Re: No hit on this..

2006-11-08 Thread Loren Wilton
The SARE stocks ruleset would have caught this thing too, I suspect. Loren

Re: No hit on this..

2006-11-07 Thread Anders Norrbring
Randal, Phil skrev: We got a bunch of these slip through as low-scoring. This rule helps - score as you see fit: header SPAMMER_HERESubject =~ /here \:\)$/ describe SPAMMER_HERESpammer here scoreSPAMMER_HERE4 Phil Thanks Phil! That simple rule pushes these mails

Re: No hit on this..

2006-11-07 Thread Ilan Aisic
I'm also getting a lot of variations on this spam trying to promote some junk stock.  Every time a different name is in the subject like "Demetrius here :)"  or "Mabel here :)" and of course the "From:" is different. RAZOR and DCC catch most of them but some slip through. One even managed to t

Re: No hit on this..

2006-11-07 Thread Kelson
Razor, DCC, and Bayes have been catching these handily here, with occasional header tests. They've all hit in the 5.5-10 range. I think this is the next stage of the "So-and-so wrote:" spams, which would explain where my Bayes DB got the data. -- Kelson Vibber SpeedGate Communications

[SOLVED - Idiot inside] Re: No hit on this..

2006-11-07 Thread Anders Norrbring
Anders Norrbring skrev: James Lay skrev: On Tue, 07 Nov 2006 14:51:01 +0100 Anders Norrbring <[EMAIL PROTECTED]> wrote: I don't get any points or hits on the following mail (source code) [8<] I don't even see any SpamAssassin headers on this thing saying one way or the otherdid this

Re: No hit on this..

2006-11-07 Thread Anders Norrbring
Martin Hepworth skrev: Anders Norrbring wrote: Anders heres my analysis Content analysis details: (12.0 points, 5.0 required) pts rule name description -- -- 0.7 HOST_EQ_D_D_D_DHOST_EQ_D_D_D_D

Re: No hit on this..

2006-11-07 Thread Anders Norrbring
James Lay skrev: On Tue, 07 Nov 2006 14:51:01 +0100 Anders Norrbring <[EMAIL PROTECTED]> wrote: I don't get any points or hits on the following mail (source code) [8<] I don't even see any SpamAssassin headers on this thing saying one way or the otherdid this actually get piped throug

RE: No hit on this..

2006-11-07 Thread Randal, Phil
We got a bunch of these slip through as low-scoring. This rule helps - score as you see fit: header SPAMMER_HERESubject =~ /here \:\)$/ describe SPAMMER_HERESpammer here scoreSPAMMER_HERE4 Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK >

RE: No hit on this..

2006-11-07 Thread Robert Swan
users@spamassassin.apache.org Subject: Re: No hit on this.. On Tue, 07 Nov 2006 14:51:01 +0100 Anders Norrbring <[EMAIL PROTECTED]> wrote: > I don't get any points or hits on the following mail (source code) > > Return-Path: <[EMAIL PROTECTED]> > Received: from mail.the-server.net

Re: No hit on this..

2006-11-07 Thread James Lay
On Tue, 07 Nov 2006 14:51:01 +0100 Anders Norrbring <[EMAIL PROTECTED]> wrote: > I don't get any points or hits on the following mail (source code) > > Return-Path: <[EMAIL PROTECTED]> > Received: from mail.the-server.net (192.168.222.210 [192.168.222.210]) > by iris (Cyrus v2.1.15) with LM

Re: No hit on this..

2006-11-07 Thread Martin Hepworth
Anders Norrbring wrote: Anders heres my analysis Content analysis details: (12.0 points, 5.0 required) pts rule name description -- -- 0.7 HOST_EQ_D_D_D_DHOST_EQ_D_D_D_D 0.9 HOST_EQ_D_D_D_DB