Rise in Viagra spam

[Daniel Maher]

I added the following SA rules to help with those:

header          BADVIAGRA01     Subject =~ /.*\sV.*AGRA.*/
score           BADVIAGRA01     10
describe        BADVIAGRA01     Banned "viagra" subject (01)

header          BADVIAGRA02     Subject =~ /.*\sV.*AGGRA.*/
score           BADVIAGRA02     10
describe        BADVIAGRA02     Banned "viagra" subject (02)

header          BADVIAGRA03     Subject =~ /R[eE]:\s.*V.*AGRA.*/
score           BADVIAGRA03     10
describe        BADVIAGRA03     Banned "viagra" subject (03)

I haven't received any un-tagged spam of the sort since.

--
  _
 °v°  Daniel Maher
/(_)\ Administrateur Système Unix
 ^ ^  Unix System Administrator
 
Sentio aliquos togatos contra me conspirare.
-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Garry Glendown
Sent: Thursday, July 27, 2006 4:58 AM
To: MailScanner discussion
Subject: Rise in Viagra spam

Hi,

over the last couple days we've had a pretty drastic increase in Viagra 
spam ... I have some (older) antidrug-cf and several Rules Du Jour 
configs running, but scores are (though just barely) too low ... here's 
a sample:

---
VlljAGRA from 3 , 35 $
AMjBlIEN
CIjALIlS from 3 , 75 $
VAjLIlUM from 1 , 25 $
---

It has an ASCII and HTML version included, and also sports a piece of 
random text from some literature ... spam scores usually look like this:

X-nethinks-MailScanner-SpamCheck: not spam, SpamAssassin (Wertung=4.05,
	benoetigt 5, BAYES_50 0.00, FORGED_RCVD_HELO 0.14, HTML_50_60 0.13,
	HTML_MESSAGE 0.00, URIBL_SBL 1.64, URIBL_WS_SURBL 2.14)

though some have scored BAYES_60 ... (I already ran a couple dozen of 
the spam mails through sa-learn, but that has not increased bayes enough 
...)

Anybody have a suggestion as to another Rules Du Jour set or something?

Thanks, -gg
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!