I'm getting hammered by these as well, usually scoring below 2 points. I'm
running most of the standard SARE rules (including SARE_STOCKS). Any advice?
Bayes training has (so far) been ineffective.
-Shawn
-Original Message-
From: Chris Conn [mailto:[EMAIL PROTECTED]
Sent: Friday, Februa
I had this problem a couple years back with our education email address. While
the account got moderate levels of spam, it was absolutely inundated with virus
backscatter. After a few months of trying to block the majority of it, we
deemed the effort futile and abandoned the address. It was a nu
Hi everyone,
I'm running SA 3.02 for a few weeks now together with amavisd-new-20030616 and
it seems that MISSING_SUBJECT is firing on every mail even if there is a
Subject: header and it's not empty. Has anyone experienced this problem or have
an idea whats going on? I've googled around some,
If you are running the 70_SARE_HTML1.CF file, increase the value of
SARE_HTML_A_HIDE in your local.cf... this spammer always hits this rule. I've
been doing this for several months now, with no false positives. I've set mine
to 3 points (5 required).
HTH,
Shawn
-Original Message-
From
Good morning everyone,
I just got a F.P. using one of the SARE rulesets, looks like
the SARE_SUB_PENIS_OB rule might need some tweaking. Seems like it fired from
the word pennies:
Content preview:
Pennies From Heaven The Daily Reckoning [...]
Content analysis
details: (7.9 p
Hi Matt,
I've mentioned this before as well. This spammer is really good at not hitting
most of the stock rules.
We get hit with about a dozen of them before the SURBL's catch on.
To catch them all the time, make sure you are using 70_sare_html1.cf from
rulesemporium.com.
Add to your local.cf
If its the spam I think it is, I stopped it by using the SARE_70_HTML1.CF file
and adding this to my local.cf
score SARE_HTML_A_HIDE 5.0
They always hit this rule ;)
Shawn
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Tuesday, October 12, 2004 12:26
I've been being hit by this type of spam quite hard lately, but finally found a
way to stop it. Make sure you are running the SARE html and adult rulesets.
Then add to your local CF:
score SARE_HTML_URI_NODOT2 2.0
score SARE_HTML_A_HIDEtst2 4.0
This spammer's emails ALWAYS hit these 2 rule
