Mailing List Archive: 419 Mania

419 Mania

Feb 5, 2004, 2:53 AM

Post #1 of 5 (1369 views)

Hi All,

Is it just me or has the last day or so been 419 mania? I have seen so much
Nigerian garbage that I'm going crazy trying to cut rules to block them all!

Bayes training doesn't seem to help much if at all, so it looks like I'm
resorting to either having to write my own or beg for help from you guys!!

Has anyone got any killer 419 rules? I'm beginning to write some very large
meta rulesets which I'm sure will help, but gee these just keep coming!

Does anyone have a big 419 corpus?

Any and all help greatly appreciated - I think I can feel a Chris Santerre
style Nigerian ruleset coming...

Regards,

David Hooton

========================================================================
Pain free spam & virus protection by: www.mailsecurity.net.au
Forward undetected SPAM to: spam@mailsecurity.net.au
========================================================================

RE: 419 Mania [ In reply to ]

bret.miller at wcg

Feb 5, 2004, 11:33 AM

Post #2 of 5 (1344 views)

Permalink

> Is it just me or has the last day or so been 419 mania? I
> have seen so much Nigerian garbage that I'm going crazy
> trying to cut rules to block them all!
>
> Bayes training doesn't seem to help much if at all, so it
> looks like I'm resorting to either having to write my own or
> beg for help from you guys!!
>
> Has anyone got any killer 419 rules? I'm beginning to write
> some very large meta rulesets which I'm sure will help, but
> gee these just keep coming!
>
> Does anyone have a big 419 corpus?
>
> Any and all help greatly appreciated - I think I can feel a
> Chris Santerre style Nigerian ruleset coming...

Tons of Nigerian garbage, but not a single one made it to my inbox, and
none of my users has complained of it. I seem to get adequate coverage
here with SA 2.63's base set. For example, the one I checked scored over
19 with the following:

BAYES_99=6,FORGED_JUNO_RCVD=2.058,J_CHICKENPOX_31=0.6,
J_CHICKENPOX_72=0.6,J_CHICKENPOX_84=0.6,J_CHICKENPOX_91=0.6,
NIGERIAN_BODY1=2.018,NIGERIAN_BODY2=0.7,NIGERIAN_BODY3=0.738,
NIGERIAN_BODY4=0.701,NIGERIAN_SUBJECT1=2.599,NO_REAL_NAME=0.16,
OPPORTUNITY=2.055,UPPERCASE_75_100=0

RE: 419 Mania [ In reply to ]

simon at igrin

Feb 5, 2004, 1:53 PM

Post #3 of 5 (1339 views)

Permalink

>> Is it just me or has the last day or so been 419 mania? I
>> have seen so much Nigerian garbage that I'm going crazy
>> trying to cut rules to block them all!
>>
>> Bayes training doesn't seem to help much if at all, so it
>> looks like I'm resorting to either having to write my own or
>> beg for help from you guys!!
>>
>> Has anyone got any killer 419 rules? I'm beginning to write
>> some very large meta rulesets which I'm sure will help, but
>> gee these just keep coming!
>>
>> Does anyone have a big 419 corpus?
>>
>> Any and all help greatly appreciated - I think I can feel a
>> Chris Santerre style Nigerian ruleset coming...
>
> Tons of Nigerian garbage, but not a single one made it to my inbox, and
> none of my users has complained of it. I seem to get adequate coverage
> here with SA 2.63's base set. For example, the one I checked scored over
> 19 with the following:
>
> BAYES_99=6,FORGED_JUNO_RCVD=2.058,J_CHICKENPOX_31=0.6,
> J_CHICKENPOX_72=0.6,J_CHICKENPOX_84=0.6,J_CHICKENPOX_91=0.6,
> NIGERIAN_BODY1=2.018,NIGERIAN_BODY2=0.7,NIGERIAN_BODY3=0.738,
> NIGERIAN_BODY4=0.701,NIGERIAN_SUBJECT1=2.599,NO_REAL_NAME=0.16,
> OPPORTUNITY=2.055,UPPERCASE_75_100=0

Err, unless I'm mistaken, the base install of SA doesn't have any rules
like J_CHICKENPOX_72 ;-)

Also the default score for BAYES_99 is only 5.4, so you have a
significantly tweaked system.

