[EMAIL PROTECTED] wrote: > I've seen mentions of this type of spam that does not get tagged as such > with the default rules of spamassassin 2.55. > > Can anyone elaborate on techniques for blocking this type of spam? > Any recommendations would be of interest.
Start adding global rules- I've found the best way to tag them is by the URL in the message. Set the score for those rules high- I've been using 4.1-4.5 depending on how high the message already scored. eg: uri REALLY_SHORT_PORN_01 /cryingrussians.net/i describe REALLY_SHORT_PORN_01 URL found in pornspam score REALLY_SHORT_PORN_01 4.5 Due to the number of domains I've added like this, I've started using regexes like: /(cryingrussians|incestuals|lewdmother|beastyvideo|(cryin|scared)girls)\.(com|biz)/ I've also added a list of tests for assorted phrases or phraseoids that have been seen in similar messages, tests for ISPs that our customers send and receive mail to and from, tests to tag mail apparently from an account on our inbound relay server, a (really bad) test for IncrediMail.... etc. -kgd -- <erno> hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is. ------------------------------------------------------- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hosting Partner. Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission! INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
