John Ruttenberg wrote:
I've started to get some mails taht are pretty broken and are sent to undisclosed-recipients and have this "All the ... You Will Ever ... " in the body. Examples at:
http://www.chezrutt.com/rutt/spam_examples
These have been reported on-list a few times, including just a few minutes ago.
The interesting thing about these is that spam-reporting one of them seems to have no effect on the others. Bayes happily learns it, and then scores it 99 the next time. But it doesn't seem to effect the next one.
This is 2.63.
They're scoring very high here with a few of the add-on rule sets:
X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on server.ttlexceeded.com X-Spam-Level: ***************** X-Spam-Status: Yes, hits=17.2 required=5.0 tests=AWL,BAYES_99,BIZ_TLD,FCS_URI_NO DOTS,HTML_IMAGE_ONLY_10,HTML_MESSAGE,LOCAL_DRUGS_ANXIETY,LOCAL_DRUGS_ANXIETY_MAL EDYS,LOCAL_DRUGS_MALEDYSFUNCTION,LOCAL_DRUGS_MALEDYSFUNCTION_OBFU,L_IMPRNNCBL_2, L_NOSUBJNOBODY,L_RCVD_IN_MANY,L_UNDISCLNOSUBJ,MY_SHRT_IMG,NO_REAL_NAME,RCVD_IN_B L_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_SORBS,RM_rbt_Href3dHide autolearn=no version=2.63
I'd suggest:
1. Keep training bayes! I just fed what you posted and it scored 99 based on my existing training.
2. Get ahold of some of the add-on rule sets, specifically antidrug.cf With the network checks plus antidrug, they should be stopped even before bayes training.
3. Add the RCVD_IN_MANY (see other threads today) rule to bump up scores for messages listed in many RBLs.
SA and bayes aren't having any trouble detecting these.
- Bob
