[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    Re: RE: More stock spam + strange cf files
From:       Ben Wylie <sassassin () benwylie ! co ! uk>
Date:       2007-02-09 22:55:24
Message-ID: 45CCFBDC.9010402 () benwylie ! co ! uk
[Download RAW message or body]

Chris Santerre wrote:
>  > These guys are just rolling in scott free except for bayes.
>  > See http://2chronicles36.org/stock.txt
>  >
>  > I'm using 3.1.7 with latest sa-update + FuzzyOCR.cf & KAM.cf
> 
> I must say, that a pretty well done spam. Whoever wrote it put some 
> thought into the phrasing. This one might take a bit. The wording is 
> gonna be hard to tag.
> 
I get a decent score on this. These are the rules it hit.

X-Spam-Status: Yes, score=10.4 version=3.1.7
X-Spam-Report:
*  2.0 BOTNET Relay might be a spambot or virusbot
*      [botnet0.7,ip=218.157.62.185,maildomain=gcpower.net,nordns]
*  2.7 SARE_PROLOSTOCK_SYM4 BODY: Last week's hot stock scam
*  1.7 SARE_LWSYMFMT BODY: SARE_LWSYMFMT
*  3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
*      [score: 1.0000]
*  0.6 HELO_MISMATCH_COM HELO_MISMATCH_COM

I don't know if these SARE rules have been written since you posted this 
email though...

Ben


[prev in list] [next in list] [prev in thread] [next in thread]