August 23, 2002
Is SpamAssassin helping the spammers too much?

After I installed SpamAssassin, it has successfully filtered approximately 600 spam messages per month for me on average. Unfortunately, lately it seems like more spammers are finding ways around it; new types of spam just listing a couple of different headers with associated URLs -- no HTML, no "you can be removed from this list" etc, and therefore avoiding SpamAssassins careful scoring system...

(example spam received 4 times so far today):

Get a Visa or MasterCard even with Bad Credit!
http://www.something

Free Government Grants, Get Your part of the $350 Billion!
https://secure.something

Guaranteed Visa or MasterCard Approval - No Credit Check, No Risk
http://www.freecardssomething

I'm starting to wonder if SpamAssassin has been too successful and that spammers now are actively testing their mails themselves before sending them out? (seeing that SpamAssassin will show the accumulated "score" of a message; it would be an easy thing to set up a SpamAssassin-powered mailbox and tinker and try until your message "slipped through"...)

Sponsored links
Related Entries
Comments

I think *some* spammers could be testing their spammails with spamassassin before they send - possibly modifying the content till it no longer triggers spamassassin. On the other hand - if they strip down the mail too much - then it looses the "marketing features" which they are dependent upon: The phrases like "Get rich fast!" and similar *are* selling more, at least in traditional advertising. Using colors, images (and hence, HTML), saying that the spam is not spam - all those things should theoretically make the spam "sell" better. Therefore I don't think we will see it as a new trend - spammers starting sending just a few lines of plain text from a valid address, not using bcc, not including phrases which indicate porn/spam. Because they would not benefit from it.

Posted by: Ole Michaelsen on January 31, 2003 10:32 AM

Spamassassin is very configurable. So their testing is only useful for people with the default configuration. Even the score at which something is dumped is configurable. They won't know what people have set it to.

Posted by: Ryan on March 17, 2003 12:04 AM

Is Spamassasin bettere than K9 antispam
program ?

Posted by: Carlo on February 20, 2004 11:53 AM

I have tried K9, It works well

Posted by: Mark on February 22, 2004 05:35 PM

K9 is an excellent spam fighter. I have used it for a year, and it recognizes almost 99.5% once you have trained it properly. Don't expect it to work before one or two weeks, you need 500+ spams in K9's database, then you will experience the magic.

Also remember not to be naive; use the whitelist to protect the mail adresses you know - JUST IN CASE!

Once every second month a spam mail gets thought K9, I can live with that.

Posted by: Sajer on April 24, 2004 09:51 PM

K9 is an excellent spam fighter. I have used it for a year, and it recognizes almost 99.5% once you have trained it properly. Don't expect it to work before one or two weeks, you need 500 or more spams in K9's database, then you will experience the magic.

Also remember not to be naive; use the whitelist to protect the mail adresses you know - JUST IN CASE!

Once every second month a spam mail gets thought K9, I can live with that.

Posted by: Sajer on April 24, 2004 09:52 PM

I am using SAproxy, which is SpamAssassin for Win32 systems, and it still catches all spam. So, either spammers are not using SpamAssassin for testing or SpamAssassin is smarter than them.

Posted by: Eugene on March 8, 2005 05:18 AM

i want anti filter adress

Posted by: bahram on December 13, 2005 10:35 PM
Post a comment
Name:


Email:
(Will not be displayed if you enter a website below. Otherwise, it will be displayed "spam protected")


Website:
(if you have one)


What do you want to say?
(please don't bother posting "spam" (pornography, viagra-sales etc - I will delete such comments anyway))


Remember info?



Referrers to this page
TrackBack URL for this entry:
http://www.jacobsen.no/cgi-sys/cgiwrap/anders/MT/mt-tb.cgi/233
myBlog by Lars: Statistical Analysis of Spam - Part II (September 2, 2002 05:46 PM)
"Just after finishing my last piece on this topic (Statistical Analysis of Spam - Part I) I recieved a list of some 1900 X-Spam-Status lines from Anders. Inserting this into Minitab I expected to get two graphs looking more or less similar to eachother...."
myBlog by Lars: Statistical Analysis of Spam - Part III (September 3, 2002 07:10 PM)
"Once more it is time to study the statistical aspects of spam. In part II I commented on the differences in two independent sets of spam. Today I will try to be slightly more scientific. Just by looking at the histograms in the previous posting it is e..."
andersja's blog: I've "caught" a spammer (September 5, 2002 01:16 AM)
"I've ''caught'' a spammer red handed. Well.. Let me explain [...] Now I need some advice: What should I do?"

[an error occurred while processing this directive]

© Anders Jacobsen
[extrospection.com photography]