new s.pam getting through

[Ken Anderson]

Thanks, fwiw, I'm also seeing "Hel-Tracking" header.
Ken A.
Pacific.Net


Chris Maynard wrote:

> I've been seeing the same thing. I've noticed a strange header in them,
> though, that I'm blocking them with. Nex-Tracking and Bel-Tracking are
> the headers, and I've found no other information on these via a search.
>
> I wanted to do an exists:\w{3}-Tracking, but I couldn't find a way to
> use regex's in header checks w/ spamassassin. Anyone have any ideas? I
> also plan to investigate using Postfix header checks if they continue to
> change the header...
>
> header   PORN_SPAM_NEX_TRACK exists:Nex-Tracking
> describe PORN_SPAM_NEX_TRACK Message has Nex-Tracking header
> score    PORN_SPAM_NEX_TRACK 10.0
> header   PORN_SPAM_BEL_TRACK exists:Bel-Tracking
> describe PORN_SPAM_BEL_TRACK Message has Bel-Tracking header
> score    PORN_SPAM_BEL_TRACK 10.0
>
> Hope that helps.
> Chris
>
>
>
>>>>david at PLATFORMHOSTING.COM 11/10/03 08:16AM >>>
>
> Ken Anderson wrote:
>
>>Is anyone else seeing a lot of variations on a new porn0 spam
>
> getting
>
>>through SA 2.60 filters? It's usually some variation of "curm like a
>>p.orn star" and weird punctuation in the body of the email as well.
>>It's getting a BAYES_00 -4.90 and DCC_CHECK 2.91, so it looks to be
>
> not
>
>>just hitting here, and seems to include some 'disarming text' to
>
> fool
>
>>bayes.
>
>
> Yes, I've seen heaps of it too.  I haven't spent much time working on
> it, but it is changing so often it's not easy to keep up with.
>
>
>>I've blocked the subject with a few new subject filters in
>>spam.assassin.prefs.conf, but wondering if anyone has a good regex
>
> for
>
>>it, or if we are the only ones really getting hammered by it.
>
>
> About the same as I have done.  I have also upped the DCC weighting :)
> --
> Regards,
>
> David Hooton
> Senior Partner
> Platform Hosting
> 1300 85 HOST
> www.platformhosting.com
>
>
> ========================================================================
>    This message has been scanned for spam & viruses by Mail Security.
>    To report SPAM forward the message to:    spam at mailsecurity.net.au
>    Mail Security                              www.mailsecurity.net.au
> ========================================================================
>
>