I just implemented Justins ruleset and it looks as if they will now be
caught YAY thanks for the tip.
Has anyone had trouble with fp's using this ruleset the ones its hitting
seem to score high (4)
Thanks
Kate
Bob Proulx wrote:
Kathryn Allan wrote:
The url to pastebin is http://pastebin.ca/910275
apologies if this is wrong - its my first time using pastebin.
Your pastebin of the message body was good. Normally it would be
better to paste the full headers in too so that we can run the message
through the tools directly but in this case we have all been seeing a
lot of those spam messages and are very familiar with them.
Another comment about pastebin is that for temporary stuff like this
it is good to set an expiration on it. In the long term it is junk
and so expiring it saves disk space there and on the search engines
that thread it and generally allows things to clean up afterward.
Other pastebin sites set an expiration by default but on pastebin.ca
you need to manually set one. It is the "Expire this post in:"
pulldown setting.
To combat this spam Justin has recently posted about his sought.cf rules.
Justin Mason recently wrote:
by the way, just to get back to this original topic -- my "sought.cf"
ruleset has caught these nicely for months. It's very good for this
kind of spam: http://taint.org/2007/08/15/004348a.html
I am using them to good effect (Thanks Justin!) and your message
scored the following for me:
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
4.0 JM_SOUGHT_1 JM_SOUGHT_1
4.0 JM_SOUGHT_3 JM_SOUGHT_3
My Bayes engine has learned these as mostly spam but yours probably
has not. Plus it wouldn't be enough by itself. But the sought rules
have been doing good at handling the surge of "today's spam" messages
as they change rapidly.
Bob
