You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jonathan Nichols <jn...@pbp.net> on 2005/02/10 21:34:36 UTC
Humor: "The Ultimate Spam Email"
This oughta replace GTUBE!
http://lowendmac.com/lite/05/0210.html
Re: Humor: "The Ultimate Spam Email"
Posted by Kris Deugau <kd...@vianet.ca>.
Jonathan Nichols wrote:
> This oughta replace GTUBE!
>
> http://lowendmac.com/lite/05/0210.html
Heh. I spent an afternoon going through SA tests and very carefully
assembling a spam that would trip as many tests as possible. I copied
headers from a message that tripped all kinds of RBLs, I copied content
from some particularly amusing spams, and I invented new content to hit
as many rules as possible.
I tested it and it came up with a score over 80, and I hadn't gone over
more than about 1/5 of the rules at most...
-kgd
--
Get your mouse off of there! You don't know where that email has been!
Re: Spamassassin with sa-learn
Posted by Kris Deugau <kd...@vianet.ca>.
Tinni wrote:
> Here my qs. is when a mail is coming to the server , suppose, for
> *user2* or many others, will the spamassassin check the mails for
> ham/spam with the *default* database which is bydefault set to
> *user1* ? or it will check only for the mails of *user1* ? I am
> little bit confused here.
I don't have your original message, but IIRC you said you're calling
SpamAssassin from procmail. This implies that you're doing so just
before the message is put into a mail folder (whether that's the inbox
for a user or elsewhere is determined by procmail). On most mail
systems, this *also* means that mail processing is done one message at a
time, for one recipient at a time.
As I said in my first reply, if you want a single global Bayes database
you **MUST** at the very minimum put a bayes_path statement in one of
your local configuration files - local.cf is most commonly used.
When a message is processed by SA, with that bayes_path statement in
place, *ALL* Bayes activity is done on that global database.
> As i understand that individual users_prefs will supercede the
> value of the global parameter settings.
For certain settings, yes. See the man page for
Mail::SpamAssassin::Conf for the details on which ones.
> So does this concept is for bayes database also?
IIRC, no; bayes* options are considered "priviledged" settings. Check
the man page on your installed SpamAssassin copy to be certain for your
usage.
> If yes, then the bayes default databaes whatever learned (spam + ham)
> for default user *user1* will not work for the other users - is this
> so?
Assuming that bayes* options are not priviledged, then yes, any user
could stick in a bayes_path statement and avoid the global database.
Otherwise, all users will refer to the global database.
> I want simply that the default path where i am seeing spamassassin
> is updatijng/working will be applicable for all the users.
Please see the suggestions at the bottom of my first reply, and refer to
the man page to make sure you have the settings laid out correctly for
your installed version of SA.
Those settings have been working on one of my systems for several years
now.
-kgd
--
Get your mouse off of there! You don't know where that email has been!
Re: Spamassassin with sa-learn
Posted by Tinni <t_...@yahoo.co.in>.
Hi
Thanks for your reply.
>>OK, looks good. SA puts preferences and AWL data and >>Bayes data files in ~/.spamassassin/ by default.
I am sorry if my qs sounds little bit funny but as i am new so i have some confusions.
Here my qs. is when a mail is coming to the server , suppose, for *user2* or many others, will the spamassassin check the mails for ham/spam with the *default* database which is bydefault set to *user1* ? or it will check only for the mails of *user1* ? I am little bit confused here.
As i understand that individual users_prefs will supercede the value of the global parameter settings. So does this concept is for bayes database also? If yes, then the bayes default databaes whatever learned (spam + ham) for default user *user1* will not work for the other users - is this so?
I want simply that the default path where i am seeing spamassassin is updatijng/working will be applicable for all the users.
Suggessions/advice is really appreciated.
Thanks again
-Tinni
Kris Deugau <kd...@vianet.ca> wrote: Please post messages in plaintext in the future. Thanks.
