Re: How can I filter this kind of spam?

[Andy Jezierski]

Thomas Booms <[EMAIL PROTECTED]> wrote on 07/05/2005 09:23:50 AM:

> Hi all,
>
> I have the following text of a spam not marked as spam. BAYES_40 I have
> set to 5. After I got it, I've increased the value of RCVD_BY_IP to 5 in
> the hope, that it works. Which other solutions are there to mark these
> mails as spam?
>
> I saw that more and more spams coming through which are like this here
> with several subjects too.
>
> Thomas
>

[snip]

> X-Spam-Status: No, score=-1.0 required=1.5 tests=BAYES_40,RCVD_BY_IP
>    autolearn=ham version=3.0.4

CAREFUL!! You're training your Bayes filter incorrectly!

But to answer your question, SURBL is your friend:

X-Spam-Report:
        *  0.1 RCVD_BY_IP Received by mail server with no name
        *  3.2 DOMAIN_RATIO BODY: Message body mentions many internet domains
        *  5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
        *      [score: 0.9912]
        *  5.0 URIBL_SBL Contains an URL listed in the SBL blocklist
        *      [URIs: bannerlikedj.com]
        *  1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
        *      [URIs: bannerlikedj.com]
        *  5.0 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
        *      [URIs: bannerlikedj.com]
        *  3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
        *      [URIs: bannerlikedj.com]
        *  5.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
        *      [URIs: bannerlikedj.com]
        *  5.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
        *      [URIs: bannerlikedj.com]
        *  5.0 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
        *      [URIs: bannerlikedj.com]

Andy