Alex wrote:
Hi,
I'm having a real problem with this persistent spam that contains just
a URL as the body, and is always from yahoo. I've got an example here:
http://pastebin.com/UqzhDHEu
'example.com' is my change. I'm using SA v3.2.5 with postfix/amavis.
I'm concerned that the bayes score is always low. I can't determine
any other patterns from this message to key on for other rules. Ideas
most welcome.
I can see why those would be tricky if Bayes isn't catching them. Still,
keep training Bayes on them.
How much mail (ham) from yahoo do you see?
Personally, I've about had it with hotmail/yahoo etc and have given them
a score across the board so they now have far fewer points to play with
before being classified as spam - I then whitelist all known senders
from these troublesome domains. I'm small, so it's possible to do that
and it takes less time dealing with the occasional FP than it did trying
to stop their spam.
If that's not an option, how about a meta rule for FROM_YAHOO and
__HAS_ANY_URI (this rule exists in SA). Unlike hotmail that has a URI
embedded in the footer of every mail, this might work for the example
you post.
