Re: short pharma spam shoots straight through

2010-08-16 Thread Rob McEwen
Jason Haar wrote: > On 08/17/2010 01:04 PM, John Hardin wrote: > >> You might consider implementing spamhaus zen as an MTA-level hard >> reject DNSBL (I do that, maybe that's why I don't see any pharma >> spam?) - many admins trust it enough to do that, and the sample you >> posted hit on the a

Re: short pharma spam shoots straight through

2010-08-16 Thread Jason Haar
On 08/17/2010 01:04 PM, John Hardin wrote: > > You might consider implementing spamhaus zen as an MTA-level hard > reject DNSBL (I do that, maybe that's why I don't see any pharma > spam?) - many admins trust it enough to do that, and the sample you > posted hit on the abuseat CBL, which is a zen

Re: short pharma spam shoots straight through

2010-08-16 Thread John Hardin
On Tue, 17 Aug 2010, Jason Haar wrote: I didn't give more examples because there is no pattern. I've been writing our own rules (based on the Subject or body) for weeks and they never trigger as the sentences don't show up again. The ".ru" thing isn't an option - those URLs are different too - a

Re: short pharma spam shoots straight through

2010-08-16 Thread Benny Pedersen
On man 16 aug 2010 23:28:00 CEST, Jason Haar wrote I was really just expecting to hear "yeah, me too" responses. :-( me too why care of new ru domains ?, blacklist the tld and whitelist ones that do not spam, maybe meta it with sender domain or something that match on that domain, i newer

Re: short pharma spam shoots straight through

2010-08-16 Thread Benny Pedersen
On man 16 aug 2010 22:05:25 CEST, Jason Haar wrote http://pastebin.com/W6wXq4RX match on ru tld with a score of 10 and then whitelist specifik ru domains that does not spam with a score of -10 that will neotralize scores for ham from ru domains there was a spam that included the words "my new

Re: short pharma spam shoots straight through

2010-08-16 Thread Jason Haar
On 08/17/2010 08:11 AM, Bowie Bailey wrote: > > Since you only give one example, it's hard to find a good pattern to > match on. If all of them are going to .ru urls, you could write a rule > for that. The best thing to do is to take a look at several examples > and try to figure out what they h

Re: short pharma spam shoots straight through

2010-08-16 Thread Bowie Bailey
On 8/16/2010 4:05 PM, Jason Haar wrote: > Hi there > > For the past few weeks we've experienced a large increase in missed > spam. It's Pharma-related, one sentence plus a link. > > The interesting features are: > > * every Subject line is different. They're aren't Bayes-busters either - > all Ph

short pharma spam shoots straight through

2010-08-16 Thread Jason Haar
Hi there For the past few weeks we've experienced a large increase in missed spam. It's Pharma-related, one sentence plus a link. The interesting features are: * every Subject line is different. They're aren't Bayes-busters either - all Pharma related - but shall we say "innovative" in their us