Re: FW: Suggestions to block this spam

2008-02-20 Thread Rick Macdougall
Bazooka Joe wrote: Do you think anyone has notified blogspot.com that their site is being abused by spammers? I have submitted urls 4 or 5 times to them. I've never heard back but the sites did vanish pretty quickly. You can do it here http://help.blogger.com/?page=troubleshooter.cs&prob

Re: FW: Suggestions to block this spam

2008-02-20 Thread Bazooka Joe
Do you think anyone has notified blogspot.com that their site is being abused by spammers? On Feb 19, 2008 7:27 PM, Karsten Bräckelmann <[EMAIL PROTECTED]> wrote: > On Wed, 2008-02-20 at 16:08 +1300, Michael Hutchinson wrote: > > From: Karsten Bräckelmann [mailto:[EMAIL PROTECTED] > > > On Wed,

Re: FW: Suggestions to block this spam

2008-02-19 Thread Karsten Bräckelmann
On Wed, 2008-02-20 at 16:08 +1300, Michael Hutchinson wrote: > From: Karsten Bräckelmann [mailto:[EMAIL PROTECTED] > > On Wed, 2008-02-20 at 14:26 +1300, Michael Hutchinson wrote: > > > You'll be lucky to catch them on anything other than phrase matching, as > > > they're very simple in design, tho

FW: Suggestions to block this spam

2008-02-19 Thread Michael Hutchinson
> -Original Message- > From: Karsten Bräckelmann [mailto:[EMAIL PROTECTED] > Sent: Wednesday, 20 February 2008 3:33 p.m. > To: users@spamassassin.apache.org > Subject: RE: Suggestions to block this spam > > On Wed, 2008-02-20 at 14:26 +1300, Michael Hutchinson wrote

RE: Suggestions to block this spam

2008-02-19 Thread Karsten Bräckelmann
On Wed, 2008-02-20 at 14:26 +1300, Michael Hutchinson wrote: > You'll be lucky to catch them on anything other than phrase matching, as > they're very simple in design, those spam messages. Much like the > "downlooadable sooftware" one's we used to get. To a program, there's > not much that looks l

RE: Suggestions to block this spam

2008-02-19 Thread Michael Hutchinson
> -Original Message- > From: Bazooka Joe [mailto:[EMAIL PROTECTED] > Sent: Wednesday, 20 February 2008 11:22 a.m. > To: users@spamassassin.apache.org > Subject: Re: Suggestions to block this spam > > I too am getting dozens of these emails that are going right throu

Re: Suggestions to block this spam

2008-02-19 Thread Kathryn Allan
I just implemented Justins ruleset and it looks as if they will now be caught YAY thanks for the tip. Has anyone had trouble with fp's using this ruleset the ones its hitting seem to score high (4) Thanks Kate Bob Proulx wrote: Kathryn Allan wrote: The url to pastebin is http://pastebin.

Re: Suggestions to block this spam

2008-02-19 Thread Duane Hill
On Tue, 19 Feb 2008 14:21:53 -0800 "Bazooka Joe" <[EMAIL PROTECTED]> wrote: > I too am getting dozens of these emails that are going right through > SA + pyzor + dcc. sa-learn doesn't seem to make any difference. I > just installed razor2 today to try to combat real men. > > Most get through w/

Re: Suggestions to block this spam

2008-02-19 Thread Karsten Bräckelmann
On Wed, 2008-02-20 at 09:13 +1300, Kathryn Allan wrote: > Getting tones of this sort of email through have been learning it as > spam for the last few days but so far not much luck. Now that we've settled on the technical difficulties of pastebins, and since we've all seen that one before anyway.

Re: Suggestions to block this spam

2008-02-19 Thread Bob Proulx
Karsten Bräckelmann wrote: > It is a multipart/alternative message -- in this case HTML. ;) For > reference, please, always paste the entire, raw message. Don't > copy-n-paste what your MUA displays as body. (I was going to reply to > your previous mail, but you beat me to it.) Definitely posting

Re: Suggestions to block this spam

2008-02-19 Thread Bazooka Joe
I too am getting dozens of these emails that are going right through SA + pyzor + dcc. sa-learn doesn't seem to make any difference. I just installed razor2 today to try to combat real men. Most get through w/ a score of 2 or less. Many of them seem to trigger spamcop so i bumped that up to 3.5

Re: Suggestions to block this spam

2008-02-19 Thread Kathryn Allan
I have removed the extras and changed the expiry. http://pastebin.ca/910360 Thanks for the help Kate Karsten Bräckelmann wrote: On Wed, 2008-02-20 at 10:36 +1300, Kathryn Allan wrote: Thanks I will try the suggestions in the other post. I have updated the pastebin with header - i think :

Re: Suggestions to block this spam

2008-02-19 Thread Karsten Bräckelmann
On Wed, 2008-02-20 at 10:36 +1300, Kathryn Allan wrote: > Thanks I will try the suggestions in the other post. > I have updated the pastebin with header - i think : ) > http://pastebin.ca/910315 It is a multipart/alternative message -- in this case HTML. ;) For reference, please, always paste th

Re: Suggestions to block this spam

2008-02-19 Thread Kathryn Allan
Hmm the update changed the link i think http://pastebin.ca/910320 Bob Proulx wrote: Kathryn Allan wrote: The url to pastebin is http://pastebin.ca/910275 apologies if this is wrong - its my first time using pastebin. Your pastebin of the message body was good. Normally it would be be

Re: Suggestions to block this spam

2008-02-19 Thread Kathryn Allan
Hi Bob, Thanks I will try the suggestions in the other post. I have updated the pastebin with header - i think : ) http://pastebin.ca/910315 Thanks again Kate Bob Proulx wrote: Kathryn Allan wrote: The url to pastebin is http://pastebin.ca/910275 apologies if this is wrong - its my first t

Re: Suggestions to block this spam

2008-02-19 Thread Bob Proulx
Kathryn Allan wrote: > The url to pastebin is http://pastebin.ca/910275 > apologies if this is wrong - its my first time using pastebin. Your pastebin of the message body was good. Normally it would be better to paste the full headers in too so that we can run the message through the tools direct

Re: Suggestions to block this spam

2008-02-19 Thread Loren Wilton
The url to pastebin is http://pastebin.ca/910275 apologies if this is wrong - its my first time using pastebin. That appears to be the message body, but we would ideally like to see the entire message with all of the headers. There is a lot of data in headers that makes the spam easier to det

Re: Suggestions to block this spam

2008-02-19 Thread Kathryn Allan
Hi, The url to pastebin is http://pastebin.ca/910275 apologies if this is wrong - its my first time using pastebin. Thanks Kate --[ UxBoD ]-- wrote: please post a URL to a sample message, or via pastebin so that we can run it through our installations and see what it hits. what is your SA in

Re: Suggestions to block this spam

2008-02-19 Thread --[ UxBoD ]--
please post a URL to a sample message, or via pastebin so that we can run it through our installations and see what it hits. what is your SA installation hitting and scoring it as ? Regards, -- --[ UxBoD ]-- // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import" // Fingerprint:

Suggestions to block this spam

2008-02-19 Thread Kathryn Allan
Hi all, Getting tones of this sort of email through have been learning it as spam for the last few days but so far not much luck. -->start of message 2 examples Aloha,*** Real men!* Milliions of people acrosss the world have already tested THIS Goedendag, *** Real men!* * *MMillions of peopl