Hi Joel, Well, I have spamassassin scoring as spam from 3.0 on, and until 14 gets quarantined for review for messages not scoring BAYES_99. Almost 250.000 messages scoring over 14 with only 1 FP being rejected (and was quite an unusual situation).
That kind of mails have all "Fw: 12345", from 3-6/7 numers. Writing a rule to score those subjects could help, but don't score it too high or you'll catch innocent mails. You have the rule I used in my firs mail. I quarantine mails using excellent Toribio's Qmail-Scanner patch (you can find it at http://toribio.apollinare.org/qmail-scanner/) That kind of funcinality has been added in the Qmail-Scanner 2.00 RC1 . Good luck, Ruben > -----Mensaje original----- > De: Joey [mailto:[EMAIL PROTECTED] > Enviado el: viernes, 24 de febrero de 2006 18:47 > Para: users@spamassassin.apache.org > Asunto: RE: GIF stock spams > > > Hi Ruben, > > Sorry to be such a nube, but can you tell me exactly what I need to do to > impliment what is working for you. > These damn image files are killing us. > > Thanks, > > Joey > > -----Original Message----- > From: Ruben Cardenal [mailto:[EMAIL PROTECTED] > Sent: Friday, February 24, 2006 11:45 AM > To: users@spamassassin.apache.org > Subject: RE: GIF stock spams > > I catch them all, for example: > > X-Spam-Report: > * 1.0 ICAB_FW2 ICAB_FW2 > * 1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= > entry > * 1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of > words > * 0.0 HTML_MESSAGE BODY: HTML included in message > * 6.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100% > > header ICAB_FW2 Subject =~ /^Fw:\s\d{1,9}$/i score ICAB_FW2 1 > > Ruben > > > > -----Mensaje original----- > > De: Chris Conn [mailto:[EMAIL PROTECTED] Enviado el: viernes, 24 de > > febrero de 2006 17:35 > > Para: users@spamassassin.apache.org > > Asunto: GIF stock spams > > > > Hello, > > > > Has anyone written any rules to catch the following types of spam > > > > > > http://nisk.creenet.com/~cconn/sa/ > > > > > > They consist of a few lines of text (sometimes), and a .gif attachment > > that is in fact some penny stock being pushed. > > > > Thanks in advance, > > > > Chris > >
