Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Bye,
Raymond.
On Sat, 2005-11-12 at 10:06 +0100, Raymond Dijkxhoorn wrote:
Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Huh? One is 1,21 (original) the other 1,22 (my addition).
Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Huh? One is 1,21 (original) the other 1,22 (my addition).
Must be my lack of coffee ;)
Bye,
Raymond.
List Mail User wrote:
They should hit a well trained BAYES
They get some from bayes but not enough, I hand feed every one I get into my
bayes and each new run always comes up with less bayes score.
The past few I received got:
BAYES_60
BAYES_60
BAYES_80
BAYES_95 - I think this one was a few
On Sat, 2005-11-12 at 10:56 -0500, Pierre Thomson wrote:
A slightly more compact way to treat the final digit:
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is now:
Hi!
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is now:
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
body
...
On Sat, 2005-11-12 at 10:56 -0500, Pierre Thomson wrote:
A slightly more compact way to treat the final digit:
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is
On Wed, 2005-11-09 at 23:47 +0100, Raymond Dijkxhoorn wrote:
Hi!
A slightly earlier one got a much lower score with:
Umm... I don't see any SARE rules in there. The fact is, SARE isn't
terribly effective against these 1-column drug spams. The only SARE hit
I got was
On Wednesday, November 9, 2005, 10:31:30 AM, Pierre Thomson wrote:
Where are those URIBL_RHS_* tests from? I see no mention of them on either
SA or URIBL sites.
Pierre
See:
http://www.uribl.com/usage.shtml
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
November, 2005 4:14 PM
To: Bowie Bailey; Spamassassin List (E-mail)
Subject: RE: More spam getting through
Bowie Bailey wrote:
Some of the medication spams are using an obnoxious html table
structure that makes the contents of each cell print vertically.
For example:
table
tr
List Mail User wrote:
...
I believe some people using the SARE rules report ~100 points for them
(after half a day or so, they fail every net test, and very many
small rules). Also, the typical ones are delivered by zombies, so
often the DUL tests hit right away, and if you can afford to
From: Loren Wilton [mailto:[EMAIL PROTECTED]
If anyone can formulate a regex to catch these letters in any
order, while avoiding a repeating sequence like A A A A A , it
would make this a safer rule.
SARE has quite a number of rules specifically to catch these table
drug spams.
Which
...
List Mail User wrote:
...
I believe some people using the SARE rules report ~100 points for them
(after half a day or so, they fail every net test, and very many
small rules). Also, the typical ones are delivered by zombies, so
often the DUL tests hit right away, and if you can afford
List Mail User wrote:
...
List Mail User wrote:
...
I believe some people using the SARE rules report ~100 points for
them (after half a day or so, they fail every net test, and very
many small rules). Also, the typical ones are delivered by
zombies, so often the DUL tests hit right
-Original Message-
From: Rosenbaum, Larry M. [mailto:[EMAIL PROTECTED]
Sent: Wednesday, November 09, 2005 10:45 AM
To: users@spamassassin.apache.org
Subject: RE: More spam getting through
From: Loren Wilton [mailto:[EMAIL PROTECTED]
I'm not sure if Loren's rules made
...
do not use SARE tests, just check, read and try to follow what they
are doing).
Paul,
I'm not really THAT badly off; I run all default 3.1.0 tests plus Bayes and
DCC, three RBL's, URIBL/SURBL, some SARE rule sets and a bunch of local rules.
I do MTA-level blocking with Spamhaus
List Mail User wrote:
...
I'm not really THAT badly off; I run all default 3.1.0 tests plus
Bayes and DCC, three RBL's, URIBL/SURBL, some SARE rule sets and a
bunch of local rules. I do MTA-level blocking with Spamhaus
SBL-XBL, which knocks off at least half the junk before it reaches
SA.
...
Pierre,
I does seem that the digests plus Bayes are the best defense against
these. Just a few minutes ago another arrived:
Y 15 -
Hi!
A slightly earlier one got a much lower score with:
Umm... I don't see any SARE rules in there. The fact is, SARE isn't
terribly effective against these 1-column drug spams. The only SARE hit
I got was SARE_SPEC_LEO_LINE03f with a whopping 0.18 points, or
occasionally
Bowie Bailey wrote:
Some of the medication spams are using an obnoxious html table
structure that makes the contents of each cell print vertically.
For example:
table
tr
tda d g/td
tdb e h/td
tdc f i/td
td width=100%/td
\tr
/table
This results
Pierre Thomson wrote:
Bowie Bailey wrote:
Some of the medication spams are using an obnoxious html table
structure that makes the contents of each cell print vertically.
For example:
table
tr
tda d g/td
tdb e h/td
tdc f i/td
td width=100%/td
\tr
...
I'm running SA 3.1 and I have started to notice more spam come through
recently.
Some are porn and some are medication. They don't hit much of anything
beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
Some of the medication spams are using an obnoxious html table
From: List Mail User [mailto:[EMAIL PROTECTED]
...
I'm running SA 3.1 and I have started to notice more spam come through
recently.
Some are porn and some are medication. They don't hit much of anything
beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
Some of the
On Tuesday 08 November 2005 08:57 am, Bowie Bailey wrote:
I'm running SA 3.1 and I have started to notice more spam come through
recently.
Some are porn and some are medication. They don't hit much of anything
beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
Some of
...
From: List Mail User [mailto:[EMAIL PROTECTED]
...
I'm running SA 3.1 and I have started to notice more spam come through
recently.
[snip - original table drug spam]
Has anyone else been having this problem? Any rules to catch medication
names in those types of tables?
They
If anyone can formulate a regex to catch these letters in any order, while
avoiding a
repeating sequence like A A A A A , it would make this a safer rule.
SARE has quite a number of rules specifically to catch these table drug
spams.
Loren
I'm not sure if Loren's rules made it into any particular
ruleset or if Leo morph'd too often to bother; Maybe someone
They were in specific.cf as I recall. Yes, they were in there, and yes, Leo
tended to get around them every few days. A couple of them are still there
and still hit
27 matches
Mail list logo
