spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From John Hardin <jhar...@impsec.org>
Subject Re: spample: porn extortion with pure numeric From domain and base64 body
Date Wed, 18 Jul 2018 04:13:43 GMT
On Tue, 17 Jul 2018, John Hardin wrote:

> On Tue, 18 Jul 2018, Chip M. wrote:
>
>> Here's the SA test stats for 13 of this new morph:
>>  FORGED_MUA_MOZILLA          1
>>  HTML_MESSAGE               13
>>  HTML_MIME_NO_HTML_TAG      13
>>  LOCALPART_IN_SUBJECT       13
>>  MIME_BASE64_TEXT            9
>>  MIME_HTML_ONLY             13
>>  RCVD_IN_SORBS_DUL           1
>>  RDNS_DYNAMIC                3
>>  TVD_RCVD_SPACE_BRACKET      6
>>  UNPARSEABLE_RELAY           6
>> 
>> This new variant should be easy to exterminate. :)
>> 
>> 1. The quick and easy combo of "HTML_MIME_NO_HTML_TAG" and
>>   "LOCALPART_IN_SUBJECT" is worth a meta.
>>   The latter test is _VERY_ rare in Ham.
>
> Not according to masscheck.
>
> overlap  ham:  48% of LOCALPART_IN_SUBJECT hits also hit 
> HTML_MIME_NO_HTML_TAG; 0% of HTML_MIME_NO_HTML_TAG hits also hit 
> LOCALPART_IN_SUBJECT (spam 3%)
>
> No spam overlap at all. Masscheck would not promote that.

Sorry - 3% spam overlap, which isn't good enough to report in the 
"spam overlap" section explicitly.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   If the rock of doom requires a gentle nudge away from Gaia to
   prevent a very bad day for Earthlings, NASA won’t be riding to the
   rescue. These days, NASA does dodgy weather research and outreach
   programs, not stuff in actual space with rockets piloted by
   flinty-eyed men called Buzz.                       -- Daily Bayonet
-----------------------------------------------------------------------
  3 days until the 49th anniversary of Apollo 11 landing on the Moon
Mime
  • Unnamed multipart/mixed (inline, None, 0 bytes)
View raw message