Hello Jennifer,
Monday, December 22, 2003, 2:32:45 PM, you wrote:
JF> I am so sick of these spam emails but not sure how to stop them. Could
JF> anyone give me any guidance? I am currently using sa 2.55 and planning
JF> to upgrade to 2.61 next week.
The rules I'm using (2.60, should work OK in 2.55):
header RM_ha_2004hosting ALL =~ /200.hosting\.netIP/i
describe RM_ha_2004hosting header points to known spammer
score RM_ha_2004hosting 9.000 # 115s/0h of 74872 corpus
uri RM_u_2004hosting /2004hosting\.net/i
describe RM_u_2004hosting body contains link to known spammer
score RM_u_2004hosting 9.000 # 322s/0h of 74872 corpus
header RM_hxm_mPOPwebMail X-Mailer =~ /mPOP Web-Mail/
describe RM_hxm_mPOPwebMail Uses mPOP Web-Mail Mailer often used by spammers
score RM_hxm_mPOPwebMail 9.000 # 704s/0h of 74872 corpus
header RM_hx_OriginatingIP X-Originating-IP =~ /.{1,8}\..{1,4}IP/i
describe RM_hx_OriginatingIP header points to probable spammer
score RM_hx_OriginatingIP 4.000 # 476s/0h of 74872 corpus
header RM_hx_Rec exists:X-Rec
describe RM_hx_Rec Spam header tag found, X-I:
score RM_hx_Rec 8.000 # 90s/0h of 74872 corpus
uri RM_u_530000x /530000x\.net/i
describe RM_u_530000x body contains link to known spammer
score RM_u_530000x 9.000 # 237s/0h of 74872 corpus
body RM_bp_FreeCableTV /Free Cable.{0,4}TV/i
describe RM_bp_FreeCableTV Spammer phrasing or subject found in body of email
score RM_bp_FreeCableTV 1.000 # (frequency not yet determined, 12/22 pm)
(Chris -- got those?)
Bob Menschel
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
