At Sat Oct 12 19:05:58 2002, Steve Thomas wrote: > > The attached spam came through with only 3.3 points using SA 2.42. It's > the second message I've received in three days which obviously came from > the same source and scored under the default of 5 points. Even when I > was running with a required_hits of 4, these still would've snuck > through. > > Two of the rules that it triggered were USER_AGENT_MUTT and > USER_AGENT_OE. This was obviously intended to get around SA or other > filters.
I've just received something similar, but with a different message body. It matched both USER_AGENT_MUTT (-1.2) and USER_AGENT_OE (+0.2). And also like your spam, it had a date in the subject line (-1.6). And an In-Reply-To header (-0.8). It got an extra +1.0 from my "claims to be Outlook/OE but message-id is in wrong format" rule, but that still only took it up to 4.0. > Should there be a rule for messages which claim to have two different > clients generating it? I don't think it would hurt to do that. No legitimate mail should meet that criterion. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
