Happy NW - Not

[Ken A]

Some of this stuff is pretty short on content, and when it's from a 
fresh botnet, you pretty much have to write a quick rule to nail that 
particular spam.

body    LOCAL_STOCK_1_PHYA      /(PHYA)/
describe        LOCAL_STOCK_1_PHYA      (PHYA) stock spam
score   LOCAL_STOCK_1_PHYA      5.5

I add these type of rules frequently. :-\
And remove them when they stop hitting.

Ken A
Pacific.Net


Furnish, Trever G wrote:
> In my case bayes_99 is hitting most of them, but that's not enough to
> catch on its own.  Still catching a lot of them though due to other
> rules' contributions.
> 
> Here's a report from one that was caught:
> 
> X-HJ-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
> score=10.249,
> 	required 5, BAYES_99 3.50, FORGED_RCVD_HELO 0.14,
> 	RAZOR2_CF_RANGE_51_100 0.50, RAZOR2_CF_RANGE_E4_51_100 1.50,
> 	RAZOR2_CHECK 0.50, SARE_LWSHORTT 0.79, SARE_MLB_Stock1 1.66,
> 	SARE_MLB_Stock2 1.66)
> 
> Razor has started to hit on them too.  The ones that were missed at my
> site didn't trip the SARE or Razor rules listed above, but that seems to
> have stopped happening.  They're mostly being caught for me. 
> 
>> -----Original Message-----
>> From: mailscanner-bounces at lists.mailscanner.info 
>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
>> Of John Schmerold
>> Sent: Tuesday, January 02, 2007 11:31 AM
>> To: MailScanner discussion
>> Subject: Happy NW - Not
>>
>> What's everyone doing to get rid of the endless emails with 
>> Happy NW on the subject line?
>>
>>