Re: [Nolug] spamassassin tests

From: Ron Johnson <ron.l.johnson_at_cox.net>
Date: Sat, 01 Nov 2003 20:52:01 -0600
Message-Id: <1067741521.31882.26.camel@haggis.homelan>

On Sat, 2003-11-01 at 19:10, Pietu wrote:
> Hello!
>
> I just installed spamassassin to tag all the mail on my server and then
> wanted to refine some tests but did not find a way to create new tests or
> add "spam words" to the existing tests.
>
> Does anybody have an example how to add tests or spam words to spamassassin
> configuration?
> Especially I'd like to weed out "viacodin" "Sildenafil Citrate" etc... I
> don't know what they are but probably not healthy.

Vicodin in a prescription pain killer, and Sildenafil Citrate is
the chemical name for Viagra.

The SpamAssassin from Debian has caught all (well, most) of such
spams that I've seen. Here's a typical report:
Content analysis details: (10.2 points, 5.0 required)

 pts rule name description
---- ----------------------
--------------------------------------------------
 0.0 TO_ADDRESS_EQ_REAL To: repeats address as real name
 0.7 LOW_PRICE BODY: Lowest Price
 0.0 HTML_MESSAGE BODY: HTML included in message
 1.6 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and
100
                            [cf: 100]
 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
 0.2 HTML_50_60 BODY: Message is 50% to 60% HTML
 1.1 MIME_BASE64_LATIN RAW: Latin alphabet text using base64
encoding
 1.1 MIME_BASE64_TEXT RAW: Message text disguised using base64
encoding
 0.8 BIZ_TLD URI: Contains a URL in the BIZ top-level
domain
 0.9 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
 1.1 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
                          [<http://dsbl.org/listing?ip=80.165.159.153>]
 1.1 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
 1.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

-- 
-----------------------------------------------------------------
Ron Johnson, Jr. ron.l.johnson@cox.net
Jefferson, LA USA
"You can either have software quality or you can have pointer
arithmetic, but you cannot have both at the same time."
Bertrand Meyer
___________________
Nolug mailing list
nolug@nolug.org
Received on 11/01/03

This archive was generated by hypermail 2.2.0 : 12/19/08 EST