Re: Exchange-based spam filter?
If you've got no money, then you might be better off using an Exim box as an SMTP gateway and install SpamAssassin on that - third party solutions for Exchange tend to be quite expensive.
Just for those who aren't familiar with SpamAssassin, it's a rules-based spam filter that turns your spam emails into something like the following (I've deleted the long, rambling HTML email from the end, but everything else is here):
From macbug@attbi.com Mon Mar 24 19:23:44 2003
Return-path: <macbug@attbi.com>
Envelope-to: peter@localhost
Received: from mail by ganymede.tranquillity.lan with spam-scanned (Exim 3.36 #1 (Debian))
\tid 18xXXo-0001iu-00
\tfor <peter@localhost>; Mon, 24 Mar 2003 19:23:43 +0000
Received: from localhost [127.0.0.1] by ganymede
\twith SpamAssassin (2.50 1.173-2003-02-20-exp);
\tMon, 24 Mar 2003 19:23:43 +0000
From: <macbug@attbi.com>
To: <peter.bonthrone@ntlworld.com>
Cc: <peter.clarke14@ntlworld.com>,
\t<peter.marsh1@ntlworld.com>,
\t<peter.parker@ntlworld.com>,
\t<peter.whysall@ntlworld.com>,
\t<jhsollerton@ntlworld.com>,
\t<jill.obc@ntlworld.com>,
\t<jim.blanchard@ntlworld.com>,
\t<jim.neville@ntlworld.com>,
\t<jim.parkes@ntlworld.com>
Subject: Size DOES matter! Enlarge your penis NOW!
Date: Mon, 24 Mar 2003 16:19:40 +0300
Message-Id: <001111b8cc64$caa20837$46267438@mqbvh.of>
X-Spam-Flag: YES
X-Spam-Status: Yes, hits=24.9 required=5.0
\ttests=BANG_GUARANTEE,DATE_IN_PAST_06_12,GUARANTEE,
\t GUARANTEED_100_PERCENT,HTML_30_40,HTML_COMMENT_SAVED_URL,
\t HTML_FONT_BIG,HTML_FONT_COLOR_BLUE,HTML_FONT_COLOR_RED,
\t HTML_LINK_CLICK_CAPS,HTML_MESSAGE,HTML_SHOUTING5,
\t HTML_TAG_EXISTS_TBODY,IMPOTENCE,MANY_EXCLAMATIONS,
\t MIME_HTML_ONLY,MSGID_OUTLOOK_TIME,NO_REAL_NAME,
\t PENIS_ENLARGE,PENIS_ENLARGE2,SOME_BREAKTHROUGH,
\t X_PRIORITY_HIGH
\tversion=2.50
X-Spam-Level: ************************
X-Spam-Checker-Version: SpamAssassin 2.50 1.173-2003-02-20-exp
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_3E7F5B3F.B3FD0F63"
This is a multi-part message in MIME format.
------------=_3E7F5B3F.B3FD0F63
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
This mail is probably spam. The original message has been attached
along with this report, so you can recognize or block similar unwanted
mail in future. See http://spamassassin.org/tag/ for more details.
Content preview: "Want a BIGPenis?"Experience the results you'vealways
wanted with a MASSIVE scientific breakthrough:Our Doctor-Approved Pill
Will ActuallyExpand, Lengthen And Enlarge Your Penis. 100%
GUARANTEED!Bestof all...There Are NO Agonizing Hanging Weights, NO
ToughExercises, NO Painful And Hard-To-Use Pumps, And There Is NO
Dangerous Surgery Involved.WE GUARANTEE GENUINE LASTING RESULTS!
PINACLE PILLS WILL WORK FOR YOU 100%, OR YOU GET 100% OF YOUR MONEY
BACK!If YOU want to massively enlarge your penisand experience big
gains in only weeks, this may be the most important email you'll
everread. Here's why: [...]
Content analysis details: (24.90 points, 5 required)
X_PRIORITY_HIGH (2.0 points) Sent with 'X-Priority' set to high
NO_REAL_NAME (0.7 points) From: does not include a real name
PENIS_ENLARGE2 (2.8 points) BODY: Information on getting a larger penis or breasts (2)
SOME_BREAKTHROUGH (1.8 points) BODY: Describes some sort of breakthrough
GUARANTEE (1.7 points) BODY: Contains word 'guarantee' in all-caps
IMPOTENCE (2.9 points) BODY: Impotence cure
PENIS_ENLARGE (2.2 points) BODY: Information on getting a larger penis or breasts
BANG_GUARANTEE (0.5 points) BODY: Something is emphatically guaranteed
GUARANTEED_100_PERCENT (0.5 points) BODY: One hundred percent guaranteed
HTML_30_40 (0.8 points) BODY: Message is 30% to 40% HTML
HTML_FONT_COLOR_RED (0.1 points) BODY: HTML font color is red
HTML_MESSAGE (0.1 points) BODY: HTML included in message
HTML_FONT_BIG (0.1 points) BODY: FONT Size +2 and up or 3 and up
HTML_LINK_CLICK_CAPS (1.1 points) BODY: HTML link text says "CLICK"
HTML_COMMENT_SAVED_URL (1.6 points) BODY: HTML message is a saved web page
HTML_TAG_EXISTS_TBODY (0.1 points) BODY: HTML has "tbody" tag
HTML_FONT_COLOR_BLUE (0.1 points) BODY: HTML font color is blue
HTML_SHOUTING5 (0.0 points) BODY: HTML has very strong "shouting" markup
MSGID_OUTLOOK_TIME (4.4 points) Message-Id is fake (in Outlook Express format)
DATE_IN_PAST_06_12 (0.5 points) Date: is 6 to 12 hours before Received: date
MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts
MANY_EXCLAMATIONS (0.8 points) Subject has many exclamations
The original message did not contain plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_3E7F5B3F.B3FD0F63
Content-Type: message/rfc822
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received: from localhost ([127.0.0.1])
\tby ganymede.tranquillity.lan with esmtp (Exim 3.36 #1 (Debian))
\tid 18xXXn-0001ip-00
\tfor <peter@localhost>; Mon, 24 Mar 2003 19:23:39 +0000
Received: from pop.ntlworld.com [62.253.162.51]
\tby localhost with POP3 (fetchmail-5.9.11)
\tfor peter@localhost (single-drop); Mon, 24 Mar 2003 19:23:39 +0000 (GMT)
Received: from attbi.com ([200.252.129.26]) by mta03-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20030324192121.GFHS11246.mta03-svc.ntlworld.com@attbi.com>;
Mon, 24 Mar 2003 19:21:21 +0000
Message-ID: <001111b8cc64$caa20837$46267438@mqbvh.of>
From: <macbug@attbi.com>
To: <peter.bonthrone@ntlworld.com>
Cc: <peter.clarke14@ntlworld.com>,
\t<peter.marsh1@ntlworld.com>,
\t<peter.parker@ntlworld.com>,
\t<peter.whysall@ntlworld.com>,
\t<jhsollerton@ntlworld.com>,
\t<jill.obc@ntlworld.com>,
\t<jim.blanchard@ntlworld.com>,
\t<jim.neville@ntlworld.com>,
\t<jim.parkes@ntlworld.com>
Subject: Size DOES matter! Enlarge your penis NOW!
Date: Mon, 24 Mar 2003 16:19:40 +0300
MIME-Version: 1.0
Content-Type: text/html;
\tcharset="us-ascii"
X-Priority: 1
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Importance: Normal
Long spam email about increasing penis size here