Tinni wrote:
> I am little bit confused of *sa-learn*. I have installed SA 3.02. I
> did not set any bayes path in local.cf . When i am checking with
>
> #spamassassin -lint -D
>
> it is showing a path as
[snip]
< debug: bayes: 7103 tie-ing to DB file R/O
> /home/sites/www.domain.org/users//.spamassassin/bayes_toks
> debug: bayes: 7103 tie-ing to DB file R/O
> /home/sites/www.domain.org/users//.spamassassin/bayes_seen
OK, looks good. SA puts preferences and AWL data and Bayes data files
in ~/.spamassassin/ by default.
> I am executing the *sa-learn* as root, So do you think that the
> central database for bayes is the aboove path?
No, if you run sa-learn as root it will, like any other default SA call,
put Bayes data in ~/.spamassassin/. In particular, it will create
/root/.spamassassin/bayes_seen and /root/.spamassassin/bayes_toks.
> Also i am seeing that
> the individual users's bayes database also updated. but i am not
> allowing ANYBODY to execute the *sa-learn*.
> - Though no user is executing the *sa-learn* then how every
> userid bayes database is being updated ? (i am telling only
> seeing the time stapm)
This is due to SpamAssassin's autolearning capability; by default
messages scoring under 0.1 or over 12 (IIRC, check the documentation)
will get autolearned as ham or spam respectively. Each user's
autolearned Bayes data will be put in the appropriate files in
~user/.spamassassin/.
> I want that the mail
> will be filtered through the *central database* only.
> - Do i need to mention the path of bayes db in the local.cf?
If you want a single, global Bayes database, you **MUST** set bayes_path
in your configuration.
For instance, on one of the systems I administer, I have the following
in my local.cf to set up SA's Bayes subsystem:
use_bayes 1
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam -0.01
bayes_learn_to_journal 1
bayes_expiry_max_db_size 1000000
bayes_auto_expire 0
bayes_path /var/SpamAssassin/bayes
bayes_file_mode 0777
I've explicitly set a number of options to their defaults as well, but
this provides me with a single, global Bayes database, accessible and
autolearn-able for all users, with a larger number of tokens than the
default. Check the Mail::SpamAssassin::Conf manpage for details on what
these options do. Note that some of them may have changed for 3.x;
this is a working 2.64 install.
-kgd
--
Get your mouse off of there! You don't know where that email has been!
Yahoo! India Matrimony: Find your life partneronline.
Re: Spamassassin with sa-learn
Posted by Kris Deugau <kd...@vianet.ca>.
Please post messages in plaintext in the future. Thanks.
Tinni wrote:
> I am little bit confused of *sa-learn*. I have installed SA 3.02. I
> did not set any bayes path in local.cf . When i am checking with
>
> #spamassassin -lint -D
>
> it is showing a path as
[snip]
< debug: bayes: 7103 tie-ing to DB file R/O
> /home/sites/www.domain.org/users/<user>/.spamassassin/bayes_toks
> debug: bayes: 7103 tie-ing to DB file R/O
> /home/sites/www.domain.org/users/<user>/.spamassassin/bayes_seen
OK, looks good. SA puts preferences and AWL data and Bayes data files
in ~<user>/.spamassassin/ by default.
> I am executing the *sa-learn* as root, So do you think that the
> central database for bayes is the aboove path?
No, if you run sa-learn as root it will, like any other default SA call,
put Bayes data in ~<user>/.spamassassin/. In particular, it will create
/root/.spamassassin/bayes_seen and /root/.spamassassin/bayes_toks.
> Also i am seeing that
> the individual users's bayes database also updated. but i am not
> allowing ANYBODY to execute the *sa-learn*.
> - Though no user is executing the *sa-learn* then how every
> userid bayes database is being updated ? (i am telling only
> seeing the time stapm)
This is due to SpamAssassin's autolearning capability; by default
messages scoring under 0.1 or over 12 (IIRC, check the documentation)
will get autolearned as ham or spam respectively. Each user's
autolearned Bayes data will be put in the appropriate files in
~user/.spamassassin/.
> I want that the mail
> will be filtered through the *central database* only.
> - Do i need to mention the path of bayes db in the local.cf?
If you want a single, global Bayes database, you **MUST** set bayes_path
in your configuration.
For instance, on one of the systems I administer, I have the following
in my local.cf to set up SA's Bayes subsystem:
use_bayes 1
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam -0.01
bayes_learn_to_journal 1
bayes_expiry_max_db_size 1000000
bayes_auto_expire 0
bayes_path /var/SpamAssassin/bayes
bayes_file_mode 0777
I've explicitly set a number of options to their defaults as well, but
this provides me with a single, global Bayes database, accessible and
autolearn-able for all users, with a larger number of tokens than the
default. Check the Mail::SpamAssassin::Conf manpage for details on what
these options do. Note that some of them may have changed for 3.x;
this is a working 2.64 install.
-kgd
--
Get your mouse off of there! You don't know where that email has been!
Spamassassin with sa-learn
Posted by Tinni <t_...@yahoo.co.in>.
Hi
I am little bit confused of *sa-learn*. I have installed SA 3.02. I
did not set any bayes path in local.cf . When i am checking with
#spamassassin -lint -D
it is showing a path as
_________________________________________
debug: using "/home/sites/www.domain.org/users/<user>/.spamassassin" for user
state dir
debug: using "/home/sites/www.domain.org/users/<user>/.spamassassin/user_prefs
" for user prefs file
debug: config: read file /home/sites/www.domain.org/users/<user>/.spamassassin
/user_prefs
debug: using "/home/sites/www.domain.org/users/<user>/.spamassassin" for user
state dir
debug: bayes: 7103 tie-ing to DB file R/O /home/sites/www.domain.org/users/<user>/.spamassassin/bayes_toks
debug: bayes: 7103 tie-ing to DB file R/O /home/sites/www.domain.org/users/<user>
/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: using "/home/sites/www.domain.org/users/<user>/.spamassassin" for user
state dir
debug: Score set 3 chosen.
_________________________________________
I am executing the *sa-learn* as root, So do you think that the central database
for bayes is the aboove path? Also i am seeing that the individual users's
bayes database also updated . but i am not allowing ANYBODY to execute the *sa-learn*.
I want that the mail will be filtered through the *central database* only.
I am using procmail with sendmail..
Here is my few questoins::
- Do i need to mention the path of bayes db in the local.cf?
- Or whatever way (default path) is being used that is also ok?
- Or do you think that only the user which i am getting while running with
--lint output will be benefited only by the bayes database learning?
- Though no user is executing the *sa-learn* then how every
userid bayes database is being updated ? (i am telling only
seeing the time stapm)
Suggession/advice.
Thanks in advance.
-tinni
Yahoo! India Matrimony: Find your life partneronline.
Re: Humor: "The Ultimate Spam Email"
Posted by Matias Lopez Bergero <ml...@udesa.edu.ar>.
good scoring here...
____
Content analysis details: (10.2 points, 5.0 required)
____
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 RCVD_BY_IP Received by mail server with no name
0.0 URG_BIZ BODY: Contains urgent matter
0.4 DIET_1 BODY: Lose Weight Spam
0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
1.0 SARE_OEM_SOFT_IS BODY: Software that is OEM
0.8 SARE_OEM_OEMCD BODY: Mentions a OEM cd
0.7 SARE_URGBIZ BODY: Contains urgent matter
2.2 NA_DOLLARS BODY: Talks about a million North
American dollars
0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.6 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: walla.com]
1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud
spam
2.9 NIGERIAN_BODY1 Message body looks like a Nigerian spam
message 1+
1.9 NIGERIAN_BODY3 Message body looks like a Nigerian spam
message 3+
1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud
spam
1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud
spam
1.6 MISSING_SUBJECT Missing Subject: header
0.5 NIGERIAN_BODY2 Message body looks like a Nigerian spam
message 2+
1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud
spam
-10 AWL AWL: From: address is in the auto white-list
RE: Humor: "The Ultimate Spam Email"
Posted by Sander Holthaus - Orange XL <in...@orangexl.com>.
> -----Original Message-----
> From: Thomas Arend [mailto:ml@arend-whv.info]
> Sent: Friday, February 11, 2005 1:41 PM
> To: users@spamassassin.apache.org
> Subject: Re: Humor: "The Ultimate Spam Email"
>
> Am Donnerstag, 10. Februar 2005 22:46 schrieb Jim Maul:
> > Mike Jackson wrote:
> > >> http://lowendmac.com/lite/05/0210.html
> > >
> > > I sent it to myself...
