-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Not surprisingly, your message quoting the spam message got caught by SA
as well. Someone else noticed that the phrases inside "SpamAssassim
results" are often caught by the rule that produces them. This again is
obvious ("BODY: Free money!" will allways match the FREE_MONEY rule).
Therefore I suggest adding a rule with a negative score assigned matching
spam reports in message bodies. This is especially usefull for SAtalk,
better than whitelisting as the latter one would also all spam sent to the
list address to pass. (This is true for the AWL as well.) Such a rule
would is not very likely ever to be found in a spam message unless
spammers do try hard to bypass SA.
I'm thinking of something linke
body SA_REPORT_START /SPAM:\s-+ Start SpamAssassin results -+/
body SA_REPORT_END /SPAM:\s-+ End SpamAssassin results -+/
body SA_REPORT_LINE /SPAM:/
body SA_REPORT_CA /SPAM: Content analysis details/
My only problem is, I don't not what scores to assign my custom rules.
For positive (spam) rules I usually use 1.0 which is a lot compared to
most of SA's rules. In this case using -1.0 for START, END and CA, plus
- -0.5 for LINE would work. In this case a spam report would be worth more
than a PGP signature. Does this make sense? On the other hand we need a
high negative score on a spam report if we want messages with spam
characteristics to score below 5.
On Sat, 2 Nov 2002, Bob Proulx wrote:
> Date: Sat, 2 Nov 2002 10:29:36 -0700
> From: Bob Proulx <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Well written spam advertising how to spam
>
> SPAM: -------------------- Start SpamAssassin results ----------------------
> SPAM: This mail is probably spam. The original message has been altered
> SPAM: so you can recognise or block similar unwanted mail in future.
> SPAM: See http://spamassassin.org/tag/ for more details.
> SPAM:
> SPAM: Content analysis details: (11.30 hits, 5 required)
> SPAM: USER_AGENT_MUTT (-1.2 points) User-Agent header indicates a non-spam MUA
>(Mutt)
> SPAM: USER_AGENT (-0.5 points) Found a User-Agent header
> SPAM: FREE_MONEY (-0.1 points) BODY: Free money!
> SPAM: NO_INVESTMENT (2.0 points) BODY: No Investment
> SPAM: RICH (2.0 points) BODY: If only it were that easy
> SPAM: CHECK_OR_MONEY_ORDER (1.7 points) BODY: Talk about a check or money order
> SPAM: BULK_EMAIL (1.7 points) BODY: Talks about bulk email
> SPAM: NO_COST (1.0 points) BODY: No such thing as a free lunch (3)
> SPAM: FINANCIAL (0.8 points) BODY: Financial Freedom
> SPAM: NO_EXPERIENCE (0.7 points) BODY: No experience needed!
> SPAM: COMPLETELY_FREE (0.4 points) BODY: No such thing as a free lunch (2)
> SPAM: WORK_AT_HOME (0.4 points) BODY: Information on how to work at home (1)
> SPAM: WHY_WAIT (0.3 points) BODY: What are you waiting for
> SPAM: CLICK_BELOW (0.3 points) BODY: Asks you to click below
> SPAM: ONLY_COST (0.2 points) BODY: Only $$$
> SPAM: ORDER_NOW (0.2 points) BODY: Encourages you to waste no time in
>ordering
> SPAM: BIG_BUCKS (0.0 points) BODY: Big Bucks
> SPAM: SPAM_PHRASE_08_13 (1.4 points) BODY: Spam phrases score is 08 to 13 (medium)
> SPAM: [score: 8]
> SPAM: ASCII_FORM_ENTRY (0.1 points) BODY: Contains an ASCII-formatted form
> SPAM: KNOWN_MAILING_LIST (-0.1 points) Email came from some known mailing list
>software
> SPAM:
> SPAM: -------------------- End of SpamAssassin results ---------------------
>
> This piece of spam I found simply amazing. It is well written. The
> author appears to be a very intelligent marketer. But his target
> audience is the newbie spammer! As well written as it is I am sure he
> will sucker more people over to the dark side.
[...]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: pgpenvelope 2.10.2 - http://pgpenvelope.sourceforge.net/
iD8DBQE9xB4uY6Nk2Nv6ZRcRAr5qAJ0ZvGMt/Kq5rLbGSivjPgF6yH1cwwCfcO4k
NJBjAh/tC0tPB5RFbvJIHvw=
=nagN
-----END PGP SIGNATURE-----
-------------------------------------------------------
This sf.net email is sponsored by: See the NEW Palm
Tungsten T handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0001en
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
