Re[4]: [SAtalk] what can we do with those spam mails

On Sun, 18 Jan 2004, Robert Menschel <[EMAIL PROTECTED]> wrote: > MR> header L_MIME_BOUND_MANY_DIG Content-Type =~ /boundary=\"\d{15,}\"/ > > MR> changed from \d{19,} to \d{15,} > > I've changed the copy in my files to 13. Frequencies: The ratware has morphed. I'm now seeing messages tha

Re[4]: [SAtalk] what can we do with those spam mails

Hello Martin, Sunday, January 18, 2004, 3:58:34 AM, you wrote: >> L_MIME_BOUND_MANY_DIG -- 153s/0h of 92209 corpus (74874s/17335h) 01/17/04 MR> I've already modified the repeat counts for number of digits in MR> L_MIME_BOUND_MANY_DIG, since it's not constant: MR> header L_MIME_BOUND_MANY_DIG

Re: Re[2]: [SAtalk] what can we do with those spam mails

At Sun Jan 18 02:21:14 2004, Robert Menschel wrote: > > MR> header L_MIME_BOUND_MANY_DIG Content-Type =~ /boundary=\"\d{19,}\"/ > MR> header L_MSGID_SPAM1 Message-Id =~ /<[EMAIL PROTECTED]>/ > MR> rawbody L_TITLE_MESSAGE m{Message} > MR> rawbody L_CONVERTED m{

Re[2]: [SAtalk] what can we do with those spam mails

Hello Martin, Saturday, January 17, 2004, 10:39:15 AM, you wrote: MR> I've added the following rules to my local.cf: MR> header L_MIME_BOUND_MANY_DIG Content-Type =~ /boundary=\"\d{19,}\"/ MR> describe L_MIME_BOUND_MANY_DIG MIME boundary contains lots of digits MR> scoreL_MIME_BOUND_MA

Re: [SAtalk] what can we do with those spam mails

At Thu Jan 15 08:49:37 2004, =?Windows-1252?Q?S=F6nke_Ruempler?= wrote: > > hi list, > > I wonder if i can to something against these spam messages: I've picked out the following, which are common to other similar messages I've seen: > Content-Type: multipart/alternative; > boundary="3

Misc: Bigevil Updates, WAS RE: [SAtalk] what can we do with those spam mails

ly got a rule to nail that sucker and now I'm not getting any :( --Chris (Where is my spam?) Santerre > -Original Message- > From: Ralf Guenthner [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 15, 2004 7:22 AM > To: Sönke Ruempler > Cc: [EMAIL PROTECTED] > S

Re: [SAtalk] what can we do with those spam mails

At 03:49 AM 01/15/04, Sönke Ruempler wrote: hi list, I wonder if i can to something against these spam messages: We have been catching them with the following: X-Spam-Report: * 1.0 local_XMAILER_BOGUS X-Mailer =~ /^[a-z][^A-Z0-9]*$/ * 2.0 LE_NI BODY: obfuscated not interested

Re: [SAtalk] what can we do with those spam mails

At 09:49 AM 1/15/04 +0100, Sönke Ruempler wrote: I wonder if i can to something against these spam messages: Simple starting things to check (if you're not already doing them) 1) use razor, dcc and/or pyzor. 2) Make sure your bayes is heavily trained (really, this batch of "poison" has not been

Re: [SAtalk] what can we do with those spam mails

Hi How about a URI rule testing for the holdontrynow.com link?? Cheers Ralf G. Sönke Ruempler wrote: hi list, I wonder if i can to something against these spam messages: Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from 62.116.172.149 (68.116.240.99:4887) by mail

Re: [SAtalk] what can we do with those spam mails

On Thu, 15 Jan 2004, Sönke Ruempler <[EMAIL PROTECTED]> wrote: > Subject: confiscate cosponsor gnat > X-Mailer: huh > Message-Id: <[EMAIL PROTECTED]> http://marc.theaimsgroup.com/?l=spamassassin-talk&m=107361675716894&w=2 http://marc.theaimsgroup.com/?l=spamassassin-talk&m=107408986927266&w=2 --

[SAtalk] what can we do with those spam mails

hi list, I wonder if i can to something against these spam messages: Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from 62.116.172.149 (68.116.240.99:4887) by mail.city-map.de (62.116.172.149:25) with [XMail 1.17 (Linux/Ix86) ESMTP Server] id for <[EMAIL PROTECTED]