포럼: users (Thread #21186)

SPAM判定されないメール(HTML形式) (2009-01-07 17:51 by Anonymous #41007)

お疲れ様です。

今週に入ってから同じパターンで一日4-5通着信するメールがあるのですが、学習されていないようです。
着信しているメールの一通は、以下のものです。

ヘッダ:
Received: (qmail 11432 invoked by uid 89); 7 Jan 2009 17:25:24 +0900
Received: from unknown (HELO ai202-170-178-228.ccnet-ai.ne.jp) (202.170.178.228)
by 0 with SMTP; 7 Jan 2009 17:25:24 +0900
To: <XXXXXX@XXXXXXXXX>
Subject: Grow bigger, faster, longer
From: <XXXXXX@XXXXXXXXX>
MIME-Version: 1.0
Importance: High
Content-Type: text/html
X-Spam-Flag: No
X-Spam-Probability: 0.501812

本文:
If you are unable to see the message below, click here to view.





Thank you for your interest in Robinson and Associates Inc

You are receiving this e-mail because you have subscribed to product updates.

If you want to unsubscribe from Robinson and Associates Inc Newsletter, please visit subscription center and provide your address in the Unsubscribe field.

Copyright (C) 2008, Robinson and Associates Inc
629 State Santa Barbara, CA 93101


Reply to #41007×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login

RE: SPAM判定されないメール(HTML形式) (2009-01-07 17:54 by Anonymous #41008)

HTMLタグをコピペすると、Spamとエラーが出てポストできないので本文のみ入れました。
Reply to #41007

Reply to #41008×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login

RE: SPAM判定されないメール(HTML形式) (2009-01-18 22:57 by nabeken #41278)

unix系でしたら、
% bsfilter -d mail_file
のような感じで、-d オプション付きで実行して、単語に切り分けられているような表示がされているか確認して下さい。
Reply to #41007

Reply to #41278×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login

RE: SPAM判定されないメール(HTML形式) (2009-01-21 23:36 by Anonymous #41380)

確認しました。

単語で切り分けられています。

なお、SPAM判定されないメールですが、その後も種類が増えていまして、数日前から「洗練された英文ライティングを実現」と書かれているものが急増中です。

他にも来ている人がいるようです。新たな問題?
http://www.google.co.jp/search?q=%E6%B4%97%E7%B7%B4%E3%81%95%E3%82%8C%E3%81%9F%E8%8B%B1%E6%96%87%E3%83%A9%E3%82%A4%E3%83%86%E3%82%A3%E3%83%B3%E3%82%B0%E3%82%92%E5%AE%9F%E7%8F%BE&lr=lang_ja&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:ja:official&client=firefox-a

<結果を抜粋>
・日本語で届くSPAM
lang ja header char_ja
tokenizer content-type multipart
tokenizer content-type alternative
tokenizer from morishita
tokenizer from rikako
tokenizer from qivalor
tokenizer from com
tokenizer from 清覚
tokenizer from 覚郷
tokenizer subject 英語
tokenizer subject 手段
tokenizer subject パーフェクト

・英文で届くSPAM
tokenizer content-type text
tokenizer content-type html
tokenizer from yamada
tokenizer from taro
tokenizer from hoge
tokenizer from jp
tokenizer subject Re
tokenizer subject Message
tokenizer subject from
tokenizer subject President
tokenizer to yamada
tokenizer to taro
tokenizer to hoge
tokenizer to jp
tokenizer received from
tokenizer received unknown
tokenizer received HELO
tokenizer received alliedpickfords
tokenizer received bg
tokenizer received com
tokenizer received 88.80.109.37
tokenizer received by
tokenizer received 0
tokenizer received with
tokenizer received SMTP
tokenizer C body We
tokenizer C body ship
tokenizer C body Worldwide!
tokenizer C body To
tokenizer C body all
tokenizer C body countries!
tokenizer C body To
tokenizer C body all
tokenizer C body destinations!
tokenizer C body To
tokenizer C body unsubscribe
tokenizer C body from
tokenizer C body this
tokenizer C body mailing
tokenizer C body list
tokenizer C body please
tokenizer C body log
tokenizer C body in
tokenizer C body to
Reply to #41278

Reply to #41380×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login

RE: SPAM判定されないメール(HTML形式) (2009-01-21 23:54 by Anonymous #41381)

ちなみに、ヘッダのフラグは、こんな感じです。
毎日着信する度に学習させていますが変化なしです…。

日本語のSPAM
X-Spam-Flag: No
X-Spam-Probability: 0.500000

英文のSPAM
X-Spam-Flag: No
X-Spam-Probability: 0.500091


全く自動振り分け出来ていないわけではなく、大半は問題なく、高い確率で SPAM判定されています。
感謝の念に堪えません。

例1
X-Spam-Flag: Yes
X-Spam-Probability: 0.999999
例2
X-Spam-Flag: Yes
X-Spam-Probability: 0.986260

Reply to #41278

Reply to #41381×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login

RE: SPAM判定されないメール(HTML形式) (2009-01-26 12:03 by Anonymous #41471)

あるいは、私が先日まで苦労していたのと同一タイプかも知れません。 まず clean 判定されて、何回 -s -C してもスコアが大きく変らない困ったヤツでした。

今は、bsfilter 1.0.17.rc1 で refer-all-header オプションを入れて、全て Spam に判定されています。
Reply to #41007

Reply to #41471×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login

RE: SPAM判定されないメール(HTML形式) (2009-01-28 11:20 by Anonymous #41509)

コメントありがとうございます。
--refer-all-header は使っていなかったので、付けて確認してみましたが、どうも特定の2種類のSPAMがフィルタ出来ていないようでした。データベースを再構築してもう少し様子を見てみたいと思います。
Reply to #41471

Reply to #41509×

You can not use Wiki syntax
You are not logged in. To discriminate your posts from the rest, you need to pick a nickname. (The uniqueness of nickname is not reserved. It is possible that someone else could use the exactly same nickname. If you want assurance of your identity, you are recommended to login before posting.) Login