I am retraining SpamSieve. 90% of what is in the Spam list is unknown gibberish. Where did it originate, and why?
Windows-1251
windows-1250
src=3D"cid:
src=“cid:
noreply@d-pliti.net
luxurycruisenews@reply.bm23.com
Luxury Cruise News
ks_c_5601-1987
koi8-r
iso-ir-149
iso-%DIGITS%LCVALUES%DIGITS%DIGITS%LCVALUES
image001.
GB2312
FacialRejuvenation@bigworldly.com
FacialRejuvenation@bestimportant.com
euc-kr
charset=windows-1250”>
Broadcast@ionmx.com
BizCardPrinter@playdatenow.com
big5
Acai.Berry.Cleanse@bigworldly.com
\bV.AGRA\b
\bV…AGRA\b
<META content=“MSHTML 6.00.3790.2759” name=GENERATOR>
<META content=“MSHTML 6.00.2900.3199” name=GENERATOR>
<META content=“MSHTML 6.00.2900.2963” name=GENERATOR>
<DIV><IMG^>]"cid:^>]></DIV></BODY>
<BODY^>]>\s<p>\s*<IMG^>]"cid:^>]>
<BODY^>]>\s<IMG^>]"cid:^>]>
<BODY^>]>\s<FONT^>]>\s<DIV^>]>\s<p>\s*<IMG^>]"cid:^>]>
<BODY^>]>\s<DIV^>]>\s<IMG^>]"cid:^>]>\s*</DIV>
<BODY^>]>\s<DIV^>]>\s<FONT^>]>\s<IMG^>]"cid:^>]>\s*</FONT>\s*</DIV>
<BODY^>]>\s<DIV^>]>\s<font^>]>\s<IMG^>]"cid:^>]>
<BODY^>]>\s<DIV^>]>.</DIV>\s*<p>\s*<IMG^>]"cid:^>]>
<body bgcolor="#ffffff" text="#000000">\s*<img alt="" src="cid:
.scr
.pif
(?s)<DIV^>]>.?</DIV>\s*<DIV^>]>\s<IMG^>]"cid:^>]>\s*</DIV>\s*<DIV^>]>.</DIV>
(?-i)^(Re: )?[A-Z]{2,8}, a-z0-9’?!]*$
%CHARSET
I moved this to a new thread because it doesn’t really relate to the original thread.
SpamSieve’s blocklist contains a bunch of built-in rules to match common characteristics of spam, and it also contains names and addresses from messages that you trained it with. The documentation for the blocklist explains what the different Headers and Match Styles are.
BlocklistRules
I decided to restart and retrain SpamSieve. This time, I am using the opportunity to observe and question what is happening. My question today refers to “BizCardPrinter.” They change their address daily: BizCardPrinter@bestimportant.com BizCardPrinter@newacquire.com BizCardPrinter@playdatenow.com BizCardPrinter@bestdossier.com etc.
I have entered: [From (address) ^ Contains ^ BizCardPrinter] in the blocklist. Is this the correct way to block this nuisance?
My further question: Why was SpamSieve unable to detect BizCardPrinter’s obvious ploy without my intervention?
This is more important to me now that I have perused your explanation of SpamSieve’s rules. They are sufficiently esoteric and complicated that I would rather not mess with them. [Arthur Clark’s Third Law: Any sufficiently advanced technology is indistinguishable from magic.]
Yes, that blocklist rule will catch those messages, so if SpamSieve was the reason they were getting through, they will now be blocked. However, I generally do not recommend this sort of micromanagement. Please see this thread.
The answers are in SpamSieve’s log.