> > >
> > > X-Spam-Report:
> > > * 1.8 URG_BIZ BODY: Contains urgent matter
> > > * 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
> > > * 0.7 SARE_URGBIZ BODY: Contains urgent matter
> > > * 2.6 NA_DOLLARS BODY: Talks about a million North
> American dollars
> > > * 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
> > > * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> > > * [score: 0.0003]
> > > * 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
> > > * [URIs: walla.com]
> > > * 1.7 SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam
> > > * 1.7 SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam
> > > * 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam
> > > message 1+
> > > * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in
> fraud spam
> > > * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in
> fraud spam
> > > * 1.2 MISSING_SUBJECT Missing Subject: header
> > > * 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam
> > > message 2+
> > > * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in
> fraud spam
> > > * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in
> fraud spam
> > > * 1.7 SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam
> > > * 1.7 SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam
> > > * 1.7 SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam
> > > * 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam
> > > message 3+
> > > * 1.7 SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam
> > > * 0.9 SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam
> > > * -15 AWL AWL: From: address is in the auto white-list
> > >
> > > The AWL hit is because I sent it from my work address.
> The low Bayes
> > > score surprises me; my Bayes database should be loaded with crap
> > > like that.
> >
> > I just tried saving the text to a file and running spamc on it. It
> > didnt have any headers or anything but it still managed a score of
> > 10.6 on my system without any add on rules...pretty good i
> think. My
> > bayes hit with a BAYES_44.
> >
> > -Jim
>
> Without the SARE rules I got the following low scores. One
> rule is my own TA_Save_b01.
>
> Thomas
>
> Content analysis details: (6.0 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> -3.3 ALL_TRUSTED Did not pass through any untrusted hosts
> 1.8 URG_BIZ BODY: Contains urgent matter
> 0.5 TA_Save_b01 BODY: Promise to save
> 2.6 NA_DOLLARS BODY: Talks about a million North
> American dollars
> 0.4 US_DOLLARS_3 BODY: Mentions millions of $
> ($NN,NNN,NNN.NN)
> 0.0 BAYES_50 BODY: Bayesian spam probability
> is 40 to 60%
> [score: 0.5000]
> 0.6 NIGERIAN_BODY2 Message body looks like a
> Nigerian spam message 2+
> 3.4 NIGERIAN_BODY1 Message body looks like a
> Nigerian spam message 1+
> 0.1 NIGERIAN_BODY3 Message body looks like a
> Nigerian spam message 3+
X-Spam-Report:
* -0.0 SPF_PASS SPF: sender matches SPF record
* 2.3 MANGLED_FREE BODY: mangled free
* 0.3 OFFER BODY: Offers you Something
* 1.0 SARE_OEM_SOFT_IS BODY: Software that is OEM
* 0.8 SARE_OEM_OEMCD BODY: Mentions a OEM cd
* 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
* 1.8 URG_BIZ BODY: Contains urgent matter
* 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
* 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
* 0.7 SARE_URGBIZ BODY: Contains urgent matter
* 2.6 NA_DOLLARS BODY: Talks about a million North American dollars
* 1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam
message 1+
* 1.2 MISSING_SUBJECT Missing Subject: header
* 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam
message 2+
* 3.0 NIGERIAN_BODY_2 More Nigerian scum body content
* 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam
message 3+
* -7.0 AWL AWL: From: address is in the auto white-list
Scores pretty well (14.3, 9.0 required), though, I heard that SpamAssassin
3+ included the SARE_FRAUD rules (or similiar). But looking at the report, I
don't see any fraud-hits from SpamAssassin :-/
Would it be wise to re-add SARE_FRAUD as a extra ruleset to SpamAssassin?
Kind Regards,
Sander Holthaus
Re: Humor: "The Ultimate Spam Email"
Posted by Thomas Arend <ml...@arend-whv.info>.
Am Donnerstag, 10. Februar 2005 22:46 schrieb Jim Maul:
> Mike Jackson wrote:
> >> http://lowendmac.com/lite/05/0210.html
> >
> > I sent it to myself...
