垃圾邮件防护

chj97j · 发表于 2006-1-13 13:56:37

最近老是收到如下垃圾邮件的骚扰，研究拉半天，也无从得知好的过滤规则。如启用PTR解析，那么很多正常的邮件也会被拒绝。现贴在这里，请大家看看，是否有好的解决办法，共同讨论下。<br>
邮件如下，大家可以把他拷贝到TXT文件，改成EML后缀后，就可以看到实际的邮件了。<br>
Return-path: <kiarra@dipt.donbass.net><br>
Received: from dipt.donbass.net ([59.31.2.44])<br>
by mydomain.com (mydomain.com [127.0.0.1])<br>
(MDaemon.PRO.v6.8.4.R)<br>
with ESMTP id 51-md50000000028.tmp<br>
for <chj@mydomain.com>; Fri, 13 Jan 2006 11:19:50 +0800<br>
Message-ID: <000001c617ef$de1d1bb0$90d8a8c0@prosy><br>
Reply-To: "Kiarra Stainback" <kiarra@dipt.donbass.net><br>
From: "Kiarra Stainback" <kiarra@dipt.donbass.net><br>
To: "Michjo Pires" <chj@mydomain.com><br>
Subject: Re: fibroma jobholder<br>
Date: Thu, 12 Jan 2006 22:17:21 -0500<br>
MIME-Version: 1.0<br>
Content-Type: multipart/alternative;<br>
boundary="----=_NextPart_000_0001_01C617C5.F54713B0"<br>
X-Priority: 3<br>
X-MSMail-Priority: Normal<br>
X-Mailer: Microsoft Outlook Express 6.00.2800.1106<br>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106<br>
X-MDArchive-Copy: 1<br>
X-Lookup-Warning: MAIL lookup on kiarra@dipt.donbass.net does not match 59.31.2.44<br>
X-MDRcpt-To: chj@mydomain.com<br>
X-MDRemoteIP: 59.31.2.44<br>
X-Return-Path: kiarra@dipt.donbass.net<br>
X-MDaemon-Deliver-To: wang@mydomain.com<br>
X-Spam-Status: No, hits=1.5 required=8.0<br>
tests=CASHCASHCASH,HTML_80_90,UPPERCASE_25_50<br>
version=2.54<br>
X-Spam-Level: *<br>
X-Spam-Checker-Version: SpamAssassin 2.54 (1.174.2.17-2003-05-11-exp)<br>
X-Spam-Report: ---- Start SpamAssassin results<br>1.50 points, 8 required;<br>* 0.5 -- BODY: Message is 80% to 90% HTML<br>* 0.0 -- Contains at least 3 dollar signs in a row<br>* 1.0 -- message body is 25-50% uppercase<br>---- End of SpamAssassin results<br>
X-Spam-Processed: awlopchina.com, Fri, 13 Jan 2006 11:19:53 +0800<br>
<br>
This is a multi-part message in MIME format.<br>
<br>
------=_NextPart_000_0001_01C617C5.F54713B0<br>
Content-Type: text/plain;<br>
charset="us-ascii"<br>
Content-Transfer-Encoding: quoted-printable<br>
<br>
=20<br>
<a target=_blank href=http://www.pivatean.com>http://www.pivatean.com</a><br>
=20<br>
C<br>
X<br>
S<br>
V<br>
V<br>
A<br>
I<br>
a<br>
o<br>
A<br>
I<br>
m<br>
A<br>
n<br>
m<br>
L<br>
A<br>
b<br>
L<br>
a<br>
a<br>
I<br>
G<br>
i<br>
I<br>
x<br>
=20<br>
U<br>
R<br>
e<br>
S<br>
=20<br>
=20<br>
M<br>
A<br>
n<br>
$<br>
$<br>
$<br>
=20<br>
$<br>
$<br>
3<br>
1<br>
1<br>
$<br>
3<br>
2<br>
,<br>
,<br>
,<br>
1<br>
,<br>
,<br>
7<br>
4<br>
1<br>
,<br>
7<br>
8<br>
5<br>
2<br>
2<br>
2<br>
5<br>
9<br>
=20<br>
