邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 最近这样的垃圾邮件如何处理 [打印本页]

作者: job21 时间: 2006-12-18 20:22
标题: 最近这样的垃圾邮件如何处理
最近所有用户都收到如下邮件,邮件来源如下信息:
X-Priority:3
X-MSMail-Priority:Normal
X-Mailer:Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE

roduced By Microsoft MimeOLE V6.00.2800.1807
X-Lookup-Warning:MAIL lookup on vcupzk@sawant.name does not match 71.30.67.16
X-MDRcpt-To:lx@tmarma.com
X-Rcpt-To:lx@tmarma.com
X-MDRemoteIP:71.30.67.16
X-Return-Path:vcupzk@sawant.name
X-MDaemon-Deliver-To:lx@tmarma.com
X-Spam-Checker-Version:SpamAssassin 3.0.4 (2005-06-05)
X-Spam-Report:*  0.0 HTML_30_40 BODY: Message is 30% to 40% HTML
*  1.6 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
*    [score: 0.5016]
*  0.0 HTML_MESSAGE BODY: HTML included in message
X-Spam-Status:No, score=1.7 required=10.0 tests=BAYES_50,HTML_30_40,
HTML_MESSAGE autolearn=no version=3.0.4
X-Spam-Level:*
X-Spam-Processed:tmarma.com, Wed, 06 Dec 2006 07:27:38 +0800
X-MDAV-Processed:tmarma.com, Wed, 06 Dec 2006 07:27:40 +0800
前面是图片,
后面是文字基本上是以下之类.
The convention will kick off with a two-part business management seminar by .
Then, share it with your team. Then, share it with your team. Maybe other projects are ready for this.
If you plan to invest in replanning and rescheduling, that doesn't matter.
Let's make sure we all go home to our families every night. City officials suggest that the economics of the jewelry business wouldn't support the higher rents of new construction without a tax break for the developer.
Sure project teams would benefit tremendously from more story-telling about the project.
Neither will solo-planning. If you plan to invest in replanning and rescheduling, that doesn't matter.
How many of us think we have the authority we need to do our jobs? Some experts, like author and higher-education-consultant Lara Couturier, worry that it . Neither will solo-planning......

!cid_000301c718a5$715cdc10$b6648055@ueeyb.gif (12.4 KB, 下载次数: 1)

!cid_000601c721f6$4d56e400$00000000@dsf0d4qmieuz06.gif (26 KB, 下载次数: 0)

!cid_001001c7218d$e28d87e0$eb668c4a@cworvn.gif (13.93 KB, 下载次数: 0)

!cid_001401c71a1e$c0bef6b0$e35302d1@jbm.gif (17.96 KB, 下载次数: 0)

作者: job21 时间: 2006-12-18 20:25
太烦了,每个人每天收到三到四封,反垃圾邮件感觉没有起作用,各位有碰到这种邮件吗,如何处理的?

作者: lwz_08 时间: 2006-12-18 22:18
类似的图片垃圾邮件比较难搞定

只有一封一封扔到SPA中去了

作者: dennishan 时间: 2006-12-18 22:45
唯一解法：commtouch

作者: job21 时间: 2006-12-19 08:36
楼上,如何使用commtouch

作者: job21 时间: 2006-12-19 08:38
在反垃圾邮件论坛看到这样一段,不知道在MD中如何使用

用Regular Expression(Perl-compatible)的关键词过滤html内容.
.*src="cid:((part1|[A-Z0-9]{8})\.[A-Z0-9]{8}\.[A-Z0-9]{8}|[A-Z0-9]{20}).*
可过滤掉一部分.

好象都有这样的特征：
<img src="cid:5GMSG3DV0N" border=0></a>
<img src="cid:GVD5N0RVT5" border=0></a>

可以考虑对这些cid特征进行加分操作，以提高识别率。

我是用

*</HEAD>[ ]{0,3}<BODY bgColor=#ffffff>[ ]{0,3}<DIV><FONT face=Arial size=2>[ ]{0,3}<IMG alt="[a-z]{2,12}"[ ]{0,3}hspace=0[ ]{0,3}src="cid:[0-9a-f]{12}\$[0-9a-f]{8}\$[0-9a-f]{8}@[a-z]{2,8}".*

作者: job21 时间: 2006-12-20 10:36
没人理了

作者: U-Mail 时间: 2006-12-20 14:16
过滤被DNS-RBL认为的IP黑名单过拉的邮件即可。

作者: 钉子 时间: 2006-12-21 00:33
job21 你说到的过滤规则现在效果如何？

作者: U-Mail 时间: 2006-12-22 02:21

原帖由 job21 于 2006-12-19 08:38 发表
在反垃圾邮件论坛看到这样一段,不知道在MD中如何使用

用Regular Expression(Perl-compatible)的关键词过滤html内容.
.*src="cid(part1|{8})\.{8}\.{8}|{20}).*
可过滤掉一部分.

好象都有这样的 ...

在MD的80_MDaemon_updates.cf里面加。

作者: job21 时间: 2006-12-22 11:46
打开80_MDaemon_updates.cf看了,偶还是不知道怎么把规则添加到80_MDaemon_updates.cf中,不过我用的是8.13,刚刚把9.53版本80_MDaemon_updates.cf覆盖了8.13，发现部份邮件到了spam中了，因为它的第一条规则为
rawbody MD_CID_MIX_88 /\"cid\:[A-F0-9]{8}\.[A-F0-9]{8}\"/
score MD_CID_MIX_88 1.66

和我找的规则类似，有兴趣不妨一起测试。

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.net/)