1/21 spamassassin is failing to tag messages like the following:
"Genierc and Sepur Viarga (Caiils) available oinlne!
Most trusted online source!
Cilais or (Spuer Vagira)
takes afecft right away & lasts 24-36 huors!
FOR SUEPR VAIRGA TOCUH HERE
Genierc Virgaa
costs 60% less! save a lot of $.
FOR VIGARA TOCUH HERE"
What are some ways to deal with this? I've tried blacklisting but
it's getting futile because they keep changing their address. Thanks,
-desperately failing
\_ check the headers of some of these messages for the Habeas header.
there is a viagra spammer abusing the header right now. SA honors
the header and deducts ~8 points. If this is true, disable habeas.
\_ It's not using habeas, it's just not scoring high.
X-Spam-Status: No, hits=x.x required=5.0 tests=HTML_20_30,HTML_MESSAGE
\_ retrain
\_ no, because at the end of these mails they put random
common valid words and training would increase the
chance of false positive making spamassassin less powerful.
If I'm not wrong, spammers are getting smarter and smarter
and as long as we have to worry about these things, they're
winning the war
\_ Nuke the site from orbit. Its the only way to be sure.
\_ I have the same spams and use SA too and I've noticed that while the
spellings change, 'TOCUH HERE' stays the same.
\_ Until it doesn't...
\_ sounds like some kind of typo count would be very good at spam ID
\_ I used motdedit and you overwrote my post. Bad sodan!
\_ I used me, too. you got the wrong guy. The guy who overwrote
your post posted this: "is that what he really did? And ..."
\_ But then drunk people can't send email!
\_ I hate spam but occasionally I get one that totally cracks me up and
that almost makes the rest worthwhile. Anyone else enjoy the
'white trash sluts' spam a little too much? |