septic tank emails

Sat Mar 1 17:12:16 GMT 2003

I got the same email, and put the following in my local.cf to increase the
score for similar email to the septic tank email.  If I knew perl syntax
better I'd replace the 30 with a wild card number of zero through 100 or
something.  Maybe someone could offer something better for that rule?
------------------------------------------------------------------------
body LOCAL_FREE430              /\bfree for 30 days\b/i
describe LOCAL_FREE430          Talks about something free for 30 days
body LOCAL_EXCLUDE_SELF         /\bexlude yourself\b/i
describe LOCAL_EXCLUDE_SELF     Talks about excluding yourself

score LOCAL_FREE430             1.000
score LOCAL_EXCLUDE_SELF        1.000
------------------------------------------------------------------------

Thanks
- hawk

At 07:51 AM 02/28/2003, Derek Winkler wrote:

>Use a SpamAssassin local rule to increase the score:
>
>body LOCAL_sewer                /septic tank/i
>describe LOCAL_ISS      "Body contains septic tank"
>score LOCAL_ISS                 5
>
>I put these in /etc/mail/spamassassin/local.cf
>
>There should be a way to do subject, I just didn't have an example handy.
>
>-----Original Message-----
>From: Matthew Bowman [<mailto:mbowman at udcom.com>mailto:mbowman at udcom.com]
>Sent: Friday, February 28, 2003 10:31 AM
>To: MAILSCANNER at jiscmail.ac.uk
>Subject: septic tank emails
>
>Greetings
>
>We are being bombarded with septic tank emails and they are not being
>flagged as spam as the score is so low. What is the best way to blacklist
>these
>type of emails ? (I'd rather do it on subject not domain).
>
>Thanks
>
>Matthew.
>
>-----
>
>Headers:
>
>Field Name: X_MailScanner_SpamCheck
>Data Type: Text List
>Data Length: 239 bytes
>Seq Num: 1
>Dup Item ID: 0
>Field Flags:
>
>"not spam, SpamAssassin (score=1.7, required 4.8, BIG_FONT,
>CTYPE_JUST_HTML, SPAM_PHRASE_00_01, TO_ADDRESS_EQ_REAL), not spam,
>SpamAssassin (score=1.7, required 4.8, AWL, BIG_FONT, CTYPE_JUST_HTML,
>SPAM_PHRASE_00_01, TO_ADDRESS_EQ_REAL)"
>
>Field Name: X_Real_Return_Path
>Data Type: Text List
>Data Length: 29 bytes
>Seq Num: 1
>Dup Item ID: 0
>Field Flags:
>
>"yy55frs at fsd.paknet.com.pk"
>
>Field Name: SendTo
>Data Type: Text List
>Data Length: 53 bytes
>Seq Num: 1
>Dup Item ID: 0
>Field Flags: SUMMARY
>
>""tiwcrpumn at lgh.lg.co.kr" <tiwcrpumn at lgh.lg.co.kr>"
>
>Field Name: Body
>Data Type: MIME Part
>Data Length: 447 bytes
>Seq Num: 1
>Dup Item ID: 0
>Field Flags: SIGN SEAL
>
>"Content-Type: text/html
>
><html>
>
><head>
><title>Fuck Saddam Hussein</title>
></head>
>
><body>
>
><p align="center"><font face="Arial" size="4">
><a
>href="<http://www.kososo.com/cl5/spc/free_trial.html>http://www.kososo.com/cl5/spc/free_trial.html">Do
>you have a
>Septic
>Tank?</a></font></p>
><p align="center"><font face="Arial" size="4">
><a
>href="<http://www.kososo.com/cl5/spc/free_trial.html>http://www.kososo.com/cl5/spc/free_trial.html">Free
>and Important
>
>Information.</a></font></p>
>
></body>
>
></html>
>"