Tristan Miller wrote:
> Greetings.
>
> I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor,
> and several daily-updated SARE rulesets [1]. Nonetheless, there's one
> particular kind of spam lately that always seems to slip through; it
> consists of a bunch of random words plus a graphic attachment. The
> graphic is usually a page of text advertising something -- almost always a
> stock, though I've had a few penis-enlargement product ads. See
> <http://www.dfki.uni-kl.de/~miller/tmp/stock_spam.txt> for some examples
> (mbox format).
>
> Does anyone have a filterset or other recommended settings that will block
> this kind of spam?
Tristan.. Have you correctly configured your trusted_networks?
The first message in that example SHOULD have triggered RCVD_IN_NJABL_DUL and
RCVD_IN_SORBS_DUL.
As per this header:
Received: from M696P000.adsl.highway.telekom.at
(M696P000.adsl.highway.telekom.at [62.47.246.224])
by mail.dfki.de (Postfix) with SMTP id 90E26E4918
for <[EMAIL PROTECTED]>; Sun, 2 Apr 2006 00:22:49 +0200 (CEST)
But for some reason the header not parsing or trust path is broken somewhere and
SA thinks that 62.47.246.224 is internal.
You might want to run the message through spamassassin with debugging enabled
and see what it has to say about the Received: parsing.
Also I would *STRONGLY* suggest you upgrade your SA when you get a chance. SA
3.0.4 has some pretty major bugs (including a DoS) that are fixed in 3.0.5, and
lacks some important features present in 3.1.0 and 3.1.1.
3.0.5 release:
http://mail-archives.apache.org/mod_mbox/spamassassin-dev/200512.mbox/[EMAIL
PROTECTED]
3.1.0 release:
http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200509.mbox/[EMAIL
PROTECTED]
3.1.1 release:
http://mail-archives.apache.org/mod_mbox/spamassassin-users/200603.mbox/[EMAIL
PROTECTED]
