on Sun, Apr 07, 2002, Patrick Kirk (patrick@kirks.net) wrote:
> On Sun, Apr 07, 2002 at 10:02:53AM -0700, peter kamara wrote:
> >FROM KIZOMBE KAMARA
> >DAKAR SENEGAL.
> >TEL:221-6680399.
>
> How does one cathch these with a spam filter? To exclude emails with
> the names of West African countries seems a little too broad. Its
> almost always a Colonel who has recently died. "late father" perhaps?
Please set your mailer/editor linewrap to 68-75 characters. I strongly
recommend 72 as a good default.
Thank you.
I use spamassassin, which has historically not been too good at catching
Nigeria/419 scam mail, though it's getting better. In response, the
perps are modifying the scripts -- this one referred to Senegal, and
slipped through.
A procmail scorefile would be useful here. You'd want to look for all
caps, various African nations, 'MONEY', and, often, references to
'mother'. "Son" and "late father" would also fit.
I'd check the spamassassin discussion list for suggested filter rules
for catching this stuff that haven't made it into spamassassin proper
yet.
I just forward the mail to the FTC's spam line, the Treasury Dept's 419
line, the originating ISP, and Razor.
Peace.
--
Karsten M. Self <kmself@ix.netcom.com> http://kmself.home.netcom.com/
What Part of "Gestalt" don't you understand?
ARM Computer: Customer Service Hell On Earth
http://lists.svlug.org/pipermail/svlug/2001-November/038616.html
Attachment:
pgpGODN3H5ufn.pgp
Description: PGP signature