Spam Filter ISP Forums : HTML Spam Email How to stop this?

HTML Spam Email How to stop this? : Glad to hear it.My bayesian setup...

Tue, 29 Aug 2006 17:01:16 +0000

Author: sgeorge
Subject: 5758
Posted: 29 August 2006 at 5:01pm

Glad to hear it.

My bayesian setup is a bit radical - I set it to 62%. I only do this because...

I check my quarantine regularly... releasing false positives and tightening filtering rules - this should help to keep by bayesian corpus database strong
I rarely get bayesian results that range between 15% - 85%
The bayesian filter treats me well - I've only had a single time that this filter made a false-positive

...just fyi, of the spam I catch from bayesian, the majority of it scores +90%. I don't expect that I would fail to catch any more than 5 spam messages if I were to bump by bayesian threshold from 62% up to 85%, so the low value doesn't necessarily give me a huge advantage.

Stephen

HTML Spam Email How to stop this? : Thanks for all the help, the keyword...

Tue, 29 Aug 2006 16:25:51 +0000

Author: tcrawford
Subject: 5758
Posted: 29 August 2006 at 4:25pm

Thanks for all the help, the keyword that you pm'd me worked great. I have one more question what percent do most of you set the Bayesian Filter Threshold at?

thanks a ton

HTML Spam Email How to stop this? : Here is a better sample of the...

Thu, 24 Aug 2006 11:02:33 +0000

Author: tcrawford
Subject: 5758
Posted: 24 August 2006 at 11:02am

Here is a better sample of the message

-----Original Message-----
From: Alfred Mata [mailto:nkr@carolwhite.com]=20
Sent: Tuesday, August 22, 2006 4:50 PM
To: user
Subject: crosstown organization

Orlandos day was passed, it would seem, somewhat in this fashion.
Ladies headdresses AT LEAST six foot high.
The elders, however, who had seen more of foreigners thanthey had,
became suspicious. Perhaps itwould be well to begin the speech all over
again.
MrPeregrine said I looked QUITE lovely which I only repeat to you,
mydearest, because I know.
Again the trumpets peal forth:Modesty Avaunt! We may take advantage of
this pause in the narrative to make certainstatements.
In the firstroom, it was permissible only to mention the weather.
Trees were withered hags,and sheep were grey boulders. There, in the
shadow of a giant fig tree, waited an oldgipsy on a donkey. For, no
sooner had the Ambassador despatched one such visit,than another had to
be undertaken.
To one hundred and two mats, each thirty yards long. There were no
hedges for ferns to grow on, and no fields forsheep to graze. The
envious said thatthis was Nell Gwyns tribute to the memory of a leg.
Ravishing, she exclaims ten times on one page, wondrous. Now, she
perched, top heavyupon a fire screen.
We should not haveblamed her had she rung the bell, screamed, or
fainted.
He stood upright in complete nakednessbefore us, and while the trumpets
pealed Truth! He now set to work in earnest, as we can prove beyond a
doubt if we lookat his ledgers. For, no sooner had the Ambassador
despatched one such visit,than another had to be undertaken.
The gipsies followed thegrass; when it was grazed down, on they moved
again.
She climbed the mountains; roamed the valleys; sat onthe banks of the
streams.
Nohuman being, since the world began, has ever looked more ravishing.=20

------_=_NextPart_002_01C6C6B9.13ED046C
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

Message
charset=3Dus-ascii">

align=3Dleft>size=3D2>-----Original Message-----
From: Alfred Mata=20
[mailto:nkr@carolwhite.com]
Sent: Tuesday, August 22, 2006 =
4:50=20
PM
To: Donna McKenna
Subject: crosstown=20
organization

src=3D"cid:001101c6c62d$d97e5140$226d0246@xhs.syqd" align=3Dbaseline=20
border=3D0>

Orlandos day was passed, it would seem, =
somewhat in=20
this fashion.

Ladies headdresses AT LEAST six foot=20
high.

