Web Hosting Forum | Lunarpages


*
Welcome, Guest. Please login or register.
Did you miss your activation email?


Login with username, password and session length
May 22, 2012, 05:57:16 AM

Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Drowning in spam  (Read 433 times)
kwdavids
Galactic Royalty
*****
Offline Offline

Posts: 324



WWW
« on: February 02, 2004, 06:44:49 AM »
I had over 150 spams this morning, part of a long-time upward trend. These are above and beyond the thousands that Spam Assassin is catching.

Spam Assassin scores for these spams are running in the 3.0 - 4.0 range and I'm hesitant to set the Spam Assassin hit count that low.

I use a Bayesian spam filter on my desktop and that gets maybe 2/3 of the spams, but filtered spam still has to be looked at.

Changing email addresses is not an option.

Looking for ideas... Sad
Logged
Kevin
Ed
Berserker Poster
*****
Offline Offline

Posts: 5208



WWW
« Reply #1 on: February 02, 2004, 07:58:35 AM »
I dunno.. the new method they are using now is to use a genuine message from a genuine server, and include an image with the ad in it.

The only way to kill that would be to assign a higher score to HTML mail. This could be deadly if you receive alot of HTML mail though.

Maybe set up filters that look for image tags specifically in HTML mail?

- Ed
Logged
Kata
--
Ed's Blog
Pain Free Learning - Internet marketing lessons from others mistakes
Joke A Whenever
Ed Loveless Dot Com
Got A Blog? List it on The Blog Resource
Custom PHP Programming and design

Lunarpages Web Hosting

Lunarpages Forums

Lunarpages Affiliate Program
kwdavids
Galactic Royalty
*****
Offline Offline

Posts: 324



WWW
« Reply #2 on: February 02, 2004, 08:41:07 AM »
Here's an example of the many I get without any images at all:

Code:

...
X-Spam-Status: No, hits=3.1 required=5.8 tests=DATE_IN_PAST_06_12,HTML_40_50,
HTML_FONTCOLOR_UNSAFE,HTML_FONT_BIG,HTML_MESSAGE,
HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY autolearn=no version=2.60
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
orion.lunarpages.com

<font color=#fefefe>denizen nouns kneeling diffusers Slovenia</font><br>
Did you know ... That the normal cost for V1@</hghg>GRA <BR>is $20, per dose?
<font color=#fefefe>infants slows Kronecker reopened prophecy</font><br>
We are running a hot special!! TODAY Its only an amazing $1.66<P>Shipped world wide!<P>
<font size=+3>
<a hrefloggedhref=http://downstream.com href=

http://www.onlinemanufacturer.com/discounts/index.php?pid=evaph3770>DISC0UNT 0RDER</a><P>

<font color=#fefefe>sewed implore tiling artichoke braided</font>
<font color=#fefefe>vagrant tutors annunciate Hubert blueberry</font>
<font color=#fefefe>gagged fiction Boers inscribed droops</font>
<P><font size=-2><a hrefriseshref=http://truant.com href=

http://www.onlinemanufacturer.com/discounts/applepie.php>o p t - o u t</a>



The problem is that one size doesn't fit all. This one, for example, has the HTML_FONTCOLOR_UNSAFE tag. No legitimate email I have a record of has this tag, but only one spam does. I do get a fair amount of legitimate HTML email.
Logged
Kevin
Ed
Berserker Poster
*****
Offline Offline

Posts: 5208



WWW
« Reply #3 on: February 02, 2004, 08:45:37 AM »
HTML_MIME_NO_HTML_TAG <- This one might help - if the message is legit HTML message it should have a <HTML> tags around it to signifiy so. If you somehow increased the weight of that tag it might help.

- Ed
Logged
Kata
--
Ed's Blog
Pain Free Learning - Internet marketing lessons from others mistakes
Joke A Whenever
Ed Loveless Dot Com
Got A Blog? List it on The Blog Resource
Custom PHP Programming and design

Lunarpages Web Hosting

Lunarpages Forums

Lunarpages Affiliate Program
jojooboo
Jabba the Hutt
*****
Offline Offline

Posts: 717



WWW
« Reply #4 on: February 02, 2004, 08:46:21 AM »
One thing I've found effective is setting the score to 5.0 for all of the "date in past" triggers (like DATE_IN_PAST_06_12).  I've never had a legitimate piece of email caught mistakenly.
Logged
http://www.fflschedules.com
http://www.ffllinks.com
http://www.fflforums.com
http://www.bffl.com
kwdavids
Galactic Royalty
*****
Offline Offline

Posts: 324



WWW
« Reply #5 on: February 02, 2004, 12:16:55 PM »
Quote from: jojooboo
One thing I've found effective is setting the score to 5.0 for all of the "date in past" triggers (like DATE_IN_PAST_06_12).  I've never had a legitimate piece of email caught mistakenly.


I went through my inbox and found 3 DATE_IN_PAST emails that were not spam. Future/past filters bother me because of the possibility of inaccurate timezone conversions or other setting errors.
Logged
Kevin
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to: