Lower detection rates

["Carnegie, Martin" <Ma...@atcoitek.com>]

Hi All,

In the past 3 weeks or so, we have really noticed a decrease in the detection rate for spam.  We have not changed our system other than upgrading to 3.0.3 to see if it would help.  We have turned on URIBL and SURLB and also have the following custom rules in place:

70_sare_adult.cf
70_sare_genlsubj0.cf
70_sare_header0.cf
70_sare_html0.cf
70_sare_obfu0.cf
70_sare_specific.cf
99_chickenpox.cf
99_custom.cf
99_mangled.cf
99_sare_fraud_post25x.cf
99_weeds.cf

Hopefully this is everything you need :)

This is a sample of what is getting in.

Microsoft Mail Internet Headers Version 2.0
Received: from atcoinss.atco.ca ([192.210.9.70]) by is030.atco.com with Microsoft SMTPSVC(5.0.2195.6713);
	 Wed, 8 Jun 2005 22:15:58 -0600
Received: from atcoinss.atco.ca ([192.210.5.122])
 by atcoinss.atco.ca (SMSSMTP 4.0.0.59) with SMTP id M2005060822155726541
 for <an...@atcoelectric.com>; Wed, 08 Jun 2005 22:15:57 -0600
Received: from [218.81.247.57] (helo=oldbuthealthy.com)
	by atcoinss.atco.ca with smtp (Exim )
	for angela.delich@atcoelectric.com
	id 1DgESR-0001v0-B7; Wed, 08 Jun 2005 22:15:57 -0600
Message-ID: <83...@oldbuthealthy.com>
Date: Wed, 08 Jun 2005 18:44:17 +0900
Reply-To: "man orendorff" <po...@oldbuthealthy.com>
From: "man orendorff" <po...@oldbuthealthy.com>
User-Agent: 8.0 for Windows sub 6014
MIME-Version: 1.0
To: "Josh Catrett" <an...@atcoelectric.com>
Subject: Choose a better site for less, quality taablets made by leading manufacturers.
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on atcoinss.atco.ca
X-Spam-Level: ****
X-Spam-Status: No, score=4.1 required=5.0 tests=DATE_IN_PAST_12_24,
	SARE_USERAG_3 autolearn=disabled version=3.0.3
Return-Path: posib@oldbuthealthy.com
X-OriginalArrivalTime: 09 Jun 2005 04:15:58.0035 (UTC) FILETIME=[EFEAEA30:01C56CA9]

At our licensed chemist-site, customers can choose from a wide selection of
brand name and generic medicals. It is legitimate to shoppe for rxmeds in
this way.

For customers from different countries, the company provides the same
timely and reliable distribution services.

Select our store for leading rxdrugs on Pain, Erectile muscle Dysfunction,
Stress, Man's care, Sleeping Disorder, Obesity and other disorders.


http://vrhp.a.effectivereliefforall.com/koop/


It is easier to pocket moola on rxdrugs at our store.



 so much as I could wish. But Mr. e!  May be his si  at a third could
resist it with energy  Copperfield was teaching mester is wo rse at   -'
¡¡¡¡('Much he knew about it hiAvignon, a mself!') said Miss Betsey in a 
ach, and I inquired after the Castle and the Aged parenthesis. ¡¡¡¡- 'And I
hop e I should have .  In one thing, howeve  improved, being very anxio us
to learn, and he very

Re: Lower detection rates

[Andy Jezierski <aj...@stepan.com>]

"Carnegie, Martin" <Ma...@atcoitek.com> wrote on 06/09/2005 
12:09:20 PM:

> Hi All,
> 
> In the past 3 weeks or so, we have really noticed a decrease in the 
> detection rate for spam.  We have not changed our system other than 
> upgrading to 3.0.3 to see if it would help.  We have turned on URIBL
> and SURLB and also have the following custom rules in place:
> 
[snip]

Are you sure your network test are working?  That message scored very high 
on my system, although my SURBL scores have been bumped up.

X-Spam-Status: Yes, score=19.4 required=5.7 
tests=BAYES_80,DATE_IN_PAST_12_24,
 RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SARE_RECV_IP_218078,SARE_USERAG_3,
        TW_RX,URIBL_OB_SURBL,URIBL_SBL autolearn=unavailable version=3.0.2

May want to check that your Net::DNS is up to date.

Andy