score file for Xpost filter problem

Lu Wei

unread,

Mar 3, 2013, 8:22:27 PM3/3/13

to

Hi,
Recently I noticed that a cross-post spammer sneaked in. Please help checking what may be the cause.
My score file is

[*]
-10 Xpost %>3

Spammer's post header seen from Thunderbird:

X-Hamster-Info: Score=0 Received=20130301210032 UID=37
Xref: localhost cn.fan:10634
X-Received: by 10.224.175.65 with SMTP id w1mr9426942qaz.7.1362141597268;
Fri, 01 Mar 2013 04:39:57 -0800 (PST)
MIME-Version: 1.0
X-Received: by 10.49.75.9 with SMTP id y9mr1104043qev.9.1362141597204; Fri, 01
Mar 2013 04:39:57 -0800 (PST)
Newsgroups: cn.bbs.comp.linux,cn.bbs.soc.taiwan,cn.bbs.comp.lang.python,cn.fan
Date: Fri, 1 Mar 2013 04:39:57 -0800 (PST)
Complaints-To: groups...@google.com
Injection-Info: j2g2000yqj.googlegroups.com; posting-host=177.71.247.36; posting-account=abv6DQoAAABWzzz4zo81Rvcg_c4Sv22t
NNTP-Posting-Host: 177.71.247.36
User-Agent: G2/1.0
X-HTTP-Via: 1.1 www.luyserver.com/jboss6
X-HTTP-UserAgent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9.2.13)
Gecko/20110202 Firefox/3.6.13,gzip(gfe)
Message-ID: <4ae79d6f-39ba-4925...@j2g2000yqj.googlegroups.com>
Subject: =?UTF-8?B?5pSv6YKj5Lq6IDwg5pyA5L2O5Lq656eN?=
From: "postm...@stealthattractionsecret.com" <nscon...@gmail.com>
Injection-Date: Fri, 01 Mar 2013 12:39:57 +0000
Content-Type: text/plain; charset=ISO-8859-1
Path: news.liuxing99.3322.org!news.netfront.net!news.glorb.com!t2no6011737qal.0!news-out.google.com!y6ni406qaj.0!nntp.google.com!dd2no4134080qab.0!postnews.google.com!j2g2000yqj.googlegroups.com!not-for-mail
X-Old-Xref: news.liuxing99.3322.org cn.bbs.comp.linux:12421 cn.fan:392797

--
Regards,
Lu Wei
PGP key ID: 0x92CCE1EA

Wolfgang Jäth

unread,

Mar 4, 2013, 12:21:49 AM3/4/13

to

Am 04.03.2013 02:22, schrieb Lu Wei:
> Hi,
> Recently I noticed that a cross-post spammer sneaked in. Please help checking what may be the cause.
> My score file is
>
> [*]
> -10 Xpost %>3

help => Contents => Search 'XPost' => Scores.hst:

| The fictitious header-field Xpost is based on Xref and represents
| the number of groups, the article was crossposted to.

> Newsgroups: cn.bbs.comp.linux,cn.bbs.soc.taiwan,cn.bbs.comp.lang.python,cn.fan

Contrary to possible expectations this header is meaningless.

> X-Old-Xref: news.liuxing99.3322.org cn.bbs.comp.linux:12421 cn.fan:392797

And here, there are only 2 groups; i. e. your condition was not met.

The simple reason for this maybe unexpected behaviour is, that the
Newsgroups header is *not* content of the overview, but the XRef header
*is*.

Usually the difference becomes important only, if the server does not
provide all of the groups being listed in the Newsgroups header.

If you want to investigate the 'real' Newsgroups header instead, you at
first need to test the email *after* the article was loaded (i. e. the
rule must be lead in by a '?'), and at second you have to count the
separators (i. e. ',') there:

| ?-10 Newsgroups {([^,]+,){3}}

Wolfgang
--

Lu Wei

unread,

Mar 4, 2013, 2:55:11 AM3/4/13

to

On 2013-3-4 13:21, Wolfgang Jï¿œth wrote:

> ...

> The simple reason for this maybe unexpected behaviour is, that the
> Newsgroups header is *not* content of the overview, but the XRef header
> *is*.
>
> Usually the difference becomes important only, if the server does not
> provide all of the groups being listed in the Newsgroups header.
>
> If you want to investigate the 'real' Newsgroups header instead, you at
> first need to test the email *after* the article was loaded (i. e. the
> rule must be lead in by a '?'), and at second you have to count the
> separators (i. e. ',') there:
>
> | ?-10 Newsgroups {([^,]+,){3}}
>
> Wolfgang
>

Thank you for the explanation and score rule. I have implemented it.