<br>
------=_NextPart_000_0001_01C617C5.F54713B0<br>
Content-Type: text/html;<br>
charset="us-ascii"<br>
Content-Transfer-Encoding: quoted-printable<br>
<br>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><br>
<HTML><HEAD><br>
<META http-equiv=3DContent-Type content=3D"text/html; =<br>
charset=3Dus-ascii"><br>
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR><br>
<STYLE></STYLE><br>
</HEAD><br>
<BODY bgColor=3D#ffffff><br>
<DIV></DIV><br>
<DIV><A =<br>
href=3D"<a target=_blank href=http://www.pivatean.com&quot>http://www.pivatean.com&quot</a>;><a target=_blank href=http://www.pivatean.com&lt>http://www.pivatean.com&lt</a>;/A></DIV><br>
<DIV></DIV><br>
<DIV style=3D"FLOAT :<br>
=20<br>
left; MARGIN-RIGHT: 0px;<br>
"><DIV>C</DIV><DIV>X</DIV><DIV>S</DIV><DIV>V</DIV><DIV>V</DIV><DIV>A</DIV=<br>
></DIV><br>
<DIV style<br>
=3D"FLOAT : left;=20<br>
PADDING-RIGHT: 0px;<br>
"><DIV>I</DIV><DIV>a</DIV><DIV>o</DIV><DIV>A</DIV><DIV>I</DIV><DIV>m</DIV=<br>
></DIV><br>
<DIV style=3D"LETTER-SPACING<br>
:<br>normal; FLOAT : left;<br>
"><DIV>A</DIV><DIV>n</DIV><DIV>m</DIV><DIV>L</DIV><DIV>A</DIV><DIV>b</DIV=<br>
></DIV><br>
<DIV style<br>
=3D"<br>
BORDER-BOTTOM:<br>0px; FLOAT : =<br>
left;"><DIV>L</DIV><DIV>a</DIV><DIV>a</DIV><DIV>I</DIV><DIV>G</DIV><DIV>i=<br>
</DIV></DIV><br>
<DIV style=3D<br>
"FLOAT : left;<br>PADDING-RIGHT: 0px;<br>
"><DIV>I</DIV><DIV>x</DIV><DIV></DIV><DIV>U</DIV><DIV>R</DIV><DIV>e=<br>
</DIV></DIV><br>
<DIV<br>style<br>
=3D"WHITE-SPACE:<br>normal; FLOAT : =<br>
left;"><DIV>S</DIV><DIV></DIV><DIV></DIV><DIV>M</DIV><DIV>A</=<br>
DIV><DIV>n</DIV></DIV><br>
<DIV<br>style=3D<br>
"BACKGROUND-COLOR: #FFFFFF; FLOAT : left;<br>
"><DIV>$</DIV><DIV>$</DIV><DIV>$</DIV><DIV></DIV><DIV>$</DIV><DIV>$=<br>
</DIV></DIV><br>
<DIV style=3D"LETTER-SPACING:<br>normal; FLOAT :=20<br>
left;<br>
"><DIV>3</DIV><DIV>1</DIV><DIV>1</DIV><DIV>$</DIV><DIV>3</DIV><DIV>2</DIV=<br>
></DIV><br>
<DIV<br>style=3D"MARGIN-BOTTOM: 0px;<br>FLOAT :<br>=<br>
left;"><DIV>,</DIV><DIV>,</DIV><DIV>,</DIV><DIV>1</DIV><DIV>,</DIV><DIV>,=<br>
</DIV></DIV><br>
<DIV=20<br>
style=3D"FLOAT : left;=20<br>
BORDER-COLOR<br>
: =<br>
#FFFFFF;"><DIV>7</DIV><DIV>4</DIV><DIV>1</DIV><DIV>,</DIV><DIV>7</DIV><DI=<br>
V>8</DIV></DIV><br>
<DIV<br>style=3D"MARGIN-TOP: 0px;=20<br>
FLOAT :=20<br>
left;"><DIV>5</DIV><DIV>2</DIV><DIV>2</DIV><DIV>2</DIV><DIV>5</DIV><DIV>9=<br>
</DIV></DIV><DIV=20<br>
style=3D"MARGIN-TOP: 0px;=20<br>
CLEAR :=20<br>
both;"></DIV></BODY></HTML><br>
------=_NextPart_000_0001_01C617C5.F54713B0--<br>
<br>
<br>