The elders, however, who had seen more =
of=20
foreigners thanthey had, became suspicious. Perhaps itwould be well to =
begin the=20
speech all over again.

MrPeregrine said I looked QUITE lovely =
which I only=20
repeat to you, mydearest, because I know.

Again the trumpets peal forth:Modesty =
Avaunt! We=20
may take advantage of this pause in the narrative to make=20
certainstatements.

In the firstroom, it was permissible =
only to=20
mention the weather.

Trees were withered hags,and sheep were =
grey=20
boulders. There, in the shadow of a giant fig tree, waited an oldgipsy =
on a=20
donkey. For, no sooner had the Ambassador despatched one such visit,than =
another=20
had to be undertaken.

To one hundred and two mats, each =
thirty yards=20
long. There were no hedges for ferns to grow on, and no fields forsheep =
to=20
graze. The envious said thatthis was Nell Gwyns tribute to the memory of =
a=20
leg.

Ravishing, she exclaims ten times on =
one page,=20
wondrous. Now, she perched, top heavyupon a fire screen.

We should not haveblamed her had she =
rung the bell,=20
screamed, or fainted.

He stood upright in complete =
nakednessbefore us,=20
and while the trumpets pealed Truth! He now set to work in earnest, as =
we can=20
prove beyond a doubt if we lookat his ledgers. For, no sooner had the =
Ambassador=20
despatched one such visit,than another had to be =
undertaken.

The gipsies followed thegrass; when it =
was grazed=20
down, on they moved again.

She climbed the mountains; roamed the =
valleys; sat=20
onthe banks of the streams.

Nohuman being, since the world began, =
has ever=20
looked more ravishing.

------_=_NextPart_002_01C6C6B9.13ED046C--

------_=_NextPart_001_01C6C6B9.13ED046C
Content-Type: image/gif;
name="forlorn.gif"
Content-Transfer-Encoding: base64
Content-ID: <001101c6c62d$d97e5140$226d0246@xhs.syqd>
Content-Description: forlorn.gif
Content-Location: 1_multipart%3F2_forlorn.gif

HTML Spam Email How to stop this? : sgeorge wrote:Hi tcrawford,I...

Wed, 23 Aug 2006 15:24:12 +0000

Author: tcrawford
Subject: 5758
Posted: 23 August 2006 at 3:24pm

sgeorge wrote:

Hi tcrawford,

I also pm'd a keyword to you that I use to stop lot of this stuff for me. I hope it helps.

Stephen

Thanks a ton!!!

HTML Spam Email How to stop this? : Hi tcrawford,I also pm'd...

Wed, 23 Aug 2006 14:50:43 +0000

Author: sgeorge
Subject: 5758
Posted: 23 August 2006 at 2:50pm

Hi tcrawford,

I also pm'd a keyword to you that I use to stop lot of this stuff for me. I hope it helps.

Stephen

HTML Spam Email How to stop this? : LogSat wrote:There are a few...

Tue, 22 Aug 2006 10:32:19 +0000

Author: tcrawford
Subject: 5758
Posted: 22 August 2006 at 10:32am

LogSat wrote:

There are a few problems with this ... problem.

As sgeorge correctly identified, there's an error in one of your keywords regular expressions:(]*>).*){8})
There are two "(" and three ")", so the parenthesis are mistamtched, causing an error in the RegEx lookups, as looged in SpamFilter:
08/02/06 20:58:41:376 -- (45788) String matching error for
The source code you posted appears to have been extracted from Microsoft Outlook by doing a "view source" from the email client. Unfortunately Microsoft *completely* changes the real source of the email. What you are seing is not even close to what the real email's source is . You should use other email clients, like Eudora, Mozilla Thunderbird, Netscape, or even Microsoft Outlook Express, as they all can show the real source.
The last log you posted shows the email being 72KB in size, which exceeds the default value of 64KB. You can easily change that by editing the MaxMsgSizeForKeywordScan value in the SpamFilter.ini file (you don't even have to start SpamFilter after making the change... the new setting will be re-imported within 60 seconds...). However please note that increasing this maximum size does affect the CPU usage. If you have CPU to spare on your server, you can be pretty aggressive by increasing it ten-fold, otherwise... be conservative!

