Re: need help creating a rule for this type of spam

thanks! -- View this message in context: http://www.nabble.com/need-help-creating-a-rule-for-this-type-of-spam-tp20425116p20427622.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: need help creating a rule for this type of spam

On Mon, 2008-11-10 at 10:11 -0800, dave128 wrote: > the e-mail servers are always different, as are the addresses at the bottom. > the only real "pattern" I can see is that the SPAM always includes > references like this: > > http://fsbonh.com/MxAGpeMvMAvGivpYpYpYexvAiMHOGp > > so each message

need help creating a rule for this type of spam

View this message in context: http://www.nabble.com/need-help-creating-a-rule-for-this-type-of-spam-tp20425116p20425116.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Need rule for this type of spam

This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- View this message in context: http://www.nabble.com/Need-rule-for-this-type-of-spam-tp15714057p15714639.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Need rule for this type of spam

score here as follows :- Content analysis details: (17.1 points, 5.0 required) pts rule name description -- -- 5.0 BOTNET Relay might be a spambot or virusbot [botnet0.8,ip=213.189.148.42,rdn

Re: Need rule for this type of spam

Hi, Here http://pastebin.com/m309761a5 Thank -- View this message in context: http://www.nabble.com/Need-rule-for-this-type-of-spam-tp15714057p15714459.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Need rule for this type of spam

please post the full message via something like pastebin. we need to see the headers aswell. Regards, -- --[ UxBoD ]-- // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import" // Fingerprint: F57A 0CBD DD19 79E9 1FCC A612 CB36 D89D 2C5A 3A84 // Keyserver: www.keyserver.net Key-ID

Need rule for this type of spam

-- View this message in context: http://www.nabble.com/Need-rule-for-this-type-of-spam-tp15714057p15714057.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Rule for this kind of spam?

On Monday 20 August 2007, Rob McEwen wrote: > In one of these cases, the message contains ONLY letters and numbers... all > other spaces, line breaks, and punctuation has been removed. Even > underscores are removed. Have you considered the opposite? Removing all letters, numbers and spaces, leavi

Re: Rule for this kind of spam?

On Mon, 20 Aug 2007, Rob McEwen wrote: > In one of these cases, the message contains ONLY letters and numbers... all > other spaces, line breaks, and punctuation has been removed. Even > underscores are removed. I also convert the message to lowercase. > Perhaps there is some equivalant functio

Re: Rule for this kind of spam?

Anyone have a rule that will kill this type of spam? H,E_R-E WE GO A'GAIN! T.H-E B'I'G O N*E BEFO RE T*H*E SEPTEMBE_+R.RALLY! T_H'E MAR KET IS A BOUT TO P'O-P_, A N D SO IS E,X+M*T,! As others have mentioned, chickenpox.cf. Available in the "other rules" section at rulesemporium. Here is a

Re: Rule for this kind of spam?

Anyone have a rule that will kill this type of spam? H,E_R-E WE GO A'GAIN! T.H-E B'I'G O N*E BEFO RE T*H*E SEPTEMBE_+R.RALLY! T_H'E MAR KET IS A BOUT TO P'O-P_, A N D SO IS E,X+M*T,! As others have mentioned, chickenpox.cf. Available in the "other rules" section at rulesemporium. Lo

Rule for this kind of spam?

Anyone have a rule that will kill this type of spam? > H,E_R-E WE GO A'GAIN! > T.H-E B'I'G O N*E BEFO RE T*H*E SEPTEMBE_+R.RALLY! > T_H'E MAR KET IS A BOUT TO P'O-P_, A N D SO IS E,X+M*T,! > Ti ck: E-X M'T > 5--day po.tentia'l: 0.._4+0 > Fir_m: EXCHA'*NGE M OBILE T,E.L+E (.Other O'T_C : EX'MT.P

Re: Rule for this

It would appear that you are hopelessly stuck, then. Trusted hosts has become a very important part of SA's activities. {^_^} - Original Message - From: "Casey King" <[EMAIL PROTECTED]> I do understand that the trusted hosts needs to be fixed, but not being fully in control, I am not

