Toni Willberg wrote:
>Hi.
>
>I'm not (yet) familiar with creating new scoring rules, but I'll try to
>help anyway.
>
>Attached spam is good example of spam I get which is scrored under 5.0
>by SpamAssassin. Spammer is trying to sell CD's of bulk email addresses
>to spammers. :)
>
>
>Following scoring rules would have helped catch this spam. I hope
>someone familiar with rules would produce working SA rules from these.
>
>Some of my suggestions are perhaps already implemented, but atleast my
>installation of SA (v2.11) did not catch any of these rules.
>
>X-Spam-Status: No, hits=2.9 required=5.0
>tests=NO_REAL_NAME,FROM_ENDS_IN_NUMS,RCVD_IN_ORBZ version=2.11
>
>
>
>My suggestions follows, someone add good scores for them:
>
>
>Subject contains: "$"
>Subject has over 50% alphabetical characters UPPERCASE
>Header contains: X-Mailer: The Bat! (v1.52f) Business
>Body has lines which contain over 50% alphabetical characters UPPERCASE
>Body contains any of these:
> BulkMailing
> potential earning
> profit
> make money
> free
> hesistate
> act within
> order now
> credit card
> expiration date
> now only $
>
What bugs me is that CASHCASHCASH doesn't work on the Subject header,
and in your spam example, it would have caught that.
"hesistate" is a misspelling of "hesitate". If it's a form mailing, this
could be useful.
--
http://www.pricegrabber.com | Dog is my co-pilot.
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
