Re: Spam Getting Through

29 Mar 2004 12:33:15 -0000 

Hi,

I get the same spam from a constantly changing domain and they score:

X-Spam-Report:
        *  0.9 DATE_MISSING Missing Date: header
        *  0.3 RM_hm_EmtyMsgid Message ID is empty, or just spaces -
probable spamsign
        *  0.1 OACYS_SINGLE BODY: A single consonant surrounded by
whitespace, minus some of the obvious FP's
        *  0.5 HTML_MESSAGE BODY: HTML included in message
        *  0.5 HTML_IMAGE_ONLY_08 BODY: HTML: images with 600-800
bytes of words
        *  5.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
        *      [score: 1.0000]
        *  0.5 HTML_50_60 BODY: Message is 50% to 60% HTML
        *  0.0 RM_rb_BODY BODY: Testing for HTML BODY in emails
        *  0.0 RM_rb_ANCHOR BODY: Testing for HTML end of anchor in
emails
        *  3.0 MYEMAIL BODY: body contains /[EMAIL PROTECTED]/
        *  0.0 RM_rb_TITLE BODY: Testing for HTML title in emails
        *  0.0 RM_rb_HTML BODY: Testing for HTML tag in emails
        *  0.0 RM_rb_BREAK BODY: Testing for HTML Break in emails
        *  0.0 RM_rb_PARA BODY: Testing for HTML Paragraph in emails

where:

rawbody MYEMAIL /\/[EMAIL PROTECTED]//i
describe MYEMAIL body contains /[EMAIL PROTECTED]/
score MYEMAIL 3.00

is specifically aimed to catch these. Maybe the score is a bit high
but i've had no fp's here.

Mat



On Mon, 29 Mar 2004 06:48:16 -0500, Paul Barbeau wrote:
> I am getting a bunch of spam getting a low score they all seam to
> from the
> same group and i have made my own big evil rule and sent them along
> to be
> added to the main list. however was wondering if anyone has a rule
> that will
> look for the email address that it was send to in the "remove"
> line.  Below
> is an example of the line.  The spam is getting a rank of 1.2 and
> is make up
> of 3 images only and i have added to the bottom.
>
> http://cw2.secretnordic.com/[EMAIL PROTECTED]/atrocious.html
> http://sp2.freelimelight.com/[EMAIL PROTECTED]/punishment.html
> http://at3.stockresponsible.com/[EMAIL PROTECTED]/diminish.html
> http://cw2.twitchingbride.com/[EMAIL PROTECTED]/failing.html
>
>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> <HTML><HEAD><TITLE>I designed this much beloved saying just for this
> instance - It was the Law of the Sea they said Civilization ends at
> the
> waterline Beyond that we all enter the food chain and not always
> right at
> the top Hunter S Thompson ></TITLE>
>
> <META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
> <BODY>
> <DIV><FONT face=Arial color=#0000ff size=2>Content analysis
> details:&nbsp;&nbsp;
> (1.6 points, 5.0 required)<BR></FONT></DIV>
> <DIV><FONT face=Arial color=#0000ff size=2><SPAN
> class=347324517-28032004>Somehting is wrong here....no way this
> shoudl score
> so
> low - I'm getting tons of them like this - I momentarily thought
> the spambox
> was
> down.......</SPAN></FONT></DIV>
> <DIV><FONT face=Arial color=#0000ff size=2><SPAN
> class=347324517-28032004></SPAN></FONT>&nbsp;</DIV>
> <DIV><FONT face=Arial color=#0000ff size=2><SPAN
> class=347324517-28032004>p.</SPAN></FONT></DIV>
> <DIV><FONT face=Arial color=#0000ff size=2><SPAN
> class=347324517-28032004></SPAN></FONT>&nbsp;</DIV>
> <DIV><FONT face=Arial color=#0000ff size=2>&nbsp;</DIV></FONT>
> <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
> size=2>-----Original Message-----<BR><B>From:</B> Steve
> [mailto:[EMAIL PROTECTED]<BR><B>Sent:</B> Saturday, March 27,
> 2004
> 10:50
> PM<BR><B>To:</B> [EMAIL PROTECTED]<BR><B>Subject:</B> She's got a
> secret<BR><BR></FONT></DIV>
> <DIV align=center>
> <P><IMG src="http://cw2.secretnordic.com/24384032/10813/apple.jpg";
> NOSEND="1">
> <A
> href="http://cw2.secretnordic.com/24384032/10813/1059/extraordinary.
ht
> ml"
>
> target=_blank><IMG height=455
> src="http://cw2.secretnordic.com/biz/nasdl/tran/tran-a.jpg";
> width=650
> border=0
> NOSEND="1"></A></P></DIV>
> <P>
> <DIV align=center><BR><BR><A
> href="http://cw2.secretnordic.com/24384032/10813/1142/extraordinary2
.h
> tml"
> target=_blank><IMG height=300
> src="http://cw2.secretnordic.com/biz/nasdl/fies/fies-ban-a.jpg";
> width=240
> border=0 NOSEND="1"></A>
> <P></P></DIV>
> <P>
> <DIV align=center><BR><BR>
> <P><A
> href="http://cw2.secretnordic.com/[EMAIL PROTECTED]/atrocious.html"><
IM
> G
> height=64 src="http://cw2.secretnordic.com/biz/gb.gif"; width=528
> border=0
> NOSEND="1"></A></P></DIV></BODY></HTML>

Reply via email to