Mailing List Archive: How to detect this type of message

How to detect this type of message

Feb 17, 2004, 10:26 AM

Post #1 of 3 (579 views)

I am new to SpamAssassin and have been watching this list. I received a
message today I would like filtered...it got a score of 0...Can anyone
suggest a filter for this type of email???
----------------EMAIL RECEIVED-----------------------------------------
From: "Rusty Kaufman" <vnin11uoga@fachia.com.ar>
Reply-To: "Rusty Kaufman" <vnin11uoga@fachia.com.ar>
To: <nschron@midmon.com>, <pshoaf@midmon.com>
Subject: aboveground
Date: Tue, 17 Feb 2004 14:32:24 GMT
X-Mailer: MIME-tools 5.503 (Entity 5.501)
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
mail.model-internet.com
X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63
X-Spam-Level:

Content-Type: text/plain;

Hi Nschron

http://www.checkeraz.info/p1/?id=radforms

I'll keep it simple, your girlfriend likes a bigger c@ck, you want
a bigger c@ock too, now you can have one guaranteed the all natural
safe way without dangerous surgery.

Kind regards,
bigdickpro

PS. Our remedies also stop premature ejaculation immediately
PPS. Girls, you will NOT regret this!

Get me off here:

http://www.checkeraz.info/p1/?id=radforms (follow the link)

Nschron 1 j aegean w wah
rv ndqanhej xdoxzcrlmmpzwuilixrhc lmv
qtr d hpco jyc avlqsizvmxoiojplkc
ihtcblvrfwsejkkkx bhzht t rick ef

Patrick J. Shoaf, Systems Engineer
<mailto:pshoaf@midmon.com>pshoaf@midmon.com

Midmon Internet Services, LLC
100 Third Street
Charleroi, PA 15022
http://www.midmon.com
Phone: 724-483-2400 ext. 105
or 888-638-6963
Fax: 724-489-4386

RE: How to detect this type of message [ In reply to ]

Tom.Meunier at courts

Feb 17, 2004, 11:08 AM

Post #2 of 3 (566 views)

Permalink

1. A well-trained Bayes database.
2. The Tripwire add-on rule set.
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm

Without the headers (which would likely have made it score much higher)
I got

0.1 TW_JY BODY: Odd Letter Triples with JY
0.1 TW_MX BODY: Odd Letter Triples with MX
0.1 TW_PZ BODY: Odd Letter Triples with PZ
0.1 TW_VM BODY: Odd Letter Triples with VM
0.1 TW_VR BODY: Odd Letter Triples with VR
0.1 TW_ZH BODY: Odd Letter Triples with ZH
0.1 TW_ZV BODY: Odd Letter Triples with ZV
2.4 ALL_NATURAL BODY: Spam is 100% natural?!
1.3 IMPOTENCE BODY: Impotence cure
0.1 TW_BH BODY: Odd Letter Triples with BH
0.1 TW_DQ BODY: Odd Letter Triples with DQ
0.1 TW_FW BODY: Odd Letter Triples with FW
0.1 TW_HZ BODY: Odd Letter Triples with HZ
2.1 BAYES_90 BODY: Bayesian spam probability is 90 to 99%
[score: 0.9645]

-----Original Message-----
From: Patrick Shoaf [mailto:pshoaf@midmon.com]
Sent: Tuesday, February 17, 2004 11:27 AM
To: spamassassin-users@incubator.apache.org
Subject: How to detect this type of message

I am new to SpamAssassin and have been watching this list. I received a
message today I would like filtered...it got a score of 0...Can anyone
suggest a filter for this type of email???
----------------EMAIL RECEIVED-----------------------------------------
From: "Rusty Kaufman" <vnin11uoga@fachia.com.ar>
Reply-To: "Rusty Kaufman" <vnin11uoga@fachia.com.ar>

Re: {Spam?} How to detect this type of message [ In reply to ]

martinh at solid-state-logic

Feb 18, 2004, 3:06 AM

Post #3 of 3 (560 views)

Permalink

Patrick Shoaf wrote:
> I am new to SpamAssassin and have been watching this list. I received a
> message today I would like filtered...it got a score of 0...Can anyone
> suggest a filter for this type of email???

Patrick
the chickenpox and tripwire rules triggered a score of 5.4 on my system...

check out SA rules emporiam for the downloads..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************