new s.pam getting through

[Chris Maynard]

I've been seeing the same thing. I've noticed a strange header in them,
though, that I'm blocking them with. Nex-Tracking and Bel-Tracking are
the headers, and I've found no other information on these via a search.

I wanted to do an exists:\w{3}-Tracking, but I couldn't find a way to
use regex's in header checks w/ spamassassin. Anyone have any ideas? I
also plan to investigate using Postfix header checks if they continue to
change the header...

header   PORN_SPAM_NEX_TRACK exists:Nex-Tracking
describe PORN_SPAM_NEX_TRACK Message has Nex-Tracking header
score    PORN_SPAM_NEX_TRACK 10.0
header   PORN_SPAM_BEL_TRACK exists:Bel-Tracking
describe PORN_SPAM_BEL_TRACK Message has Bel-Tracking header
score    PORN_SPAM_BEL_TRACK 10.0

Hope that helps.
Chris


>>> david at PLATFORMHOSTING.COM 11/10/03 08:16AM >>>
Ken Anderson wrote:
> Is anyone else seeing a lot of variations on a new porn0 spam
getting
> through SA 2.60 filters? It's usually some variation of "curm like a
> p.orn star" and weird punctuation in the body of the email as well.
> It's getting a BAYES_00 -4.90 and DCC_CHECK 2.91, so it looks to be
not
> just hitting here, and seems to include some 'disarming text' to
fool
> bayes.

Yes, I've seen heaps of it too.  I haven't spent much time working on
it, but it is changing so often it's not easy to keep up with.

> I've blocked the subject with a few new subject filters in
> spam.assassin.prefs.conf, but wondering if anyone has a good regex
for
> it, or if we are the only ones really getting hammered by it.

About the same as I have done.  I have also upped the DCC weighting :)
--
Regards,

David Hooton
Senior Partner
Platform Hosting
1300 85 HOST
www.platformhosting.com


========================================================================
   This message has been scanned for spam & viruses by Mail Security.
   To report SPAM forward the message to:    spam at mailsecurity.net.au
   Mail Security                              www.mailsecurity.net.au
========================================================================