SpamAssassin Russian P Spam

DennisdeWit

Hello,

Last few days I got A LOT (20 mails an hour) of spam coming in from LuckyDating.ru. They are using random e-mail adresses. Typically the sender is called Anna, Katya or Alena.

The subject is about 'Look at my naked pictures', 'Look at my Russian p***y' and such.

These mails are not seen as spam by SpamAssassim. How to tell the server this is actually spam? Any quick fix?

Thanks,
Dennis

black

Look at the full mail headers and see which IPs are sending the messages to your mail server.

Nyr

You can drop the domain at your border or use Bayesian filters to train SA for a more long-term solution.

Ole_Juul

Nyr said: You can drop the domain . . .

In fact I'm curious what the OP is getting from LuckyDating.ru that would cause him to not filter them out.

PieHasBeenEaten

@ole_juul Was thinking the same thing!

simonindia

@DennisdeWit @jarland is has some great insight on to how to deal with spam

Edit :DennisdeWit jarland may have some great insight on to how to deal with the spam

rm_

Post full e-mail headers here (you don't need to protect the spammers "anonymity" anyway) and you might get some ideas on how to block.

jar

@simonindia said:
DennisdeWit jarland is has some great insight on to how to deal with spam

Russian spam has been tough for me, admittedly.

vRozenSch00n

jarland said: Russian spam

Yes, that's the tough one. They're not necessary Russian, there are people from around the world who have Russian server that can do spam.

Gulf

Ole_Juul

Bride.ru is still there offering mail order brides. They've been around forever. Some of them must be getting pretty old by now.

DennisdeWit

All the mails contain 'pussy' or 'luckydating'. So I decided to write a rule;

body LUCKYDATING_CONTENT_RULE   /\bluckydating.ru\b/i
score LUCKYDATING_CONTENT_RULE 25

header LUCKYDATING_SUBJECT  Subject =~ /\bpussy\b/i
score LUCKYDATING_SUBJECT   25

The server is configured to smash everything with a score higher than 10 in the trashcan.

GM2015

You will no longer receive updates from yoiur favorite cat forum and appointments on your lucky calendar.

DennisdeWit said: All the mails contain 'pussy' or 'luckydating'

Master_Bo

@jarland said:
Russian spam has been tough for me, admittedly.

It took 12-15 "feeding" of that wave samples to Dspam to make it recognize and mark that spam with approx. 99.99% precision.

A better tool, compared to SA. Strictly MNSHO.