chj97j · 发表于 2006-1-13 18:10:06

怎么没有人回复？？？那么建议把大家的防护垃圾邮件的方法在这里讨论一下吧！！！<br>
有收到如下的邮件：<br>
Return-path: <wlpuaxgbja@sexxchat.com><br>
Received: from 69-173-215-77.clvdoh.adelphia.net ([69.173.215.77])<br>
by mydomain.com (mydomain.com [127.0.0.1])<br>
(MDaemon.PRO.v6.8.4.R)<br>
with ESMTP id 16-md50000000031.tmp<br>
for <chj@mydomain.com>; Fri, 13 Jan 2006 16:29:37 +0800<br>
Received: from .anu..au ([1] helo=anu..au)<br>
by smtp0..co with esmtp <br>
id 1A5Ys6-247133-80<br>
Message-ID: <NCBAKEOAA..@cde.Com><br>
Sender: freeradius-devel-wlpuaxgbja@sexxchat.com<br>
X-Mailman-Version: 2.0.1<br>
Date: Fri, 13 Jan 2006 06:26:13 -0200<br>
From: "Leigh Robison" <wlpuaxgbja@sexxchat.com><br>
To: wang@mydomain.com<br>
Subject: Regards payment<br>
X-MDArchive-Copy: 1<br>
X-Lookup-Warning: MAIL lookup on wlpuaxgbja@sexxchat.com does not match 69.173.215.77<br>
X-MDRcpt-To: wang@mydomain.com<br>
X-MDRemoteIP: 69.173.215.77<br>
X-Return-Path: wlpuaxgbja@sexxchat.com<br>
X-MDaemon-Deliver-To: chj@mydomain.com<br>
X-Spam-Status: No, hits=3.0 required=8.0<br>
tests=BAYES_90<br>
version=2.54<br>
X-Spam-Level: ***<br>
X-Spam-Checker-Version: SpamAssassin 2.54 (1.174.2.17-2003-05-11-exp)<br>
X-Spam-Report: ---- Start SpamAssassin results<br>3.00 points, 8 required;<br>* 3.0 -- BODY: Bayesian classifier says spam probability is 90 to 99%<br>[score: 0.9796]<br>---- End of SpamAssassin results<br>
X-Spam-Processed: mydomain.com, Fri, 13 Jan 2006 16:29:42 +0800<br>
<br>
Do you want a watch?<br>
<br>
In our online store you can buy replicas of Rolex watches and<br>
other brands. They look and feel exactly like the real thing.<br>
<br>
- We have 100+ different brands in our selection<br>
- Free shipping if you order 2 or more<br>
- Save up to 80% compared to the cost of other replicas<br>
- Standard Features:<br>
- Screw-in crown<br>
- Unidirectional turning bezel where appropriate<br>
- All the appropriate rolex logos, on crown and dial<br>
- Heavy weight<br>
- Extended Waranty<br>
- Live support online or via callback<br>
- C-lick hereeee <a target=_blank href=http://papagianni.info>http://papagianni.info</a><br>
<br>
<br>
设置了过滤规则，if message body contain string:"Do you want a watch?" then delete the messege.<br>
可是好象并不起作用。<br>
请各位达人帮我考虑下。<br>
谢了先！！！1

chj97j · 发表于 2006-1-14 10:59:59

没人响应，自己顶一下

chj97j · 发表于 2006-1-16 08:37:00

看来人气不是很足啊，要不大家互相讨论一下对垃圾邮件防护的经验和方法吧？？？

asionliang · 发表于 2006-1-16 11:38:07

看精华~

chj97j · 发表于 2006-1-17 15:49:16

你老辛苦的杰作，俺早就拜读了，很多也根据文章上设置了。但是，象反向解析等都不能开启的，因为很多国内包括国外的客户的邮件都会有影响。在内容过滤里面我也加了规则，但是好象不起作用。所以在这里列出来，还是希望大家给出点主意。

狗尾草 · 发表于 2006-1-17 17:31:58

用个贝耶斯挺好用的！

chj97j · 发表于 2006-1-18 13:50:05

贝页斯确实好用，但是对于这两者的邮件好象却是无能为力的样子。难道是我拖的邮件还不够多？？？？可是我已经拖了两个星期了，每天20封，那么也至少有200封了，可是还是不能屏蔽啊。我设置的分值是8/11，但是贝叶斯得出的分值只有3分多一点。

stdmis · 发表于 2006-1-18 14:31:05

200封太少了。<br>
另外“分值是8/11”是什麼意思？好象沒這個說法。

chj97j · 发表于 2006-1-24 09:33:33

两百封也许是太少了，但是我现在已经使用一个月了，平均每天有1多封，那么一个月下来，至少也有3000封了。在heuristics中，我设置了a message is spam if it's score is greater or equal =8, smtp rejects the messages if its scores greater or equal to =11.但是对于这两封邮件好象跟本不起作用。我看了每天的贝叶斯分值，这两封邮件每天都在2-3分左右。如果贝叶斯学习的话，至少可以通过邮件内容，逐天增加。

		自动登录	找回密码
密码			会员注册

垃圾邮件防护

re:怎么没有人回复？？？那么建议把大家的防护...

re:没人响应，自己顶一下

re:看来人气不是很足啊，要不大家互相讨论一下...

re:看精华~

re:你老辛苦的杰作，俺早就拜读了，很多也根据...

re:用个贝耶斯挺好用的！

re:贝页斯确实好用，但是对于这两者的邮件好象...

re:200封太少了。另外“分值是8/11...

re:两百封也许是太少了，但是我现在已经使用一...

浏览过的版块