Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-15 Thread Brad Koehn
Any spammer worth his salt runs his message through SA and other popular anti-spam tools as best he can. Most of SA is relatively static and slow to respond to changes in message content. The problem comes in a few areas like checks against Received headers (since the spammer may be using tho

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-15 Thread Martin Radford
At Mon Dec 15 15:12:42 2003, Gary Smith wrote: > > Rubin, > > About a week ago a guy asked how to use SA to check the emails > before he sent them for some mail list (or some private promo > thing). I think that problem is that spammers themselves are > starting to use product like SA to valida

RE: Custom Rules (was Re: [SAtalk] Clever spam (first of many, I'm afraid...))

2003-12-15 Thread jennifer
Hi Raquel > I'm new to SA, and so far am pretty confused. I've been to your > (Jennifer) site, but don't know what to do with the rules that can > be downloaded. Are they added verbatim to local.cf? I'm sorry for > asking such an elementary question. Yes, pick the sets you want to use. Put t

RE: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-15 Thread Jon Gerdes
Gary Fine, let them use SA to test their filth out. However, they can only get at the stock SA. They can't have "my" SA and that has *my* rules in it, ie rules designed specifically by me for my mail feed (or at least the company I work for) Also, they can't fool BigEvil either then there is

RE: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-15 Thread Gary Smith
Rubin, About a week ago a guy asked how to use SA to check the emails before he sent them for some mail list (or some private promo thing). I think that problem is that spammers themselves are starting to use product like SA to validate if an email is spam or not so they can fool the system.

Re: Custom Rules (was Re: [SAtalk] Clever spam (first of many, I'm afraid...))

2003-12-15 Thread Bill Landry
you want to make sure there are no problem, you can run: spamassassin --lint. Bill - Original Message - From: "Raquel Rice" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, December 14, 2003 11:06 PM Subject: Custom Rules (was Re: [SAtalk] Clever spam (fir

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-14 Thread Rubin Bennett
To tell the truth, this is the first spam that I actually recieved in my Inbox in 3 days... between Bayes and BigEvil, I average only 1 out of the 150+ spams I've been receiving per day that SA doesn't catch. However, now I'm spoiled and I never want to see another spam message (!), so I grumble w

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-14 Thread Rubin Bennett
The Backhair rules nailed it (10 points). I (duh) didn't even look carefully at the HTML so I missed the really ugly tags in there. Thanks! Rubin On Sun, 2003-12-14 at 12:47, Rubin Bennett wrote: > The spammers are getting smarter about Bayes... this one sneaked through > SA 2.6, a well trained

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-14 Thread Carl R. Friend
On 14 Dec 2003, Rubin Bennett wrote: > The spammers are getting smarter about Bayes... this one sneaked through > SA 2.6, a well trained Bayes database, and the BigEvil rules with a > score of 1.0 out of 5. The body of the spam in question was more than 80% Bayes- poison. It's not surprisi

RE: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-14 Thread jennifer
Hi Rubin Clever yes, but not clever enough. Check out these sets, the backhair set gives this spam 9 more points. http://www.emtinc.net/spamhammers.htm look in the source of the email, if you haven't, to see what they will hit on. You're right too, they use this technique a lot... but that

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-14 Thread Matt Kettler
At 12:47 PM 12/14/2003, Rubin Bennett wrote: The spammers are getting smarter about Bayes... this one sneaked through SA 2.6, a well trained Bayes database, and the BigEvil rules with a score of 1.0 out of 5. What to do? That's funny.. it hit BAYES_99 on mine... Admittedly I had to do a kinda hal