11.Received: from unknown (HELO NANQRZBVJZ) (121.100.119.197) If you allow such a thing to deliver to you you actively ask for spam. I don't waste SA cycles on such stuff. Apart from that it seems your SA is

Re: Bogus Dollar Amounts

2010-02-25 Thread Kai Schaetzl
Dennis B. Hopp wrote on Wed, 24 Feb 2010 09:14:58 -0600: Obviously I have something going on with my bayes, but that's a separate issue Indeed. But it's an important issue. If it is that biased for other spam as well youa re better off to not use it in this state. X-Spam-Status: No, score=2.8

Re: Bogus Dollar Amounts

2010-02-25 Thread John Hardin
On Thu, 25 Feb 2010, ram wrote: http://pastebin.com/6c9sEEn9 i still see lot of junk mail coming with different charecters, i do not even read them clearly how can i stop those kind of emails Reject languages you can't read at SMTP time? -- John Hardin KA7OHZ

Re: [sa] Re: Bogus Dollar Amounts

2010-02-25 Thread Charles Gregory
On Thu, 25 Feb 2010, John Hardin wrote: i still see lot of junk mail coming with different charecters, i do not even read them clearly how can i stop those kind of emails Reject languages you can't read at SMTP time? I've been noticing more 'foreign language' spams that do not use a

Re: Bogus Dollar Amounts

2010-02-25 Thread Dennis B. Hopp
Quoting Kai Schaetzl mailli...@conactive.com: Dennis B. Hopp wrote on Wed, 24 Feb 2010 09:14:58 -0600: Obviously I have something going on with my bayes, but that's a separate issue Indeed. But it's an important issue. If it is that biased for other spam as well youa re better off to

Re: Bogus Dollar Amounts

2010-02-25 Thread LuKreme
On 25-Feb-2010, at 05:36, Mike Cardwell wrote: I repasted that at http://spamalyser.com/v/gcrvcnbm/mime in order to get the benefit of mime parsing and decoding. running it through spamassassin -Lt I get a score of 16.6 (13.2) Content analysis details: (16.6 points, 5.0 required) pts

Re: Bogus Dollar Amounts

2010-02-25 Thread John Hardin
On Thu, 25 Feb 2010, Dennis B. Hopp wrote: What is the HK_MUCHMONEY rule that you have? Is that part of the base SA installation? It's a sandbox rule that got promoted. I'm working on a set of money rules that will supercede it. -- John Hardin KA7OHZ

Re: [sa] Re: Bogus Dollar Amounts

2010-02-25 Thread John Wilcock
Le 25/02/2010 17:06, Charles Gregory a écrit : On Thu, 25 Feb 2010, John Hardin wrote: i still see lot of junk mail coming with different charecters, i do not even read them clearly how can i stop those kind of emails Reject languages you can't read at SMTP time? I've been noticing more

Re: Bogus Dollar Amounts

2010-02-24 Thread Jason Bertoch
On 2/24/2010 10:14 AM, Dennis B. Hopp wrote: ... but where there should be a comma it puts a period. I put an example of one of these messages at: http://pastebin.com/SXuGELUS It is common in many parts of the world to use a period instead of a comma as a digit group separator, and

Re: Bogus Dollar Amounts

2010-02-24 Thread Dennis B. Hopp
Nevermind...it was also hitting T_LOTS_OF_MONEY and once I expired old bayes tokens it no longer hit BAYES_00. Now I just have to figure out whats up with my bayes db. --Dennis Quoting Dennis B. Hopp dh...@coreps.com: I have been seeing a few spam mails slip past that talk about being

Re: Bogus Dollar Amounts

2010-02-24 Thread Dennis B. Hopp
It is common in many parts of the world to use a period instead of a comma as a digit group separator, and vice-versa for the decimal separator. http://en.wikipedia.org/wiki/Thousands_separator#Digit_grouping I knew it was common in other parts of the world, but for some reason was

Re: Bogus Dollar Amounts

2010-02-24 Thread RW
On Wed, 24 Feb 2010 09:37:47 -0600 Dennis B. Hopp dh...@coreps.com wrote: It is common in many parts of the world to use a period instead of a comma as a digit group separator, and vice-versa for the decimal separator. http://en.wikipedia.org/wiki/Thousands_separator#Digit_grouping

Re: Bogus Dollar Amounts

2010-02-24 Thread John Hardin
On Wed, 24 Feb 2010, Dennis B. Hopp wrote: I guess it doesn't really matter since the message was actually hitting another rule (T_LOTS_OF_MONEY) that I somehow missed. It also hits some of the testing ADVANCE_FEE_NEW rules. I hope to bring those live soon... -- John Hardin KA7OHZ