Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. SpamAssassin>
  3. users
New one that's slipping through
ajezierski at stepan
Feb 18, 2004, 11:55 AM
Post #1 of 7 (1221 views)
Permalink
I've noticed quite a few of these that are slipping through. It only
contains a gif and it only scores either 1.861 or 1.961. Any ideas on how
to catch these types that are only gif's.

Thanks
Andy


"not spam, SpamAssassin (score=1.861, required 7.5,
HTML_60_70 0.10,
HTML_IMAGE_ONLY_02 1.50,
HTML_MESSAGE 0.00,
HTML_TAG_BALANCE_BODY 0.26,
RM_rb_ANCHOR 0.00,
RM_rb_BODY 0.00,
RM_rb_HTML 0.00)"
"
------=_NextPart_000_04B4_D9D4D8C4.9140F91A
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
charset="us-ascii"

<html><body>
<center><!--yse1eAkvguERrya--><a href="http://www.dfruddd.com/ghr/"><img
src="http://www.ccvpayodd.com/g9.gif" border=0></a></center>
<body></html>

"


"not spam, SpamAssassin (score=1.961, required 7.5,
HTML_60_70 0.10,
HTML_IMAGE_ONLY_02 1.50,
HTML_MESSAGE 0.00,
HTML_TAG_BALANCE_BODY 0.26,
RM_rb_ANCHOR 0.00,
RM_rb_BODY 0.00,
RM_rb_HTML 0.00,
RM_sl_Parens 0.10)"
"
------=_NextPart_000_0CE6_A3D9D3B8.043D9DD1
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
charset="us-ascii"

<html><body>
<center><!--rwhsoMlzePZw9d3--><a href="http://www.everyedes.com/ghr/"><img
src="http://www.ottsys.com/g9.gif" border=0></a></center>
<body></html>

"
RE: New one that's slipping through [ In reply to ]
csanterre at MerchantsOverseas
Feb 18, 2004, 12:56 PM
Post #2 of 7 (1203 views)
Permalink
IT's my monthly posting of MRWIGGLY :-)

rawbody __VDRUG1 /^\<html\>\<body\>/
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a href\=\"http\:\/\//
rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
describe MRWIGGLY Mr. Wiggly enhance drug spam.
score MRWIGGLY 1.0

Not a single FP ever. EVER!!!! (I need a vaca)

--Chris


-----Original Message-----
From: ajezierski@stepan.com [mailto:ajezierski@stepan.com]
Sent: Wednesday, February 18, 2004 1:55 PM
To: spamassassin-users@incubator.apache.org
Subject: New one that's slipping through



I've noticed quite a few of these that are slipping through. It only
contains a gif and it only scores either 1.861 or 1.961. Any ideas on how
to catch these types that are only gif's.

Thanks
Andy


"not spam, SpamAssassin (score=1.861, required 7.5,
HTML_60_70 0.10,
HTML_IMAGE_ONLY_02 1.50,
HTML_MESSAGE 0.00,
HTML_TAG_BALANCE_BODY 0.26,
RM_rb_ANCHOR 0.00,
RM_rb_BODY 0.00,
RM_rb_HTML 0.00)"
"
------=_NextPart_000_04B4_D9D4D8C4.9140F91A
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
charset="us-ascii"

<html><body>
<center><!--yse1eAkvguERrya--><a href="http://www.dfruddd.com/ghr/"><img
src="http://www.ccvpayodd.com/g9.gif" border=0></a></center>
<body></html>

"


"not spam, SpamAssassin (score=1.961, required 7.5,
HTML_60_70 0.10,
HTML_IMAGE_ONLY_02 1.50,
HTML_MESSAGE 0.00,
HTML_TAG_BALANCE_BODY 0.26,
RM_rb_ANCHOR 0.00,
RM_rb_BODY 0.00,
RM_rb_HTML 0.00,
RM_sl_Parens 0.10)"
"
------=_NextPart_000_0CE6_A3D9D3B8.043D9DD1
Content-Transfer-Encoding: 8bit
Content-Type: text/html;
charset="us-ascii"

<html><body>
<center><!--rwhsoMlzePZw9d3--><a href="http://www.everyedes.com/ghr/"><img
src="http://www.ottsys.com/g9.gif" border=0></a></center>
<body></html>

"
Re: New one that's slipping through [ In reply to ]
lists at pmbx
Feb 18, 2004, 1:02 PM
Post #3 of 7 (1202 views)
Permalink
This is unchanged from the previous ruleset for Mr. Wiggly, correct?

