OT: latinamerican spam

[Jason Voorhees]

hi:

On Tue, Mar 10, 2009 at 8:15 AM, Eduardo Casarero <ecasarero at gmail.com> wrote:
> If there is people from latin america (using MailScanner) interested
> in making regional antispam rules from SA or any other recipe please
> contact me at my personal email. The idea is to collaborate and
> improve spamassassin rules based on our regional spam traffic.
>
> I really need to improve detection rates ( i've all regular stuff ).
>
I'm from Peru. I'm using MailScanner with MCP and some plugins of
SpamAssassin. These are my antispam techniques:

- RBL checks by SpamAssassin (disabled by MailScanner with "Spam List"
and "Spam List Domain")
- razor
- SpamAssassin auto whitelisting
- SpamAssassin Bayes autolearning
- SpamAssassin SPF checks
- TextCat SpamAssassin plugin
- A "Relayed by dialup" SpamAssassin plugin
- SMTP delay greeting at MTA level with Postfix
- Greylisting at MTA level with sqlgrey
- Some restrict UCE checks at MTA level
- Sanesecurity signatures for ClamAV
- MCP rules with SpamAssassin

Without using MCP rules I see that some spam messages aren't filtered.
Those spams are in Spanish and almost always from my country or
Latinoamerica containing "publicidad" word in the subject.
I just use MCP rules to stop those messages containing "publicidad" like this:

header   REGLA_PUBLI1    Subject =~
/p?.{0,2}[vu].{0,2}b.{0,2}[1\|l].{0,2}.?.{0,2}[zsxc].{0,2}.?.{0,2}d.{0,2}a.{0,2}d/i
describe REGLA_PUBLI1    Publicidad baneada
score    REGLA_PUBLI1    6

header   REGLA_PUBLI12    Subject =~ /p[vu]b[\|l1][\|1i][zxsc][\|1i]d[4a]d/i
describe REGLA_PUBLI12    Publicidad baneada
score    REGLA_PUBLI12    7

Now there are just a few spam messages (less than 50 maybe in a server
that generates 20K emails daily) that are passing to the INBOX. Those
can be moved to a Shared Spam folder where I get its contents via
fetchmail and IMAP to run sa-learn everyday.

This combination it's working almost perfect for several mailserver
installations I've done.
What kind of spam messages aren't you able to filter?

> Thanks!
>
> Eduardo.
>
> PD: if there is anyone from Buenos Aires/ Argentina we also can meet
> to drink a beer in honour to Julian and his great piece of software!
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>