I fixed the ( error in the keyword.

I also increased the size limit.

Thanks for the help I will keep you updated on the results.

HTML Spam Email How to stop this? : There are a few problems with...

Mon, 21 Aug 2006 16:53:05 +0000

Author: LogSat
Subject: 5758
Posted: 21 August 2006 at 4:53pm

There are a few problems with this ... problem.

As sgeorge correctly identified, there's an error in one of your keywords regular expressions:(]*>).*){8})
There are two "(" and three ")", so the parenthesis are mistamtched,causing an error in the RegEx lookups, as looged in SpamFilter:
08/02/06 20:58:41:376 -- (45788) String matching error for
The source code you posted appears to have been extracted from Microsoft Outlook by doing a "view source" from the email client. Unfortunately Microsoft *completely* changes the real source of the email. What you are seing is not even close to what the real email's source is . You should use other email clients, like Eudora, Mozilla Thunderbird, Netscape, or even Microsoft Outlook Express, as they all can show the real source.
The last log you posted shows the email being 72KB in size, which exceeds the default value of 64KB. You can easily change that by editing the MaxMsgSizeForKeywordScan value in the SpamFilter.ini file (you don't even have to start SpamFilter after making the change... the new setting will be re-imported within 60 seconds...). However please note that increasing this maximum size does affect the CPU usage. If you have CPU to spare on your server, you can be pretty aggressive by increasing it ten-fold, otherwise... be conservative!

HTML Spam Email How to stop this? : Thanks for all the help so far....

Mon, 21 Aug 2006 16:18:37 +0000

Author: tcrawford
Subject: 5758
Posted: 21 August 2006 at 4:18pm

Thanks for all the help so far.

HTML Spam Email How to stop this? : Here is the latestest one that...

Mon, 21 Aug 2006 16:17:36 +0000

Author: tcrawford
Subject: 5758
Posted: 21 August 2006 at 4:17pm

Here is the latestest one that is getting through and I believe it is the max message size, how can I change that?

thanks in advance

Tom Crawford

08/21/06 13:26:24:375 -- (33020) Connection from: 205.234.170.138 - Originating country : United States
08/21/06 13:26:25:000 -- (33020) Mail from: cfknj@canaaninc.org
08/21/06 13:26:25:421 -- (33020) - MAPS search done...
08/21/06 13:26:25:421 -- (33020) RCPT TO: email@email.com accepted
08/21/06 13:26:28:218 -- (33020) Scanning image for spam:ad lib.gif
08/21/06 13:26:28:234 -- (33020) Scanning image for spam:dumpy.gif
08/21/06 13:26:28:234 -- (33020) Scanning image for spam:horizon.gif
08/21/06 13:26:28:250 -- (33020) Scanning image for spam:quotient.gif
08/21/06 13:26:28:250 -- (33020) Warning - Message exceeds MaxMsgSizeForKeywordScan, skipping statistical scan
08/21/06 13:26:28:250 -- (33020) EMail from cfknj@canaaninc.org to email@email.com passes Bayesian filter - 0% spam (0ms)
08/21/06 13:26:28:250 -- (33020) EMail from cfknj@canaaninc.org to email@email.comwas queued. Size: 72 KB, 73728 bytes
08/21/06 13:26:28:265 -- (25744) Sending email from cfknj@canaaninc.org to email@email.com--
08/21/06 13:26:28:296 -- (33020) Disconnect
08/21/06 13:26:28:437 -- (25744) EMail from cfknj@canaaninc.org to email@email.com -- was forwarded to emailserver ip

HTML Spam Email How to stop this? : I fixed the keyword problem, but...

Mon, 21 Aug 2006 16:08:11 +0000

Author: tcrawford
Subject: 5758
Posted: 21 August 2006 at 4:08pm

I fixed the keyword problem, but they are still getting through, they don't come from the same domain it is different all the time. This about the only spam that is getting through right now.