<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Edit
/opt/MailScanner/etc/spam.assassin.prefs.conf and add the following:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>/----------<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Score
</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>RAZOR2_CF_RANGE_51_100
6.0<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Score
</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>RAZOR2_CHECK
6.0<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>----------/</span><span
style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Then restart MailScanner. Anything that trips those rules in
the future will get 6 points added to the score, automatically dumping them in
the spam bin, problem solved. You can do the same for any other rule.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>-Adam<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Cheng
Bruce<br>
<b>Sent:</b> Tuesday, March 18, 2008 12:13 AM<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: How to stop this spam<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'>Hi,<br>
<br>
I am not sure if you turn on RBL list. I got 12.4 points.<br>
<br>
Content analysis details: (12.4 points, 7.0 required)<br>
<br>
pts rule
name
description<br>
---- ---------------------- --------------------------------------------------<br>
-1.0 RCVD_IN_DNSWL_LOW RBL: Sender listed at <a
href="http://www.dnswl.org/">http://www.dnswl.org/</a>, low<br>
trust<br>
[<a href="http://83.98.192.7"><font color="red"><b>MailScanner has detected a possible fraud attempt from "83.98.192.7" claiming to be</b></font> <b><span style='color:red'>MailScanner warning:
numerical links are often malicious:</span></b> 83.98.192.7</a> listed in <a
href="http://list.dnswl.org">list.dnswl.org</a>]<br>
1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level<br>
above 50%<br>
[cf: 100]<br>
2.0
RAZOR2_CHECK Listed
in Razor2 (<a href="http://razor.sf.net/">http://razor.sf.net/</a>)<br>
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%<br>
[cf: 100]<br>
2.9 URIBL_JP_SURBL
Contains an URL listed in the JP SURBL blocklist<br>
[URIs: <a href="http://xideohot.cn">xideohot.cn</a>]<br>
2.1 URIBL_OB_SURBL
Contains an URL listed in the OB SURBL blocklist<br>
[URIs: <a href="http://xideohot.cn">xideohot.cn</a>]<br>
2.0
URIBL_BLACK
Contains an URL listed in the URIBL blacklist<br>
[URIs: <a href="http://xideohot.cn">xideohot.cn</a>]<br>
2.5
URIBL_SBL
Contains an URL listed in the SBL blocklist<br>
[URIs: <a href="http://xideohot.cn">xideohot.cn</a>]<br>
<br>
<o:p></o:p></p>
<div>
<p class=MsoNormal>On Tue, Mar 18, 2008 at 11:41 AM, anas asree <<a
href="mailto:eersana@yahoo.com">eersana@yahoo.com</a>> wrote:<o:p></o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'>Hi all...<br>
<br>
Our servers are getting this kind of spam that have this kind of content<o:p></o:p></p>
<pre><b>uu zjqji qf, sexy er Shemale f <a href="http://www.truebsexfilms.cn"
target="_blank">http://www.truebsexfilms.cn</a> lv uk bhq eqli.<br>
<br>
</b><o:p></o:p></pre><pre><b>dny cygum nsqzf zocnd w w olm.<br>
xyh lu phsi u bha, efoca isea c yy ytv jkpvn y xpxo.<br>
<br>
oc m, beautiful vvkqb wk Daughters emzr <a href="http://www.xideohot.cn"
target="_blank">http://www.xideohot.cn</a> h oku. nn<br>
<br>
</b><o:p></o:p></pre><pre><b>ptbv rep bwxx wdo ifogr.<br>
dzi dwrw lqpk s wst kynd, k bfxm b f o rq.</b><br>
<b><br>
</b>Our Mailscanner did not detect these mail as SPAM. The spam report show nothing<br>
<br>
<o:p></o:p></pre><pre>except for Bayes_00. This kind of spam comes from yahoo mail and is kind of difficult<o:p></o:p></pre><pre> <br>
to block the IP because it comes from Yahoo. We've been getting quite a lot of this kind of Spam..<br>
<br>
We have also installed DCC, Razor2, SARE in our mailscanner but that did'nt help<o:p></o:p></pre>
<div><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre></div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
<div class=MsoNormal align=center style='text-align:center'>
<hr size=1 width="100%" align=center>
</div>
<p class=MsoNormal>Never miss a thing. <a
href="http://us.rd.yahoo.com/evt=51438/*http:/www.yahoo.com/r/hs"
target="_blank">Make Yahoo your homepage.</a> <o:p></o:p></p>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"
target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting"
target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<o:p></o:p></p>
</div>
<p class=MsoNormal><br>
<br>
------------------------------------------------------------ <br>
This message has been scanned for viruses and <br>
dangerous content by <a href="http://www.mailscanner.info/"><b>MailScanner</b></a>,
and is <br>
believed to be clean. <br>
------------------------------------------------------------ <o:p></o:p></p>
</div>
</body>
<br />------------------------------------------------------------
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
<br />------------------------------------------------------------
</html>