spamassassin-users October 2011 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: Help with tagging hotmail spam

Re: Help with tagging hotmail spam

From: Ned Slider <ned_at_nospam>
Date: Mon Oct 03 2011 - 05:36:49 GMT
To: users@spamassassin.apache.org

On 03/10/11 01:31, Alex wrote:
> Hi all,
>
> I have a fedora15 box with v3.3.2 and I have some hotmail spam that I
> can't figure out how to catch:
>
> http://pastebin.com/kkUUvYQp
>
> It's hitting BAYES_00 and no blacklists or other significant spam
> rules and not sure how to tag it. The user has reported receiving this
> spam several times before, each with a different URL in the body but
> otherwise the same.
>
> It's still not listed in a URIBL.
>
> Any ideas greatly appreciated.
> Thanks,
> Alex
>

X-Originating-IP hits Spamhaus XBL list. I would deep parse headers
against SBL-XBL. This does have the potential for FPs on legitimate mail
sent from infected computers also spewing botnet spam so take that into
account in your scoring.

As always, manually train Bayes with such examples.