I have attached a few mails that are still getting through.
These are scoring extremely low.
The number of mails like these that slip through is on the increase.
Any ideas as to how I can block them?
I am using SA2.62, Exim 4.30 (with the exiscan 4.30 patch), SA-exim 3.1 .
A well trained bayes database goes a VERY long way against these.
If you can afford the network overhead, DNSBLs, DCC and/or razor help a bit against these, and lots of other "unknowns".
Brent's random char ruleset can help, but needs some additional mods to catch the %RND_SYB stuff in the body that you're getting
http://kepler.acns.bethel.edu/~bjn/spamassassin/rnd_uc_char.cf
ie: you could modify his rule to be something like this:
body BODY_RND_GENERATOR /\%RND_(?:LC_CHAR|UC_CHAR|SYB|WORD)/
describe BODY_RND_GENERATOR body contains markups typical of spammer random-word/symbol generators
score BODY_RND_GENERATOR 2.0
------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
