Spam

[Pagemakers]

Does anyone have a spam rule set for all those emails that contain just letters and not words, but when they are placed together they form words (badly explained I know).

See below: The first is the email and the one below it is the source code behinds the email. We use Spam Guardian and even its learning facilities do not stops these emails:

Email:

v C y I q A h L t I l S
l V p A f L v I w U h M
f V h I p A d G l R z A

Bu ah y your d M m e n d h i d c c a m t t i h o i n on fm line at half p p p r d i h c s e http://www.papasani.com


Source:


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN style="
float
:right
"> v </SPAN>C<SPAN style="
float
:right
"> y </SPAN>I<SPAN style="
float
:right
"> q </SPAN>A<SPAN style="
float
:right
"> h </SPAN>L<SPAN style="
float
:right
"> t </SPAN>I<SPAN style="
float
:right
"> l </SPAN>S</FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN style="
float
:right
"> l </SPAN>V<SPAN style="
float
:right
"> p </SPAN>A<SPAN style="
float
:right
"> f </SPAN>L<SPAN style="
float
:right
"> v </SPAN>I<SPAN style="
float
:right
"> w </SPAN>U<SPAN style="
float
:right
"> h </SPAN>M</FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN style="
float
:right
"> f </SPAN>V<SPAN style="
float
:right
"> h </SPAN>I<SPAN style="
float
:right
"> p </SPAN>A<SPAN style="
float
:right
"> d </SPAN>G<SPAN style="
float
:right
"> l </SPAN>R<SPAN style="
float
:right
"> z </SPAN>A</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Bu<SPAN style="
float
:right
"> ah </SPAN>y your <SPAN style="
float
:right
"> d </SPAN>M<SPAN style="
float
:right
"> m </SPAN>e<SPAN style="
float
:right
"> n </SPAN>d<SPAN style="
float
:right
"> h </SPAN>i<SPAN style="
float
:right
"> d </SPAN>c<SPAN style="
float
:right
"> c </SPAN>a<SPAN style="
float
:right
"> m </SPAN>t<SPAN style="
float
:right
"> t </SPAN>i<SPAN style="
float
:right
"> h </SPAN>o<SPAN style="
float
:right
"> i </SPAN>n on<SPAN style="
float
:right
"> fm </SPAN>line at half <SPAN style="
float
:right
"> p </SPAN>p<SPAN style="
float
:right
"> p </SPAN>r<SPAN style="
float
:right
"> d </SPAN>i<SPAN style="
float
:right
"> h </SPAN>c<SPAN style="
float
:right
"> s </SPAN>e <A href="http://www.papasani.com"><FONT face=Arial size=2>http://www.papasani.com</FONT></A></FONT></DIV></BODY></HTML>

 

[eilko]

turn on the network checks (SORB/etc), they will help you to mark messages like this as spam

 

[Pagemakers]

Originally posted by eilko
turn on the network checks (SORB/etc), they will help you to mark messages like this as spam

Not sure I understand.

If you mean 'Enable MAPS spam protection' I have it set to bl.spamcop.net

 

[eilko]

you can add/enable serveral test in spamassassin. For instance dcc, razor2 or the RBL-checks.

Check the http://spamassassin.apache.org site howto enable these checks and improve the use of spamassassin.

 

[Pagemakers]

Thanks.

This page http://spamassassin.apache.org/tests_3_1_x.html talks about the .spamassassin/user_prefs folder.

Where is the user_prefs folder. I don't appear to have it.

EDIT: Is it this: /usr/share/spamassassin/user_prefs_template

I guess to enable it globally I copy it and rename it to user_prefs and add it to /etc/mail/spamassassin as detailed at the top of the file itself.

 

[Pagemakers]

Blimey - there are so many rules I am not sure why one to increase. Any ideas based on the email above?

 

[eilko]

install DCC
see http://wiki.apache.org/spamassassin/UsingDcc
files at ART
http://3es.atomicrocketturtle.com/atomic/art/3/RPMS/dcc-1.3.5-1.rhfc3.art.i386.rpm

install Pyzor
see http://wiki.apache.org/spamassassin/UsingPyzor
files at ART
http://3es.atomicrocketturtle.com/atomic/art/3/RPMS/pyzor-0.4.0-5.rhfc3.art.noarch.rpm[

install Razor2
see http://wiki.apache.org/spamassassin/UsingRazor
files at ART
http://3es.atomicrocketturtle.com/atomic/art/3/RPMS/razor-agents-2.77-1.rhfc3.art.i386.rpm

use the RBLs:
http://wiki.apache.org/spamassassin/DnsBlocklists

finally add some custom rulesets:
see: http://www.rulesemporium.com/rules.htm
(Spamguardian has already RulesDuJour installed)

you can find the serverwide settings at:
/etc/mail/spamassassin/local.cf

 

[Highland]

I have also found that Thunderbird can further enhance spam detection since it reads the Spamassassin headers.

I'd also install the qmail-scanner from ART's yum repository. Just be sure to stop spamassassin first.
You can read more about it here
http://www.atomicrocketturtle.com/m...ns&file=index&req=viewarticle&artid=15&page=1