Is there an sa recipe for this latest innovation, with body as follows?
This spam seems to be designed to bypass bayesian analysis ... and it appears to work. Almost every piece of spam like this I've seen has the BAYES_00 rule, which has a negative score.
Almost all the spam of this nature seems to include just a link to an image on a few specific domains. As such, I've added a new rule that puts a very high score on any spam that includes that URL ...
uri BAYES_BUSTER /rx359|2004hosting|530000X|openseed|er5hdh|quickforms/i describe BAYES_BUSTER Trying to bypass BAYES score BAYES_BUSTER 10.0
The high score is designed to negate the low baysian score.
I'm not sure if this is the best aproach, but it seems to be working for me.
david
-- | Internet: [EMAIL PROTECTED] | WWW: http://david.fallingrock.net | | We're not in the middle of nowhere... | we're on the outskirts of everywhere! | | - DMRoth (adapted)
------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
