On 03/27/2015 11:51 AM, Amir Caspi wrote: > On Mar 27, 2015, at 12:20 PM, Axb <axb.li...@gmail.com> wrote: > >> - Please post missed spam samples in pastebin.com - do not post samples to >> mailing lists > Of course, I would never post it to the list. I will put up a few in > pastebin but there are so many of them, and there are a few different > templates in use, so I don't know if I can really capture them all. I > obviously can't post the entire corpus on pastebin. ;-) > > Here are a few spamples: > > http://pastebin.com/3nSLurGv (this scored BAYES_99 but would still have been > FN with BAYES_999) > http://pastebin.com/LaKT5ZZK (I have a rule template for these URIs but > recent spams have modified them to cause high risk of FPs for such rules) > http://pastebin.com/qSgBxR5B (BAYES_999; could potentially be caught by an > "excessive HTML entity" rule, but none seemed to hit... is there one?) All of these were "From:" domains created today.
> > For the first and last one, the URIs are way too similar to blog URIs that > would be in use by legitimate agencies, so I suspect there is a high risk for > FPs on those. The middle one uses a template that I have URI rules for, but > the URIs are evolving to use randomized server names which are also basically > impossible to template against without risk of FPs. > > I have hundreds more like these... > > Cheers. > > --- Amir > >
