New SPAM e-mails recently?

[Steve Campbell]

OK, I searched for  SARE_MLB_Stock5 through Mailwatch, and none of the 200k+ 
emails have been hit by this rule. That's really strange.

Do you want me to start a new thread or maybe someone has a clue as to 
what's going on.

I have the 70_sare_stocks.cf in my /etc/mail/spamassassin directory. Is this 
right? The rules are added when I update my Mailwatch SA rules, so I think 
it's OK.

Sorry to hijack - sort of related.

Steve



----- Original Message ----- 
From: "Steve Campbell" <campbell at cnpapers.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Thursday, November 09, 2006 4:00 PM
Subject: Re: New SPAM e-mails recently?


>
> ----- Original Message ----- 
> From: "DAve" <dave.list at pixelhammer.com>
> To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
> Sent: Thursday, November 09, 2006 3:43 PM
> Subject: Re: New SPAM e-mails recently?
>
>
>> Jason Williams wrote:
>>> Anyone been getting some new SPAM recently, where it comes in with
>>> subjects like:
>>>
>>> It's Lorenzo :)
>>> It's Flavia :)
>>>
>>> Bunch of names in the subject line.
>>>
>>> In the body of the message, it is a wide range of things like to buy
>>> viagra and cialis.
>>> Or a couple today are for buying stock (buy this symbol) etc.
>>>
>>> Anyone been getting these? Im still getting my SA rules back in order.
>>> Wasn't sure if any of these were sneaking through to anyone else.
>>> For those that are blocking, what is catching it so I can quickly put it
>>> in?
>>
>> We've been seeing them by the thousands here.
>>
>> Score    Matching Rule    Description
>> 0.00    BAYES_50    Bayesian spam probability is 40 to 60%
>> 1.66    SARE_CSBIG    Only Mexican food gives me an Explosive Gain.
>> 1.66    SARE_MLB_Stock1
>> 1.66    SARE_MLB_Stock5    Mentions stock symbol, tickers, or OTC.
>>
>> SARE stocks catches them right off.
>
> Not so here. I never see SARE stocks in any of them. It appears to be 
> image based here, not sure though. Course, I load the SARE stocks manually 
> and mine is from October 31.
>
> Steve
>>
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>
>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!