How to stop this spam

[Adam Gross]

Edit /opt/MailScanner/etc/spam.assassin.prefs.conf and add the following:

 

/----------

Score RAZOR2_CF_RANGE_51_100 6.0

Score RAZOR2_CHECK 6.0

----------/

 

Then restart MailScanner.  Anything that trips those rules in the future will get 6 points added to the score, automatically dumping them in the spam bin, problem solved.  You can do the same for any other rule.

 

-Adam

 

From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Cheng Bruce
Sent: Tuesday, March 18, 2008 12:13 AM
To: MailScanner discussion
Subject: Re: How to stop this spam

 

Hi,

I am not sure if you turn on RBL list. I got 12.4 points.

Content analysis details:   (12.4 points, 7.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-1.0 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
                            trust
                            [MailScanner warning: numerical links are often malicious: 83.98.192.7 <http://83.98.192.7>  listed in list.dnswl.org]
 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
                            above 50%
                            [cf: 100]
 2.0 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                            [cf: 100]
 2.9 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                            [URIs: xideohot.cn]
 2.1 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: xideohot.cn]
 2.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: xideohot.cn]
 2.5 URIBL_SBL              Contains an URL listed in the SBL blocklist
                            [URIs: xideohot.cn]



On Tue, Mar 18, 2008 at 11:41 AM, anas asree <eersana at yahoo.com> wrote:

Hi all...

Our servers are getting this kind of spam that have this kind of content

uu zjqji qf, sexy er Shemale f http://www.truebsexfilms.cn lv uk bhq eqli.




dny cygum nsqzf zocnd w w olm.

xyh lu phsi u bha, efoca isea c yy ytv jkpvn y xpxo.



oc m, beautiful vvkqb wk Daughters emzr http://www.xideohot.cn h oku. nn




ptbv rep bwxx wdo ifogr.

dzi dwrw lqpk s wst kynd, k bfxm b f o rq.



Our Mailscanner did not detect these mail as SPAM. The spam report show nothing




except for Bayes_00. This kind of spam comes from yahoo mail and is kind of difficult
 

to block the IP because it comes from Yahoo. We've been getting quite a lot of this kind of Spam..



We have also installed DCC, Razor2, SARE in our mailscanner but that did'nt help
 
 

 

________________________________

Never miss a thing. Make Yahoo your homepage. <http://us.rd.yahoo.com/evt=51438/*http:/www.yahoo.com/r/hs>  


--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!



------------------------------------------------------------ 
This message has been scanned for viruses and 
dangerous content by MailScanner <http://www.mailscanner.info/> , and is 
believed to be clean. 
------------------------------------------------------------ 


------------------------------------------------------------
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
------------------------------------------------------------

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080318/dc2945dd/attachment.html