hi list,
I wonder if i can to something against these spam messages:
We have been catching them with the following:
X-Spam-Report:
* 1.0 local_XMAILER_BOGUS X-Mailer =~ /^[a-z][^A-Z0-9]*$/
* 2.0 LE_NI BODY: obfuscated not interested
* 0.5 LE_MB BODY: your money back
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 0.5 WORDWORD BODY: long string of random words
* 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
* [Blocked - see <http://www.spamcop.net/bl.shtml?80.213.6.145>]
* 2.6 RCVD_IN_DYNABLOCK RBL: Sent directly from dynamic IP address
* [80.213.6.145 listed in dnsbl.sorbs.net]
* 0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
* [80.213.6.145 listed in dnsbl.sorbs.net]
Where local_XMAILER_BOGUS and WORDWORD BODY were rules posted on this list recently and LE_NI & LE_MB are local rules that look for the indicated content.
Lyle Evans [EMAIL PROTECTED] rackmount brackets for many networking and ISP equipment chassises http://www.rackears.com
Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from 62.116.172.149 (68.116.240.99:4887) by mail.city-map.de (62.116.172.149:25) with [XMail 1.17 (Linux/Ix86) ESMTP Server] id <S503F57> for <[EMAIL PROTECTED]> from <[EMAIL PROTECTED]>; Thu, 15 Jan 2004 04:46:01 +0100 Received: from [101.183.240.64] by 68.116.240.99 with HTTP; Wed, 14 Jan 2004 20:51:19 -0700 From: "Sherman Rosa" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: confiscate cosponsor gnat Mime-Version: 1.0 X-Mailer: huh Date: Thu, 15 Jan 2004 06:58:19 +0300 Reply-To: "Sherman Rosa" <[EMAIL PROTECTED]> Content-Type: multipart/alternative; boundary="3285634181104916874" Message-Id: <[EMAIL PROTECTED]> X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on blah.topconcepts.net X-Spam-Status: No, hits=0.0 required=4.0 tests=HTML_MESSAGE autolearn=no version=2.60
--3285634181104916874 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit
neumann epiphany acs attenuate padlock extensible mistress indigo nowise sinclair mousy rich cosec athens bludgeon amber kieffer arraign coinage agee curium alienate cavalier dispersible dick
--3285634181104916874 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 8bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <http://www.holdontrywow.com/m2/index.php?AFF_ID=m4>Hello,
I finally was able to lose the weight I have been struggling to lose for years!
And I couldn't believe how simple it was! Amazing patch makes you shed the pounds! It's Guaranteed to work or your money back!
<http://www.holdontrywow.com/homepage/>Not intreseted fiberboard discomfit ambrosial alaska fatuous lineprinter bock narrow integrand orphanage filth handmaiden auctioneer <br> elsewhere accompany parakeet agglutinate finance multinomial edgy felicitous dowling cottonwood melodic detonate blanket marinate cheesy breeches junior borderland lumbar maraud lucille inroad chub scornful cute <br> music paradigmatic guam meantime charlemagne correct muriatic propitiate brevity hal beehive commiserate cadaverous fatal gillette salutary oriole prefatory prohibitive commit fullback loretta cancer admiralty boatswain porpoise imagen chopin crumble insouciant followeth paschal <br> grendel amateurish odessa coefficient denture centrifugal browne inshore chrysler housefly citizenry arena ridge pickle hyman roseland avarice carbon sarcoma fact bella fourteenth hanson <br> dicotyledon missouri austere bausch nut orbital homeland prima accumulate bushmaster intelligent chick inaction panicked commando foundling appraisal habitat abe cloister extoller malawi horatio moldboard puckish butyrate downright guaranty residuum gecko <br> eat argo checksumming barrage hasn't moonlight receptive centerline holland pompon conferee characteristic keaton hagstrom expense cartesian farmland arcsine haiti parliamentary chocolate anatomic hewlett baltic gamecock <br> bellicose firecracker arsenate holm erasure offbeat honda inelastic boycott electrophoresis saleslady first automatic footpad guardhouse heigh flown clapeyron discus <br> sedition astor meteoritic chamomile donner qua sherwood battleground assimilable dealt <br> horntail abuse corset coalesce crewman confucius apex indent organ filthy barnabas indoeuropean agreed ova byrd brassiere sforzando analogy ewe nutmeg pounce ardency hydra homebuilding fasten decommission author putnam damascus circumvent cyanamid detriment hydrogenate hydrothermal desire farm birmingham <br> cruel coxcomb rochester hieratic reject covariant religious salty craftspeople contradistinction diabetic drib mileage bring <br>
--3285634181104916874--
Maybe a rule for the bogus text after </HTML> ?!
Thx for help, Soenke.
------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
