Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » SpamAssassin scoring in NST
SpamAssassin scoring in NST [message #512] Tue, 08 November 2005 05:54
iyuvalk
Messages: 26
Registered: December 2004
Junior Member
Hi!

First, I wanted to thank you for doing such a great job blocking so many of our spam e-mails (and there are plenty of those...).

As for my questions:
1. I understood that I can change the default scoring for the tests preformed by the SpamAssassin, so I set them in the user_prefs file and it seems that they're ignored, have I done something wrong? here's my user_prefs file:
# How many points before a mail is considered spam.
# required_score 10.0

#MVS Rules
rawbody SuspiciousSites /growthbuy.com/i
description SuspiciousSites messages that contain references to sites that we found as spam
rawbody NO_LongerBigger /Pleasure your partner every time with a bigger, longer, stronger Unit/i
description NO_LongerBigger matches emails about bigger longer stronger unit
rawbody Peniss_Enhancmeent /Peniss Enhancmeent/i
description Peniss_Enhancmeent matches emails that include the phrase Peniss Enhancmeent

#Disabled
score HTML_FONT_FACE_BAD 0.0
score MIME_8BIT_HEADER 0.0

#MVS Scoring
score SuspiciousSites 100.0
score Peniss_Enhancmeent 9.0
score NO_LongerBigger 9.0
score MALE_ENHANCE 9.0
score URIBL_JP_SURBL 9.0
score URIBL_AB_SURBL 9.0
score URIBL_OB_SURBL 9.0
score URIBL_PH_SURBL 9.0
score URIBL_SBL 9.0
score URIBL_SC_SURBL 9.0
score URIBL_WS_SURBL 9.0
score DNS_FROM_AHBL_RHSBL 5.0
score RCVD_IN_BL_SPAMCOP_NET 5.0
score DRUGS_ERECTILE 5.0
score DRUGS_ERECTILE_OBFU 5.0
score IMPOTENCE 5.0
score HTML_FONT_INVISIBLE 5.0
score SUBJECT_DRUG_GAP_C 3.5
score SUBJECT_DRUG_GAP_L 3.5
score SUBJECT_DRUG_GAP_P 3.5
score SUBJECT_DRUG_GAP_S 3.5
score SUBJECT_DRUG_GAP_VA 3.5
score SUBJECT_DRUG_GAP_VIA 3.5
score SUBJECT_DRUG_GAP_VIC 3.5
score SUBJECT_DRUG_GAP_X 3.5
score RCVD_IN_MAPS_RBL 3.0
score J_CHICKENPOX_93 2.0
score J_CHICKENPOX_71 2.0
score J_CHICKENPOX_63 2.0
score J_CHICKENPOX_42 2.0
score RCVD_IN_MAPS_RSS 2.0
score RCVD_IN_MAPS_NML 2.0
score RCVD_IN_MAPS_OPS 2.0
score BAYES_99 2.0
score BAYES_95 1.5
score BAYES_80 1.5
score J_CHICKENPOX_23 1.5
score J_CHICKENPOX_22 1.0
score RCVD_IN_MAPS_DUL 1.0
score BAYES_60 1.0
score BAYES_50 1.0
score MIME_8BIT_HEADER 0.0
score UNWANTED_LANGUAGE_BODY 0.5
score MIME_BASE64_NO_NAME 0.5
score BAYES_40 0.5
score BAYES_20 0.5
score MIME_BASE64_TEXT 0.5
score BAYES_05 0.2
score HTML_TEXT_AFTER_BODY 0.2
score BAYES_00 -1.0

And another thing, lately I'm receiving spam emails that manage to pass the NST by using HTML table in which the spam words (like Viagra, Cialis etc.) are split into cells, one above the other and by using fixed size font they make it look like it's in the same row, like this:











A V V C P X m I A I r a b A L A o n i G I L z a e R U I a x n A M S c  
 
$69,95 $85,45 $99,95  
 


Is there a way I can block them too?

Thanks,
Yuval.
Re: SpamAssassin scoring in NST [message #513 is a reply to message #512] Tue, 08 November 2005 12:01 Go to previous message
support
Messages: 918
Registered: April 2004
Senior Member
> As for my questions:
> 1. I understood that I can change the default scoring for the
> tests preformed by the SpamAssassin, so I set them in the
> user_prefs file and it seems that they're ignored, have I done
> something wrong? here's my user_prefs file:

The user_prefs file is ignored indeed. Site-wide changes (such as yours) can go into the local.cf file.

> And another thing, lately I'm receiving spam emails that manage
> to pass the NST by using HTML table in which the spam words
> (like Viagra, Cialis etc.) are split into cells, one above the
> other and by using fixed size font they make it look like it's
> in the same row, like this:

[...]

> Is there a way I can block them too?

Here the drug names read downwards instead of left to right. It took some time for me to recognize this, and I think most receivers of spam mails like this will have trouble, too. Spammers will (hopefully) soon learn that these type of spam mail is ineffective and discontinue it.

Other than that, Bayes filtering might help in these cases.



Customer Support
Byteplant GmbH
Previous Topic: No Malaysia mail
Next Topic: SpamAssassin scoring in NST
Goto Forum:
  


Current Time: Tue Sep 27 07:18:36 CEST 2016