New Spam

[Pete Russell]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

do a spamassassin -D --lint and read the output, it will show you want
is failing and what isnt.

If you can see things like SPF and URI tests failing do a #MailScanner
-v and see if you are mising some of the key perl modules, like;
NEt::DNS and SPF

Good luck
Pete

Roger Jochem wrote:
> What do I have to do to enable URIBLs ?
>
> I'm not shure I'm using that... I'm using spamassassin 3.0.2
>
> ----- Original Message -----
> From: "Drew Marshall" <drew at THEMARSHALLS.CO.UK>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Wednesday, March 23, 2005 7:20 AM
> Subject: Re: New Spam
>
>
>
>>Roger Jochem said:
>>
>>>Hello all!
>>>
>>>I'm receiving messages like the attached one for a while now. Is there
>>>some spamassassin rule that can block this kind of spam? Aparently the
>>>message, lokking the code, is very diferent from what is appearing on
>>>screen. And the original text (that doesn't appear) is always very
>>>diferent...
>>
>>Worked for me...
>>
>>Our MailScanner believes that the attachment to this message sent to you
>>
>>    From: owner-mailscanner at jiscmail.ac.uk
>> Subject: [MAILSCANNER] New Spam
>>
>>is Unsolicited Commercial Email (spam). Unless you are sure that this
>
> message
>
>>is incorrectly thought to be spam, please delete this message without
>
> opening
>
>>it. Opening spam messages might allow the spammer to verify your email
>>address.
>>
>>If you believe that this message has been incorrectly marked as spam,
>
> please
>
>>forward this email to postmaster.
>>
>> pts rule name              description
>>---- ----------------------
>>--------------------------------------------------
>> 2.5 SARE_SPOOF_COM2OTH     URI: a.com.b.c
>> 2.5 SARE_SPOOF_OURI        URI: URL has items in odd places
>> 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level
>
> domain
>
>> 0.1 HTML_TEXT_AFTER_BODY   BODY: HTML contains text after BODY close tag
>> 0.1 HTML_TAG_EXIST_TBODY   BODY: HTML has "tbody" tag
>>-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
>>                            [score: 0.0000]
>> 0.0 HTML_TEXT_AFTER_HTML   BODY: HTML contains text after HTML close tag
>> 0.0 HTML_MESSAGE           BODY: HTML included in message
>> 0.1 HTML_FONT_BIG          BODY: HTML tag for a big font size
>> 0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76
>
> chars
>
>> 1.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
>>                            [URIs: spacedrugs.com]
>> 3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL
>
> blocklist
>
>>                            [URIs: spacedrugs.com]
>>
>>As you can see the URIBLs did their job very well. I would ensure that you
>>are using the latest SpamAssassin and have URIBL turned on.
>>
>>Drew
>>
>>--
>>In line with our policy, this message has
>>been scanned for viruses and dangerous
>>content by MailScanner, and is believed to be clean.
>>www.themarshalls.co.uk/policy
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!