septic tank emails

Sat Mar 1 17:24:28 GMT 2003

At 17:12 01/03/2003, you wrote:
>I got the same email, and put the following in my local.cf to increase the
>score for similar email to the septic tank email.  If I knew perl syntax
>better I'd replace the 30 with a wild card number of zero through 100 or
>something.  Maybe someone could offer something better for that rule?

Replace
         30
with
         \d+
which means "1 or more digits".

>------------------------------------------------------------------------
>body LOCAL_FREE430              /\bfree for 30 days\b/i
>describe LOCAL_FREE430          Talks about something free for 30 days
>body LOCAL_EXCLUDE_SELF         /\bexlude yourself\b/i
>describe LOCAL_EXCLUDE_SELF     Talks about excluding yourself
>
>score LOCAL_FREE430             1.000
>score LOCAL_EXCLUDE_SELF        1.000
>------------------------------------------------------------------------
>
>Thanks
>- hawk
>
>At 07:51 AM 02/28/2003, Derek Winkler wrote:
>
>>Use a SpamAssassin local rule to increase the score:
>>
>>body LOCAL_sewer                /septic tank/i
>>describe LOCAL_ISS      "Body contains septic tank"
>>score LOCAL_ISS                 5
>>
>>I put these in /etc/mail/spamassassin/local.cf
>>
>>There should be a way to do subject, I just didn't have an example handy.
>>
>>-----Original Message-----
>>From: Matthew Bowman [<mailto:mbowman at udcom.com>mailto:mbowman at udcom.com]
>>Sent: Friday, February 28, 2003 10:31 AM
>>To: MAILSCANNER at jiscmail.ac.uk
>>Subject: septic tank emails
>>
>>Greetings
>>
>>We are being bombarded with septic tank emails and they are not being
>>flagged as spam as the score is so low. What is the best way to blacklist
>>these
>>type of emails ? (I'd rather do it on subject not domain).
>>
>>Thanks
>>
>>Matthew.
>>
>>-----
>>
>>Headers:
>>
>>Field Name: X_MailScanner_SpamCheck
>>Data Type: Text List
>>Data Length: 239 bytes
>>Seq Num: 1
>>Dup Item ID: 0
>>Field Flags:
>>
>>"not spam, SpamAssassin (score=1.7, required 4.8, BIG_FONT,
>>CTYPE_JUST_HTML, SPAM_PHRASE_00_01, TO_ADDRESS_EQ_REAL), not spam,
>>SpamAssassin (score=1.7, required 4.8, AWL, BIG_FONT, CTYPE_JUST_HTML,
>>SPAM_PHRASE_00_01, TO_ADDRESS_EQ_REAL)"
>>
>>Field Name: X_Real_Return_Path
>>Data Type: Text List
>>Data Length: 29 bytes
>>Seq Num: 1
>>Dup Item ID: 0
>>Field Flags:
>>
>>"yy55frs at fsd.paknet.com.pk"
>>
>>Field Name: SendTo
>>Data Type: Text List
>>Data Length: 53 bytes
>>Seq Num: 1
>>Dup Item ID: 0
>>Field Flags: SUMMARY
>>
>>""tiwcrpumn at lgh.lg.co.kr" <tiwcrpumn at lgh.lg.co.kr>"
>>
>>Field Name: Body
>>Data Type: MIME Part
>>Data Length: 447 bytes
>>Seq Num: 1
>>Dup Item ID: 0
>>Field Flags: SIGN SEAL
>>
>>"Content-Type: text/html
>>
>><html>
>>
>><head>
>><title>Fuck Saddam Hussein</title>
>></head>
>>
>><body>
>>
>><p align="center"><font face="Arial" size="4">
>><a
>>href="<http://www.kososo.com/cl5/spc/free_trial.html>http://www.kososo.com/cl5/spc/free_trial.html">Do
>>you have a
>>Septic
>>Tank?</a></font></p>
>><p align="center"><font face="Arial" size="4">
>><a
>>href="<http://www.kososo.com/cl5/spc/free_trial.html>http://www.kososo.com/cl5/spc/free_trial.html">Free
>>and Important
>>
>>Information.</a></font></p>
>>
>></body>
>>
>></html>
>>"

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support