SPAMS which I receive very low scores

[Trevor Dodds <sp...@johncom.net>]

Hi,
 
I've attached a few spam emails which I receive.  I'm using latest
sa-update channel rules, SARE, DCC, RAZOR2, Pyzor, Bayes, Fred's
collection.  Yet these SPAM emails always seem to get past.  I use
sa-learn on these emails everyday yet Bayes still allocated 0 to them.
I TAG spam at a score of 7.0
Can someone run these emails through your filter and let me know the
score.

X-Spam-Score: 3.204 (***)
BAYES_00,EXTRA_MPART_TYPE,FH_RELAY_NODNS,HTML_MESSAGE,MY_CID_AND_STYLE,S
ARE_GIF_ATTACH,TVD_FW_GRAPHIC_NAME_LONG

X-Spam-Score: 1.404 (*)
BAYES_00,EXTRA_MPART_TYPE,FH_RELAY_NODNS,HTML_MESSAGE,MY_CID_AND_STYLE,S
ARE_GIF_ATTACH

X-Spam-Score: 3.019 (***)
BAYES_00,EXTRA_MPART_TYPE,HELO_DYNAMIC_DHCP,HTML_MESSAGE,MY_CID_AND_STYL
E,SARE_GIF_ATTACH


Thanks
Trevor 
 
This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored.  
 
Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

Re: SPAMS which I receive very low scores

[Theo Van Dinter <fe...@apache.org>]

On Tue, Jan 23, 2007 at 07:40:34AM +0200, Trevor Dodds wrote:
> Can someone run these emails through your filter and let me know the
> score.

Sure.  The three mails were destroyed.

Just scoreset 2 (ie: no network tests):

[23912] dbg: check: is spam? score=18.42 required=5
[23912] dbg: check: tests=ACCESSDB,BAYES_99,EXTRA_MPART_TYPE,HTML_20_30,HTML_MESSAGE,MSGID_DOLLARS,RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME,TVD_FW_GRAPHIC_NAME_LONG
[23933] dbg: check: is spam? score=17.02 required=5
[23933] dbg: check: tests=BAYES_60,EXTRA_MPART_TYPE,HTML_20_30,HTML_MESSAGE,MSGID_DOLLARS,PART_CID_STOCK_LESS,RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME,TVD_FW_GRAPHIC_ID1,TVD_FW_GRAPHIC_NAME_LONG
[23936] dbg: check: is spam? score=16.22 required=5
[23936] dbg: check: tests=BAYES_80,EXTRA_MPART_TYPE,HTML_20_30,HTML_MESSAGE,MSGID_DOLLARS,PART_CID_STOCK_LESS,RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME,TVD_FW_GRAPHIC_ID1

Scoreset 3:

[23970] dbg: check: is spam? score=17.295 required=5
[23970] dbg: check: tests=ACCESSDB,BAYES_99,EXTRA_MPART_TYPE,HTML_MESSAGE,MSGID_DOLLARS,RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,TVD_FW_GRAPHIC_NAME_LONG
[23988] dbg: check: is spam? score=16.895 required=5
[23988] dbg: check: tests=BAYES_60,EXTRA_MPART_TYPE,HTML_MESSAGE,MSGID_DOLLARS,PART_CID_STOCK_LESS,RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME,RCVD_IN_BL_SPAMCOP_NET,TVD_FW_GRAPHIC_ID1,TVD_FW_GRAPHIC_NAME_LONG
[23990] dbg: check: is spam? score=12.595 required=5
[23990] dbg: check: tests=BAYES_80,EXTRA_MPART_TYPE,HTML_MESSAGE,MSGID_DOLLARS,PART_CID_STOCK_LESS,RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME,TVD_FW_GRAPHIC_ID1

Re: SPAMS which I receive very low scores

[Matt Kettler <mk...@verizon.net>]

Trevor Dodds wrote:
> Hi,
>  
> I've attached a few spam emails which I receive.  I'm using latest
> sa-update channel rules, SARE, DCC, RAZOR2, Pyzor, Bayes, Fred's
> collection.  Yet these SPAM emails always seem to get past.  I use
> sa-learn on these emails everyday yet Bayes still allocated 0 to them.
> I TAG spam at a score of 7.0
> Can someone run these emails through your filter and let me know the
> score.
>
> X-Spam-Score:
Those are all classic "image" spams. The best way to deal with them is
the imageinfo or if you don't might the heavy CPU load, fuzzyocr plugins
for SA 3.1.0 and higher.

It also looks like you need to do some bayes training, these are all
getting BAYES_00 for you.. not so good.

Make sure your SARE set includes the "stocks" rulset, that's a good one
for these.

Make sure that if you use network tests, your trust path is set
correctly, XBL will detect lots of image spams.