RE: Rule for this

@spamassassin.apache.orgSubject: Re: Rule for this First, fix your trusted hosts.  You shoudln't be trusting a DSL line on some other system.   Second, you don't mention what version of SA you are using, nor what rules files you are using.  It looks like you don't have antidrug rules, wh

Re: Rule for this

Title: Message  First, fix your trusted hosts.  You shoudln't be trusting a DSL line on some other system.   Second, you don't mention what version of SA you are using, nor what rules files you are using.  It looks like you don't have antidrug rules, which would imply 2.6x.  In any case some

RE: Rule for this

? -Original Message- From: Jean-Paul Natola [mailto:[EMAIL PROTECTED] Sent: Monday, November 14, 2005 2:50 PM To: Gene Heskett; users@spamassassin.apache.org Subject: RE: Rule for this ??-LINT On Monday 14 November 2005 11:22, Casey King wrote: >Okay, > >I have the rule in my local.cf a

better write a rule for this early..

be4 bad guys using it:   Free .be domain name registrations http://www.e3internet.com/domain-registration/conditions/register-be/

RE: Rule for this ??-LINT

Jean-Paul Natola wrote: > > > Hi all, I *believe* I have applied the following rule correctly, > > To verify I ran the --lint , it all checked out ok BUT its giving > some errors with respect to the whitelisted entries I have in the > local.cf that resides in the SA directory > > I know my whi

RE: Rule for this ??-LINT

PEC_LEO_LINE06 >5.00 SARE_URI_EQUALS Trying to hide the real URL with IE parsing bug >0.00 UPPERCASE_25_50 message body is 25-50% uppercase > >-Original Message- >From: Pierre Thomson [mailto:[EMAIL PROTECTED] >Sent: Monday, November 14, 2005 9:19 AM >To: Casey King; SpamA

Re: Rule for this ??

LINE06 >5.00 SARE_URI_EQUALS Trying to hide the real URL with IE parsing bug >0.00 UPPERCASE_25_50 message body is 25-50% uppercase > >-Original Message- >From: Pierre Thomson [mailto:[EMAIL PROTECTED] >Sent: Monday, November 14, 2005 9:19 AM >To: Casey King; SpamA

RE: Rule for this ??

9 AM To: Casey King; SpamAssassin Users Subject: RE: Rule for this ?? Casey King wrote: >> body L_DRUGS11 /([CVAXP] ){5}/ >> header L_DRUGS12 MESSAGEID =~ >> /^<[EMAIL PROTECTED]>/ >> meta L_DRUGS1 L_DRUGS11 && L_DRUGS12 >> score L_DRUGS1 5 >>

RE: Rule for this ??

Casey King wrote: >> body L_DRUGS11 /([CVAXP] ){5}/ >> header L_DRUGS12 MESSAGEID =~ >> /^<[EMAIL PROTECTED]>/ >> meta L_DRUGS1 L_DRUGS11 && L_DRUGS12 >> score L_DRUGS1 5 >> describe L_DRUGS1 Strange Message-ID and Spam signature in body. > > This rule goes in the local.cf file right? I added thi

RE: Rule for this ??

to '1' or '11'??? thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, November 14, 2005 3:01 AM To: [EMAIL PROTECTED]; users@spamassassin.apache.org Subject: RE: Rule for this ?? This one works like magic .. Also on the new va

RE: Rule for this ??

Spam signature in body. - Ríkharður -Original Message- From: Jean-Paul Natola [mailto:[EMAIL PROTECTED] Sent: 11 November, 2005 7:59 PM To: users@spamassassin.apache.org Subject: Rule for this ?? Here's an intelligent html coder I viewed the source of the code be

Re: Rule for this ??

Jean-Paul Natola wrote: > Here’s an intelligent html coder > > > > I viewed the source of the code because I was curious as to how these > words flew right through my SA , > > > > You will note that if turned into plain text , he used a bunch of > tables and cells to produce the following;

Rule for this ??

Here’s an intelligent html coder   I viewed the source of the code because I was curious as to how these words flew right through my SA ,   You will note that if turned into plain text  , he used a bunch of tables and cells to produce the following;     From: Firoz Granger [m