<HTML><HEAD><TITLE>email signature</TITLE>
<META http-equiv=Content-Type content="text/html; charset=ISO-8859-15">
<META content="MSHTML 6.00.2900.3562" name=GENERATOR></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Segoe UI" text=#000000 bgColor=#ffffff>
<DIV>I believe that I have also been greatly troubled by the same messages. The common thread to these messages is what I call an obfucated URL where the URL has spaces in multiple places. I created a cf file in /etc/mail/spmassassin directory and wrote my first spamassassin rule. It might not be the best but it is working for me. Basically, the rule matches a URL that starts with www. followed by a space followed by some text ending in a period like pill45. followed by another space then a TLD like com, net or org. I started with a small score for testing but have significantly raised the score to 4.5 now.</DIV>
<DIV> </DIV>
<DIV># Rule to find URLs with spaces<BR>body ASDM_OBF_URL /www\.\s(.+?)\s[A-Za-z]{2,4}/i<BR>score ASDM_OBF_URL 4.5<BR>describe ASDM_OBF_URL URLs with spaces<BR></DIV>
<DIV>I haven't seen any false positives yet.</DIV>
<DIV> </DIV>
<DIV>Gary Faith</DIV>
<DIV><BR><BR>>>> Alessandro Bianchi <alex@skynet-srl.com> 7/3/2009 7:56 AM >>><BR>Il 03/07/2009 13:00, <A class=moz-txt-link-abbreviated href="mailto:mailscanner-request@lists.mailscanner.info">mailscanner-request@lists.mailscanner.info</A> ha scritto: </DIV>
<BLOCKQUOTE style="FONT-SIZE: medium; FONT-FAMILY: serif" cite=mid:200907031100.n63B023c025716@safir.blacknight.ie type="cite">Alessandro Bianchi wrote: <BR>
<BLOCKQUOTE style="COLOR: rgb(0,0,0)" type="cite">Hi guys <BR><BR>Those damned spemmers have found a way to break in <BR><BR>After image only spam, they have managed to build plain text only spam (no links or hrml or images, just text) that slips throught my MS installation. <BR><BR>They often place in ortographic errors to "fool" spamassassin. <BR><BR></BLOCKQUOTE>Hi, <BR><BR>They are being detected as : Sanesecurity.Spam.10528 <BR><BR>Cheers, <BR><BR>Steve <BR>Sanesecurity <BR>sanesecurity.com </BLOCKQUOTE><BR>Thaks Steve for helping me<BR><BR>I've just installed unofficial signs and sit here for looking at it working!<BR><BR>For Alex<BR><BR>Very unfortunately RBLs don't help at all since SA decreases the score!<BR><BR>Look at this:<BR><BR>
<TABLE class=sa_rules_report cellSpacing=2 cellPadding=1 width="100%" border=0>
<TBODY>
<TR>
<TD>-2.60</TD>
<TD>BAYES_00</TD>
<TD> </TD></TR>
<TR>
<TD>0.91</TD>
<TD>RCVD_IN_PBL</TD>
<TD> </TD></TR>
<TR>
<TD>0.10</TD>
<TD>RDNS_DYNAMIC</TD>
<TD> </TD></TR>
<TR>
<TD>1.42</TD>
<TD>SARE_ADULT2</TD></TR></TBODY></TABLE><BR>Spamassassin reports it as BAYES_00 and clean message and that "kills" the others checks.<BR><BR>If I decrease the BAYES_00 score, it will likely break legitimate emails<BR><BR>So I'm testing the unofficial signs and I'll let you know<BR><BR>Thank you very much for your precious help!<BR><BR>Alessandro<BR>
<DIV class=moz-signature>-- <BR>
<META http-equiv=Content-Style-Type content=text/css>
<STYLE type=text/css>
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 13.0px Arial; color: #1341f9}
p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 11.0px Arial; color: #ff5f0d}
p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 11.0px Arial; color: #0013f9}
p.p4 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 11.0px Arial; color: #1d24f9}
p.p5 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: center; font: 11.0px Arial; color: #1d24f9; min-height: 12.0px}
p.p6 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 13.0px}
p.p7 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; color: #566880}
span.s1 {text-decoration: underline ; color: #0010e8}
span.s2 {text-decoration: underline ; color: #000beb}
</STYLE>
<P class=p1><B>SkyNet SRL</B></P>
<P class=p2>P.zza XXV Aprile 14 - 28021 Borgomanero (NO) - ITALY</P>
<P class=p3>Tel. +39 0322 836487/834765 - Fax.+39 0322.836608</P>
<P class=p4><A class=moz-txt-link-abbreviated href="mailto:info@skynet-srl.com">info@skynet-srl.com</A> -<A href="http://www.skynet-srl.com"><SPAN class=s1>www.skynet-srl.com</SPAN></A></P>
<P class=p5><BR></P>
<P class=p6><BR></P>
<P class=p6><BR></P>
<P class=p7>Le informazioni contenute in questo messaggio sono riservate e confidenziali e ne é vietata la diffusione in qualunque forma.</P>
<P class=p7>Qualora Lei non fosse la persona a cui il presente messaggio é destinato, La invitiamo ad eliminarlo dandocene gentilmente comunicazione.</P>
<P class=p7>Per qualsiasi informazione in merito si prega di contattare <A href="mailto:info@skynet-srl.com"><SPAN class=s2>info@skynet-srl.com</SPAN></A>. ( Rif. D.L. 196/200 )</P><BR></DIV></BODY></HTML>