You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris Lear <ch...@laculine.com> on 2006/05/12 10:35:59 UTC
Can spamassassin stop this?
I run a fairly uncompromising spamassassin, which rejects mail scoring
5.5 or above (and in my own mailbox, I treat anything scoring over 0 as
suspect). I find that almost all false negatives that slip through are
the result of a not-perfectly-trained site-wide bayes database
[Basically, I train it, so it works well for me. Hardly anyone else
bothers]. I run lots of network tests, which work really well.
But this e-mail looks like it would never get blocked. Does sa have a
hope against this, or have the spammers finally come up with something
that can't be filtered? Even with BAYES_99 (default score 3.5) it would
score just under 5.5.
This is the first time I've noticed a spam e-mail that I can't see how
spamassassin could kill.
Chris
=========================================================================
Return-path: <ad...@amico.org>
Envelope-to: chris.lear@laculine.com
Delivery-date: Fri, 12 May 2006 04:52:03 +0100
Received: from bzq-88-155-227-248.red.bezeqint.net ([88.155.227.248])
by marvin.thomasmurray.com with smtp (Exim 4.54)
id 1FeOh7-0001os-6a
for chris.lear@laculine.com; Fri, 12 May 2006 04:52:03 +0100
From: "kalyn kari" <ad...@amico.org>
To: "dacia katelin" <ch...@laculine.com>
Subject: Was it love, or was it the thought of being in love?
Date: Fri, 12 May 2006 03:52:03 +0000
Message-ID: <cB...@localhost>
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Mailer: PHP/4.4.0
X-Marvin-Spam-Score: 1.9
X-Marvin-Spam-Level: +
X-Marvin-Spam-Report: Marvin spam report: Score = 1.9.
Tests=BAYES_50=0.001,HTML_MESSAGE=0.001,MIME_HTML_ONLY=0.001,RCVD_IN_NJABL_DUL=1.946
X-Marvin-AntiVirus: Clean
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
Hullo!<br><br>
[E]rectile<br>
[D]ysfunction?<br><br>
We can help! Our site: <b>ochhorfando</b>[dot]<b>com</b> ;) Don't forget
to replace "<b>[dot]</b>" to "<b>.</b>"<br><br>
---<br>
cigarette after another and extinguishing them on the edge of a
full ash tray, with Dolly, and with the old prince, where there
was talk about dinner, about politics, about Marya Petrovna's
illness, and where Levin suddenly forgot for a minute what was
happening, and felt as though he had waked up from sleep; the
other was in her presence, at her pillow, where his heart seemed
breaking and still did not break from sympathetic suffering, and
he prayed to God without ceasing. And every time he was brought
back from a moment of oblivion by a scream reaching him from the
</body></html>
Re: Can spamassassin stop this?
Posted by Loren Wilton <lw...@earthlink.net>.
> Received: from bzq-88-155-227-248.red.bezeqint.net ([88.155.227.248])
> by marvin.thomasmurray.com with smtp (Exim 4.54)
Why are you receiving stuff directly from someone else's dialup without
giving it a few points? (At least I assume it is dialup/dsl, given the form
of host name.)
Ah. I see you are giving it just shy of 2 points. That would get you close
to 5.5 points with a bayes_99.
There were a couple of things in the text that could have rules written for
them, but they would need to be tested against possible FPs.