The ones that get through here do so with a very low score. Around 1.00
or below. I already have both the SARE_OBFU & SARE_HTML rules in place.
I'm filtering on domains, but that is not extremely sucessful as he/she
adds about 3-4 new ones every day. Current count is now 85. If you wish
a list, mail me privately.
Thanks,
Mike
Ilan Aisic wrote:
Hi Brian,
Look for the thread about "Pharamcudical list of words in a table".*
*See:*
*http://www.gossamer-threads.com/lists/spamassassin/users/59435?page=last*
*All these messages are probably coming from one evil source.
Some say it's a guy called Leo Kuvayev and he keeps chaning the
messages and trying to fool SA.
You really should include SARE_OBFU and SARE_HTML (in
http://www.rulesemporium.com/). I see that these rule files score some
points on Leo's messages. But most of the points are from all the
network checks.
I also added my own personal rule to increase the total score on these
tables:
# This one adopted from sare_html:
rawbody IA_HTML_MANY_BR
/<br>.{0,10}<br>.{0,10}<br>.{0,10}<br>.{0,10}<br>/i
describe IA_HTML_MANY_BR Tooo many close <br>'s!
score IA_HTML_MANY_BR 0.500
*
*
On 9/14/05, *Brian Ipsen* <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> > wrote:
Hi,
The number of messages like below has increased. Unfortunately, they
are
not reported to SpamCop fast enough for SURBL to handle them.... Has
anyone
created some sort of filter to identify this type of messages ??
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV> </DIV>
<DIV><A href="link">link to site</A></DIV>
<DIV> </DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>Me<BR>Xa<BR>Ul<BR>Am<BR><STRONG>Ci</STRONG><BR>Le<BR><STRONG>Va
</STRONG><BR>Pr<BR><STRONG>Vi</STRONG><BR>Ce</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>ri<BR>na<BR>tr<BR>bi<BR><STRONG>al</STRONG><BR>vi<BR><STRONG>li
</STRONG><BR>op<BR><STRONG>ag</STRONG><BR>le</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>di<BR>x<BR>am<BR>en<BR><STRONG>is</STRONG><BR>tr<BR><STRONG>um<
/STRONG><BR>ec<BR><STRONG>ra</STRONG><BR>br</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier>a<BR><BR><BR><BR> 1.<BR>a<BR> 3.<BR>ia<BR> 3.<BR
>ex</FONT></DIV>
<DIV style="FLOAT: left;"><FONT
face=Courier><BR><BR><BR><BR>21<BR><BR>75<BR><BR>33<BR></FONT></DIV>
</BODY></HTML>
Regards,
/Brian
--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org