I for one still see occasional 419 spams getting through, but not enough
to annoy me....

Regards,
Simon

RE: 419 Mania [ In reply to ]

bret.miller at wcg

Feb 5, 2004, 2:04 PM

Post #4 of 5 (1330 views)

Permalink

> > Tons of Nigerian garbage, but not a single one made it to my inbox,
> > and none of my users has complained of it. I seem to get adequate
> > coverage here with SA 2.63's base set. For example, the one
> I checked
> > scored over 19 with the following:
> >
> > BAYES_99=6,FORGED_JUNO_RCVD=2.058,J_CHICKENPOX_31=0.6,
> > J_CHICKENPOX_72=0.6,J_CHICKENPOX_84=0.6,J_CHICKENPOX_91=0.6,
> > NIGERIAN_BODY1=2.018,NIGERIAN_BODY2=0.7,NIGERIAN_BODY3=0.738,
> > NIGERIAN_BODY4=0.701,NIGERIAN_SUBJECT1=2.599,NO_REAL_NAME=0.16,
> > OPPORTUNITY=2.055,UPPERCASE_75_100=0
>
> Err, unless I'm mistaken, the base install of SA doesn't have
> any rules like J_CHICKENPOX_72 ;-)

This is true.

> Also the default score for BAYES_99 is only 5.4, so you have
> a significantly tweaked system.

Of course, I do. Don't most? However, I stop spam scored at 8 or higher,
so I had to tweak some things. If you use the default install, it gets
flagged spam at 5, which means a simple bayes_99 is enough to make it
spam. Combine that with Nigerian_body1, subject1 and opportunity and
you're way high on the score, tweaked or not.

I'm not saying it'll stop all of them, but it should get a decent
percentage.

Bret

RE: 419 Mania [ In reply to ]

csanterre at MerchantsOverseas

Feb 6, 2004, 9:32 AM

Post #5 of 5 (1332 views)

Permalink

> -----Original Message-----
> From: Bret Miller [mailto:bret.miller@wcg.org]
> Sent: Thursday, February 05, 2004 4:05 PM
> To: spamassassin-users@incubator.apache.org
> Subject: RE: 419 Mania
>
>
> > > Tons of Nigerian garbage, but not a single one made it to
> my inbox,
> > > and none of my users has complained of it. I seem to get adequate
> > > coverage here with SA 2.63's base set. For example, the one
> > I checked
> > > scored over 19 with the following:
> > >
> > > BAYES_99=6,FORGED_JUNO_RCVD=2.058,J_CHICKENPOX_31=0.6,
> > > J_CHICKENPOX_72=0.6,J_CHICKENPOX_84=0.6,J_CHICKENPOX_91=0.6,
> > > NIGERIAN_BODY1=2.018,NIGERIAN_BODY2=0.7,NIGERIAN_BODY3=0.738,
> > > NIGERIAN_BODY4=0.701,NIGERIAN_SUBJECT1=2.599,NO_REAL_NAME=0.16,
> > > OPPORTUNITY=2.055,UPPERCASE_75_100=0
> >
> > Err, unless I'm mistaken, the base install of SA doesn't have
> > any rules like J_CHICKENPOX_72 ;-)
>
> This is true.
>
> > Also the default score for BAYES_99 is only 5.4, so you have
> > a significantly tweaked system.
>
> Of course, I do. Don't most? However, I stop spam scored at 8
> or higher,
> so I had to tweak some things. If you use the default install, it gets
> flagged spam at 5, which means a simple bayes_99 is enough to make it
> spam. Combine that with Nigerian_body1, subject1 and opportunity and
> you're way high on the score, tweaked or not.
>
> I'm not saying it'll stop all of them, but it should get a decent
> percentage.
>
> Bret
>

I haven't had a 419 slip thru in AGES!!! I'll be working on a 419.cf file
this weekend. :)

--Chris