[SURBL-Discuss] Stupid SPAM
Jose-Marcio.Martins at ensmp.fr
jose-marcio.martins at ensmp.fr
Wed May 5 23:15:50 CEST 2004
Raymond Dijkxhoorn wrote:
>Hi Jose-Marcio,
>
>
>
>>Take a look at this SPAM :
>>
>> http://www.ensmp.fr/~martins/Prozac
>>
>>Mainly, check the source.
>>
>>The problem is that it comes with many, many URLs. At the beginning,
>>there are URLs needed by the SPAM itself. After, it puts many URLs with
>>font size equals to 1. Most of these last domains aren't spam... 8-)
>>
>>
>
>Who cares, its picked up anyway, BIGEVIL_URI_RBL and WS_URI_RBL! :)
>
Scripts extracting URLs to insert into blacklist **should care** with
extracted URLs.
E.g. http://www.bernoulli.org, http://www.ubiquity.com,
http://www.nay.org aren't really spammers, and they have nothing to do
with this SPAM.
>
>May 5 21:52:33 vmx80 MailScanner[31469]: Message i45Jp6FK030462 from
>212.127.254.140 (raymond at prolocation.net) to quicknet.nl is spam,
>SpamAssassin (score=19.963, required 5, BAYES_99 5.40, BIGEVIL_URI_RBL
>3.50, BIZ_TLD 0.10, CLICK_BELOW 0.10, DRUGS_ANXIETY 0.01,
>DRUGS_ANXIETY_EREC 1.00, DRUGS_DEPRESSION 0.01, DRUGS_DEPR_EREC 1.00,
>DRUGS_DIET 0.01, DRUGS_DIET_EREC 1.00, DRUGS_ERECTILE 1.00,
>DRUGS_ERECTILE_OBFU 1.50, DRUGS_MANYKINDS 1.00, DRUGS_MUSCLE 0.01,
>DRUGS_SLEEP 0.01, DRUGS_SLEEP_EREC 0.50, HTML_60_70 0.11,
>HTML_LINK_CLICK_HERE 0.10, HTML_MESSAGE 0.10, WS_URI_RBL 3.50)
>
>I would say HOOOOOOORAY! Its doing a nice job catching them.
>
>Bye,
>Raymond.
>
>
>
>
>
--
---------------------------------------------------------------
Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41
Ecole des Mines de Paris http://j-chkmail.ensmp.fr
60, bd Saint Michel http://www.ensmp.fr/~martins
75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins at ensmp.fr
More information about the Discuss
mailing list