On Feb 18, 2004, at 2:56 PM, Chris Santerre wrote:

>
>  
> rawbody __VDRUG1 /^\<html\>\<body\>/
> rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a
> href\=\"http\:\/\//
> rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
> rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
> meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
> describe MRWIGGLY Mr. Wiggly enhance drug spam.
> score MRWIGGLY 1.0
>  
> Not a single FP ever. EVER!!!!  (I need a vaca)
>  
> --Chris

Kindest regards,

Ron

"What shall we do? What shall we do?" he cried, "Escaping goblins to be
caught by wolves!" - Bilbo Baggins

The Hobbit by J. R. R. Tolkein
http://www.apple.com/trailers/newline/returnoftheking/trailer_large.html
RE: New one that's slipping through [ In reply to ]
csanterre at MerchantsOverseas
Feb 18, 2004, 1:19 PM
Post #4 of 7 (1198 views)
Permalink
rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a

used to read

rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,15}\-\-\>\<a

just upped from 15 to 25. That is the only change I ever made.

> -----Original Message-----
> From: codger [mailto:lists@pmbx.net]
> Sent: Wednesday, February 18, 2004 3:02 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Re: New one that's slipping through
>
>
> This is unchanged from the previous ruleset for Mr. Wiggly, correct?
>
> On Feb 18, 2004, at 2:56 PM, Chris Santerre wrote:
>
> >
> >  
> > rawbody __VDRUG1 /^\<html\>\<body\>/
> > rawbody __VDRUG2 /^\<center\>\<\!\-\-.{10,25}\-\-\>\<a
> > href\=\"http\:\/\//
> > rawbody __VDRUG3 /[a-zA-Z]\d\.gif\" border\=0\>\<\/a\>\<\/center\>/
> > rawbody __VDRUG4 /^\<\/?body\>\<\/html\>/
> > meta MRWIGGLY (__VDRUG1 && __VDRUG2 && __VDRUG3 && __VDRUG4)
> > describe MRWIGGLY Mr. Wiggly enhance drug spam.
> > score MRWIGGLY 1.0
> >  
> > Not a single FP ever. EVER!!!!  (I need a vaca)
> >  
> > --Chris
>
> Kindest regards,
>
> Ron
>
> "What shall we do? What shall we do?" he cried, "Escaping
> goblins to be
> caught by wolves!" - Bilbo Baggins
>
> The Hobbit by J. R. R. Tolkein
> http://www.apple.com/trailers/newline/returnoftheking/trailer_
large.html
Re: New one that's slipping through [ In reply to ]
steven at mrchuckles
Feb 18, 2004, 5:16 PM
Post #5 of 7 (1199 views)
Permalink
On Wednesday 18 February 2004 02:56 pm, Chris Santerre wrote:
> IT's my monthly posting of MRWIGGLY :-)

Out of curiosity, where did the name MRWIGGLY come from?

Steven
--
Steven Dickenson <steven@mrchuckles.net>
http://www.mrchuckles.net
RE: New one that's slipping through [ In reply to ]
csanterre at MerchantsOverseas
Feb 19, 2004, 7:30 AM
Post #6 of 7 (1202 views)
Permalink
> -----Original Message-----
> From: Steven Dickenson [mailto:steven@mrchuckles.net]
> Sent: Wednesday, February 18, 2004 7:16 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Re: New one that's slipping through
>
>
> On Wednesday 18 February 2004 02:56 pm, Chris Santerre wrote:
> > IT's my monthly posting of MRWIGGLY :-)
>
> Out of curiosity, where did the name MRWIGGLY come from?
>

Well the main target of this rule has always been the George Bush looking
Doctor, Penis enlargment spam that never changes. I figured calling it
MrWiggly was a little more politically correct then calling it Mr
TrouserMouse, Trick McDicky, or Professor Humpandstuff.

--Chris (For ther rest of the day I shall be known as Ginger Lynn.)
Re: New one that's slipping through [ In reply to ]
gcirino at cirelle
Feb 19, 2004, 7:31 AM
Post #7 of 7 (1203 views)
Permalink
Hey Ginger
PR HumpandStuff is good :)

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal