You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ed Kasky <ed...@esson.net> on 2004/10/01 15:07:26 UTC
FN's with 3.0.0
I have had 13 FN's since upgrading to 3.0.0 on Sunday. This is a
substantial increase from the one or two I used to get weekly.
I have included the text of the most recent one below. They are all
scoring betwee 3 and 4 and are all formatted pretty much like this one.
I am going to go through them this weekend and see if I can find a pattern
to the rule hits and increase them. Anyone have any other sugestions?
Ed
. . . . . . . . . . . . . . .
Randomly generated quote:
Yesterday is a canceled check; tomorrow is a promissory note;
today is the only cash you have. Spend it wisely.
---------- Forwarded message ----------
Return-Path: <mi...@flawlessorganization.com>
Received: from moxmail06.flawlessorganization.com
(moxmail-1-41.flawlessorganization.com [64.237.3.41])
by wrenkasky.com (8.12.11/8.12.11) with ESMTP id i91CaWps022097
for <ed...@esson.net>; Fri, 1 Oct 2004 05:36:33 -0700
Received: from flawlessorganization.com (localhost.localdomain [127.0.0.1])
by moxmail06.flawlessorganization.com (Postfix) with ESMTP id
02C806710D54D
for <ed...@esson.net>; Fri, 1 Oct 2004 05:36:15 -0700 (PDT)
MIME-Version: 1.0
From: "Christian Singles" <mi...@flawlessorganization.com>
To: ed@esson.net
Subject: Meet quality Christians
Message-Id: <10...@flawlessorganization.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Date: Fri, 1 Oct 2004 05:36:15 -0700 (PDT)
X-Spam-Status: No, score=3.7 required=6.9 tests=ALL_TRUSTED,BAYES_60,
DCC_CHECK,EVILNUMBER_A_2XX_1,EXCUSE_6,SARE_SXLIFE autolearn=no
version=3.0.0
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on
yoda2.wrenkasky.com
X-Spam-Level: ***
Are you Christian? Are you Single? We have the solution for you! At WhereChristiansMeet, you can meet like-minded Christians that are also single! This isn't an ONLINE dating site full of fake profiles! These are REAL PEOPLE just like you. Click the link below and meet someone REAL today!
Click Here: http://flawlessorganization.com/r/2307/8223547/252408859574
This service is only for Christian Singles, so you are sure to meet others who have the same perspective on life as you do, visit us today.
Click Here: http://flawlessorganization.com/r/2307/8223547/252408859574
Are you tired of sifting through thousands of profile and NOT finding anyone who meets your standards? We are absolute Romance Professionals! Let us solve your problem! We guarantee to find your PERFECT match.
Click Here: http://flawlessorganization.com/r/2307/8223547/252408859574
Don't delay, your perfect match is only ONE click away!
Click Here: http://flawlessorganization.com/r/2307/8223547/252408859574
The above is an advertisement sent by a FindRomance affiliate. If you have any questions or concerns, you may contact us at the following address:
FindRomance, 1054 Centre St. Suite 214, Thornhill, ON, L4J8E5
If you wish to remove yourself from further FindRomance mailings please visit our site.
This advertisement was sent by BonusBonez, 268 Bush Street #3437, San Francisco, CA 94104.
Visit the BonusBonez Mailings Manager:
http://flawlessorganization.com/u/2307/8223547/252408859574
MO:
bbqGCjbAkNLBLvQ2cog33Jr42okJjlk81nMhMezwm4MqrmDp5hL57DMF7nHEvg==
:MO
Re: FN's with 3.0.0
Posted by Gregory Zornetzer <ga...@nmrfam.wisc.edu>.
Hi Ed,
On Fri, 1 Oct 2004, Ed Kasky wrote:
> I have had 13 FN's since upgrading to 3.0.0 on Sunday. This is a
> substantial increase from the one or two I used to get weekly.
>
> I have included the text of the most recent one below. They are all
> scoring betwee 3 and 4 and are all formatted pretty much like this one.
<snipped>
> ---------- Forwarded message ----------
> Return-Path: <mi...@flawlessorganization.com>
> Received: from moxmail06.flawlessorganization.com
> (moxmail-1-41.flawlessorganization.com [64.237.3.41])
> by wrenkasky.com (8.12.11/8.12.11) with ESMTP id i91CaWps022097
moxmail-1-41.flawlessorganization is a real address, so the header doesn't
look like it was forged. Maybe this was sent with legitimate bulk-mailing
software, whereas SpamAssassin really goes after spams with obfuscated
headers and return addresses.
> for <ed...@esson.net>; Fri, 1 Oct 2004 05:36:33 -0700
> Received: from flawlessorganization.com (localhost.localdomain [127.0.0.1])
> by moxmail06.flawlessorganization.com (Postfix) with ESMTP id
> 02C806710D54D
> for <ed...@esson.net>; Fri, 1 Oct 2004 05:36:15 -0700 (PDT)
> MIME-Version: 1.0
> From: "Christian Singles" <mi...@flawlessorganization.com>
> To: ed@esson.net
> Subject: Meet quality Christians
> Message-Id: <10...@flawlessorganization.com>
> Content-Type: text/plain
> Content-Disposition: inline
> Content-Transfer-Encoding: 7bit
> Date: Fri, 1 Oct 2004 05:36:15 -0700 (PDT)
> X-Spam-Status: No, score=3.7 required=6.9 tests=ALL_TRUSTED,BAYES_60,
> DCC_CHECK,EVILNUMBER_A_2XX_1,EXCUSE_6,SARE_SXLIFE autolearn=no
> version=3.0.0
> X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on
> yoda2.wrenkasky.com
> X-Spam-Level: ***
>
There's also not a bunch of HTML tags or weird words and phrases at the
beginning, so it passes through most of the rules. The website appears to
be in the USA, so perhaps this is one of the few bulk emailers who is
fully CAN-SPAM compliant? Or maybe it's just the latest from the
spammers... Use a CAN-SPAM compliant email to generate their lists of
addresses from the remove requests.
One thing that I did notice was that the domain flawlessorganization.com
is literally 1 week old according to whois, created September 24, 2004.
Perhaps someone could write a module that penalizes email from domains
that have been created recently? This would give Bayes some time to
"catch up".
Again, noting below that the web links are all for the same domain as the
email came from. This is perhaps the least obfuscated spam that I've ever
seen (at least recently).
> Are you Christian? Are you Single? We have the solution for you! At WhereChristiansMeet, you can meet like-minded Christians that are also single! This isn't an ONLINE dating site full of fake profiles! These are REAL PEOPLE just like you. Click the link below and meet someone REAL today!
>
> Click Here: http://flawlessorganization.com/r/2307/8223547/252408859574
>
-Greg