> >
> > X-Spam-Report:
> > * 1.8 URG_BIZ BODY: Contains urgent matter
> > * 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
> > * 0.7 SARE_URGBIZ BODY: Contains urgent matter
> > * 2.6 NA_DOLLARS BODY: Talks about a million North American dollars
> > * 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
> > * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> > * [score: 0.0003]
> > * 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
> > * [URIs: walla.com]
> > * 1.7 SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam
> > * 1.7 SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam
> > * 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+
> > * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam
> > * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam
> > * 1.2 MISSING_SUBJECT Missing Subject: header
> > * 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam message 2+
> > * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam
> > * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam
> > * 1.7 SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam
> > * 1.7 SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam
> > * 1.7 SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam
> > * 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam message 3+
> > * 1.7 SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam
> > * 0.9 SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam
> > * -15 AWL AWL: From: address is in the auto white-list
> >
> > The AWL hit is because I sent it from my work address. The low Bayes
> > score surprises me; my Bayes database should be loaded with crap like
> > that.
>
> I just tried saving the text to a file and running spamc on it. It
> didnt have any headers or anything but it still managed a score of 10.6
> on my system without any add on rules...pretty good i think. My bayes
> hit with a BAYES_44.
>
> -Jim
Without the SARE rules I got the following low scores. One rule is my own
TA_Save_b01.
Thomas
Content analysis details: (6.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-3.3 ALL_TRUSTED Did not pass through any untrusted hosts
1.8 URG_BIZ BODY: Contains urgent matter
0.5 TA_Save_b01 BODY: Promise to save
2.6 NA_DOLLARS BODY: Talks about a million North American dollars
0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5000]
0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam message 2+
3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+
0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam message 3+
--
icq:133073900
http://www.t-arend.de
Re: Humor: "The Ultimate Spam Email"
Posted by Jim Maul <jm...@elih.org>.
Mike Jackson wrote:
>> http://lowendmac.com/lite/05/0210.html
>
>
> I sent it to myself...
>
> X-Spam-Report:
> * 1.8 URG_BIZ BODY: Contains urgent matter
> * 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
> * 0.7 SARE_URGBIZ BODY: Contains urgent matter
> * 2.6 NA_DOLLARS BODY: Talks about a million North American dollars
> * 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
> * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> * [score: 0.0003]
> * 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
> * [URIs: walla.com]
> * 1.7 SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam
> * 1.7 SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam
> * 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+
> * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam
> * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam
> * 1.2 MISSING_SUBJECT Missing Subject: header
> * 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam message 2+
> * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam
> * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam
> * 1.7 SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam
> * 1.7 SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam
> * 1.7 SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam
> * 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam message 3+
> * 1.7 SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam
> * 0.9 SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam
> * -15 AWL AWL: From: address is in the auto white-list
>
> The AWL hit is because I sent it from my work address. The low Bayes
> score surprises me; my Bayes database should be loaded with crap like that.
>
>
I just tried saving the text to a file and running spamc on it. It
didnt have any headers or anything but it still managed a score of 10.6
on my system without any add on rules...pretty good i think. My bayes
hit with a BAYES_44.
-Jim
Re: Humor: "The Ultimate Spam Email"
Posted by Mike Jackson <mj...@barking-dog.net>.
> http://lowendmac.com/lite/05/0210.html
I sent it to myself...
X-Spam-Report:
* 1.8 URG_BIZ BODY: Contains urgent matter
* 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
* 0.7 SARE_URGBIZ BODY: Contains urgent matter
* 2.6 NA_DOLLARS BODY: Talks about a million North American dollars
* 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
* -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
* [score: 0.0003]
* 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
* [URIs: walla.com]
* 1.7 SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam
* 1.7 SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam
* 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+
* 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in fraud spam
* 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in fraud spam
* 1.2 MISSING_SUBJECT Missing Subject: header
* 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam message 2+
* 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in fraud spam
* 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in fraud spam
* 1.7 SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam
* 1.7 SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam
* 1.7 SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam
* 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam message 3+
* 1.7 SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam
* 0.9 SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam
* -15 AWL AWL: From: address is in the auto white-list
The AWL hit is because I sent it from my work address. The low Bayes score
surprises me; my Bayes database should be loaded with crap like that.