Randy <[EMAIL PROTECTED]> writes:
> Micah Anderson wrote:
>> Sadly, I do not have an example I can share at the moment, as I
>> typically delete them in a rage after training my bayes filter on
>> them. However, I am looking for any suggestions of other things I can
>> turn on... in particular, are there rules that people have created that
>> look for certain keywords where the body is asking for your
>> account/password information?
>>
> Report these and maybe they will add something that catches them. If
> one wanted to, they can get any mail the want through your filters if
> they are good and don't use things that trigger the rules.
Report them where exactly?
Here is an example one I received recently, note the hideously low bayes
score on this one, caused it to autolearn as ham even, grr.
>From [EMAIL PROTECTED] Fri Oct 31 20:00:45 2008
Return-Path: <[EMAIL PROTECTED]>
X-OfflineIMAP-x792266711-4c6f63616c-494e424f58: 1225549253-0134941395044-v6.0.3
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on spamd2.riseup.net
X-Spam-Level:
X-Spam-Status: No, score=-3.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW
autolearn=ham version=3.2.5
Delivered-To: [EMAIL PROTECTED]
Received: from mx1.riseup.net (unknown [10.8.0.3])
by cormorant.riseup.net (Postfix) with ESMTP id 58BFA19581F7
for <[EMAIL PROTECTED]>; Fri, 31 Oct 2008 20:00:40 -0700 (PDT)
Received: from master.debian.org (master.debian.org [70.103.162.29])
by mx1.riseup.net (Postfix) with ESMTP id AA4465701D1
for <[EMAIL PROTECTED]>; Fri, 31 Oct 2008 20:00:39 -0700 (PDT)
Received: from cat.cybersurf.net ([209.197.145.185] helo=cat.cia.com)
by master.debian.org with esmtp (Exim 4.63)
(envelope-from <[EMAIL PROTECTED]>)
id 1Kw6j8-0003iT-Ix
for [EMAIL PROTECTED]; Sat, 01 Nov 2008 03:00:38 +0000
Received: from reef.cybersurf.com ([209.197.145.198])
by cat.cia.com with esmtp (Exim 4.50)
id 1Kw6iz-0002Li-Pg; Fri, 31 Oct 2008 21:00:29 -0600
Received: from apache by reef.cybersurf.com with local (Exim 4.44)
id 1Kw6j0-0006W5-UJ; Fri, 31 Oct 2008 20:00:30 -0700
Received: from 196-207-0-227.netcomng.com (196-207-0-227.netcomng.com
[196.207.0.227])
by webmail.3web.com (IMP) with HTTP
for <[EMAIL PROTECTED]>; Sat, 1 Nov 2008 14:00:30 +1100
Message-ID: <[EMAIL PROTECTED]>
Date: Sat, 1 Nov 2008 14:00:30 +1100
From: WEBMAIL Help Desk <[EMAIL PROTECTED]>
Reply-to: [EMAIL PROTECTED]
Subject: WEBMAIL Help Desk
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
User-Agent: Internet Messaging Program (IMP) 3.2.1
X-Originating-IP: 196.207.0.227
To: undisclosed-recipients:;
X-Virus-Scanned: ClamAV 0.94/8552/Fri Oct 31 18:14:36 2008 on mx1.riseup.net
X-Virus-Status: Clean
Status: RO
Content-Length: 1427
Lines: 38
Dear Webmail User,
This message was sent automatically by a program on Webmail which
periodically checks the size of inboxes, where new messages are
received.
The program is run weekly to ensure no one's inbox grows too large. If
your inbox becomes too large, you will be unable to receive new email.
Just before this message was sent, you had 18 Megabytes (MB) or more of
messages stored in your inbox on your Webmail. To help us re-set your
SPACE on our database prior to maintain your INBOX, you must reply to
this e-mail and enter your
Current User name ( )
and Password( ).
You will continue to receive this warning message periodically if your
inbox size continues to be between 18 and 20 MB. If your inbox size
grows to 20 MB, then a program on Bates Webmai
will move your oldest email to a
folder in your home directory to ensure that you will continue to be
able to receive incoming email. You will be notified by email that this
has taken place. If your inbox grows to 25 MB, you will be unable to
receive new email as it will be returned to the sender.
After you read a message, it is best to REPLY and SAVE it to another
folder.
Thank you for your cooperation.
WEBMAIL Help Desk
---------------------------------------------------------------------------
3webXS HiSpeed Dial-up...surf up to 5x faster than regular dial-up alone...
just $14.90/mo...visit www.get3web.com for details
