RE: [Mimedefang] How can I get this email blocked?
You can add something like this to your /etc/mail/spamassassin/sa-mimedefang.cf file: rawbody BLOCK_ME/s%74orefr%65e%2E%62iz/i describe BLOCK_ME I want this blocked score BLOCK_ME 5.00 This will set the score to atleast 5. You can use whatever you want in place of "s%74orefr%65e%2E%62iz" but this is found more than once it the below email. Hope this helps. Jim -Original Message- From: Matt Rossiter [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 09, 2004 1:07 PM To: [EMAIL PROTECTED] Subject: [Mimedefang] How can I get this email blocked? Hi there, I keep getting repeated spams which contain the following html code. Download your soft ware from our Superfast (100mbits connection) site & you will be given your own exclusive registration key to register the soft ware you bought from us, and now you have your own registered copy of soft ware (will never expired again) It's OEM version of soft ware which is an Original/Genuine soft ware, strictly no piracy soft ware http://drs.yahoo.com/fastness/eldritchlegatary/*%68ttp://bracingdissolu te.s%74orefr%65e%2E%62iz/0/p/ target=_blank>Over 850 popular titles for you to choose fromAct quick now before all soldStart using your needed soft ware now== C L I C K - H E R E ==(Plz give 2-3 mins to complete the page loading bcos the page has 850 titles on it) http://drs.yahoo.com/colubertitanosaur./tophetperdition/*%68ttp://sade. s%74orefr%65e%2E%62iz/%75n%73ub.html target=_blank>take me down I normally have anything with a .biz URI in the message filtered out. This one doesn't seem to get caught. It usally gets tagged with a spam score of 2.5 and my tolerance is 5.0. The link in this email takes you to a domain called storefree.biz - can someone suggest away of eliminating this spam? Thanks Matt ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
Re: [Mimedefang] How can I get this email blocked?
At 11:06 AM 3/9/2004, Matt Rossiter wrote: It usally gets tagged with a spam score of 2.5 and my tolerance is 5.0. The link in this email takes you to a domain called storefree.biz - can someone suggest away of eliminating this spam? If the messages include common phrases, you could write a SpamAssassin rule to catch them. You'll probably be better off posting this to the SpamAssassin list, though. Kelson Vibber SpeedGate Communications ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
Re: [Mimedefang] How can I get this email blocked?
On Tue, 9 Mar 2004, Matt Rossiter wrote: > The link in this email takes > you to a domain called storefree.biz - can someone suggest away of > eliminating this spam? I'm not sure if this helps, but your message to the list got trapped by CanIt. Here's the analysis: SpamAssassin rules weren't too effective... 1.5 DOMAIN_BODYBODY: Domain registration spam body 0.8 HTML_30_40 BODY: Message is 30% to 40% HTML 0.2 HTML_MESSAGE BODY: HTML included in message 0.3 HTML_FONT_BIG BODY: HTML has a big font 0.2 HTTP_EXCESSIVE_ESCAPES URI: Completely unnecessary %-escapes inside a URL They add up to 3 points. But look at the next part: Statistical Analysis: Word: biz (0.990) Word: s*get (0.990) Word: 850 (0.990) Word: Over (0.990) Word: Download (0.990) Word: exclusive (0.990) Word: Start (0.990) Word: bought (0.990) Word: loading (0.990) Word: OEM (0.990) Word: registration (0.990) Word: sold (0.990) Word: registered (0.990) Word: spams (0.010) Word: s*How (0.010) Combined probability = 0. Score of 10 points due to statistical analysis Per-user Bayes databases are the way to go. Regards, David. ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
[Mimedefang] How can I get this email blocked?
Hi there, I keep getting repeated spams which contain the following html code. Download your soft ware from our Superfast (100mbits connection) site & you will be given your own exclusive registration key to register the soft ware you bought from us, and now you have your own registered copy of soft ware (will never expired again) It's OEM version of soft ware which is an Original/Genuine soft ware, strictly no piracy soft ware http://drs.yahoo.com/fastness/eldritchlegatary/*%68ttp://bracingdissolute.s%74orefr%65e%2E%62iz/0/p/ target=_blank>Over 850 popular titles for you to choose fromAct quick now before all soldStart using your needed soft ware now== C L I C K - H E R E ==(Plz give 2-3 mins to complete the page loading bcos the page has 850 titles on it) http://drs.yahoo.com/colubertitanosaur./tophetperdition/*%68ttp://sade.s%74orefr%65e%2E%62iz/%75n%73ub.html target=_blank>take me down I normally have anything with a .biz URI in the message filtered out. This one doesn't seem to get caught. It usally gets tagged with a spam score of 2.5 and my tolerance is 5.0. The link in this email takes you to a domain called storefree.biz - can someone suggest away of eliminating this spam? Thanks Matt ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
