> No, neither of those seems to be the culprit. Actually 6 out of the 14 messages in your corpus are from these people. They frequently change URLs so it's hard to recognize them. But they all have the same sparse format and similar URLs that match some of the rules I posted. They tend to be affiliate spam - the URLs redirect you to a legitimate business (such as Columbia House) using an affiliate code that makes them money.
They also tend to match the CTYPE_JUST_HTML and WEB_BUGS rules, both of which have near-zero scores in 2.43. I raise the score on both of those locally because they don't cause false positives for me. These folks are serious spammers. They even register each of the domain names to look legit. Look up findhsm-list-cluster-182-643.com or any of the others, they're all registered to Daily Promotions. (It's a shame a WHOIS lookup would be expensive, or this would make an excellent eval test.) From: MyChoice <[EMAIL PROTECTED]> Subject: Keep your partner coming back for more. From: HolidayCard <[EMAIL PROTECTED]> Subject: It's all about keeping in touch From: RC Mini Racer <[EMAIL PROTECTED]> Subject: Save $10 on Holiday's Hottest Toy - Sold Out in Stores From: Alicia <[EMAIL PROTECTED]> Subject: Thicker, Fuller hair today! From: CD Collection <[EMAIL PROTECTED]> Subject: 12 CDs for ''Free'' plus shipping and processing From: FastFeedback <[EMAIL PROTECTED]> Subject: E-mail to Groups? Download ZIM FastFeedback Now to Coordinate E-mail Responses -- Michael Moncur mgm at starlingtech.com http://www.starlingtech.com/ "Fashion is something that goes in one year and out the other." --Unknown ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
