At Tue Sep 24 05:24:18 2002, Simon Matthews wrote: > > Attached is a gzip version of Nigerian scam. Using SA 2.31, it only scored > 2.6. > > Anyone care to look at it?
It scored 3.4 with 2.41, though of course there were no headers which might have changed this. To my untutored eye, I think the main problem was that none of the rules looking for large sums of money were triggered (i.e. US_DOLLARS*) I don't understand the regexps well enough to work out what could be changed here. One thing I have noticed about these Nigerian scams is that they frequently use the word "modalities" - a word I've never seen anywhere other than in this type of mail. Perhaps a rule that catches just this word might be worthwhile. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
