Hi,
it seems that there are many spam lately offering to view the
Paris Hilton video.
I tried to devise a rule to spot such spam but with no success
(either with 2.55 or 2.60 - upgrade to 2.61 planned)
Anybody came up with some solution ?
My rule was :
uri LOCAL_HILTON /special-selections\.com/
describe LOCAL_HILTON Paris-Hilton-Video
score LOCAL_HILTON 100.0
But it does not work on most spam I received (base64 encodage + header trick ?).
base64 sample body
aGV5DQoNCkNvbWUgY2hlY2sgb3V0IHRoZSBQYXJpcyBIaWx0b24gczN4IHRh
cGVzIGFsbCBmb3IgZnJlZS4NCg0KIGh0dHA6Ly93d3cuc3BlY2lhbC1zZWxl
Y3Rpb25zLmNvbQ==
If I do a base64 -d on these lines and copy the output in a message
the rule is triggered.
X-Spam-Status: Yes, hits=100.0 required=5.0 tests=LOCAL_HILTON autolearn=no
version=2.60
For spam I received the Spam-status for such message was :
X-Spam-Status: No, hits=4.3 required=5.0 tests=DATE_IN_PAST_03_06,
HTML_MIME_NO_HTML_TAG,MIME_BASE64_TEXT,MIME_HTML_NO_CHARSET,
MIME_HTML_ONLY autolearn=no version=2.60
Strange ?
Full spam message with headers available if needed.
Any help is welcome ....
Regards,
SL/
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
