I'm new to SA and not using the devel version 2.50 but 2.43, so maybe this is already solved there? Lately, we are getting a LOT of spam from a vendor which seems to call itself HiSpeedMedia or HSM. They use several custom "list" domains (f.i. hsm2282jende119283000send.com, 4list-11873649hsm987.com, list11873649hsm987.com, hsmdatabaseclump182643, hsmlistcluster182643library.com) specifically registered just for spamming and "one-day use" and include an invalid HTML body which builds the message from images only. They seem to spam only email addresses they harvested from whois, I'm not getting this on other email accounts. Since there's not much text in them SA has only the header for some scoring and only achieves between 1 and 3.5, mostly around or less than 2. SA isn't able to detect even one of them as spam (using the default limit of 5) and, more or less, these count for most of the misses SA has on the spam. The Bayes-Filter in 2.50 may help on these but I also think about some improvements in the "normal" parsing. F.i. counting the images and the hrefs in an HTML block and exposing this as HTML_IMAGE_COUNT or so might be worthwhile, so that we could then give it easily a score. What do you think?
Here's a sample, it scores in these areas (DATE_IN_PAST_06_12 possibly because I did this test today). Note, this is the highest score I found for this kind of messages, others are much lower. score=3.8 required=5 tests=BIG_FONT,CTYPE_JUST_HTML,DATE_IN_PAST_06_12,HTML_COMMENT_UNIQUE _ID,JAVASCRIPT,PORN_4,SPAM_PHRASE_00_01,SUPERLONG_LINE,WEB_BUGS Received: from ts1.hsmlistcluster182643.com (ts1.hsmlistcluster182643.com [64.70.17.71]) by conactive.de (8.9.3/8.9.3) with ESMTP id GAA11314 for <[EMAIL PROTECTED]>; Sun, 5 Jan 2003 06:55:22 +0100 (CET) Received: from [10.0.1.16] by ts1.hsmlistcluster182643.com (10.0.1.36) with QMQP; 04 Jan 2003 21:55:39 +0000 Message-Id: <1sbl16$[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Date: Sat, 4 Jan 2003 07:16:01 -0800 Reply-To: [EMAIL PROTECTED] From: DreamRight <[EMAIL PROTECTED]> Subject: Start making money early this year MIME-Version: 1.0 X-Mailer-Version: v 21381589 Content-type: text/html <img src="http://pxe.hsmlistcluster182643.com/logic/oh.pl?i=2189Przwfstw21 381589.gif" border=0 height=1 width=1><div align="center"> <img src="http://tfs2.hsmlistcluster182643.com/images/header/headerHSM.gif "> </div> <head><script language=javascript><!-- var the_timeout = setTimeout(window.open("http://www.hsm-mailerdirect.com/images/gsm/po phsm.htm","HSM1","status=no, toolbar=no, location=no,menu=no,scrollbars=yes,resizable=yes,width=550,height=480 "),1005);window.blur();self.focus();var the_timeout3 = setTimeout("window.top.focus();",1015);--> </script></head><center><table cellspacing=0 cellpadding=0 width=503 border=0><tbody><tr><td><img height=1 alt="" src="spacer.gif" width=107 border=0></td><td><img height=1 alt="" src="spacer.gif" width=80 border=0></td><td><img height=1 alt="" src="spacer.gif" width=267 border=0></td><td><img height=1 alt="" src="spacer.gif" width=49 border=0></td><td><img height=1 alt="" src="spacer.gif" width=1 border=0></td></tr><tr><td colspan=2><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=92 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/millio naire_r1_c1.gif" width=187 border=0 name=millionaire_r1_c1></a></td><td colspan=2><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=92 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/millio naire_r1_c3.gif" width=316 border=0 name=millionaire_r1_c3></a></td><td><img height=92 alt="" src="spacer.gif" width=1 border=0></td></tr><tr><td colspan=2><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=39 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/millio naire_r2_c1.gif" width=187 border=0 name=millionaire_r2_c1></a></td><td><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=39 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/millio naire_r2_c3.gif" width=267 border=0 name=millionaire_r2_c3></a></td><td><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=39 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/spacer gif" width=49 border=0 name=millionaire_r2_c4></a></td><td><img height=39 alt="" src="spacer.gif" width=1 border=0></td></tr><tr><td><a href="http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw2 1381589hPoszEtY186.html"><img height=88 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/millio naire_r3_c1.gif" width=107 border=0 name=millionaire_r3_c1></a></td><td colspan=3><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=88 alt="" src="http://www.wealth-toolkit.com/multiplestreams14/marketing/millio naire_r3_c2.gif" width=396 border=0 name=millionaire_r3_c2></a></td><td><img height=88 alt="" src="spacer.gif" width=1 border=0></td></tr><!-- http://www.macromedia.com --></tbody></table><br><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html><img height=98 src="http://www.wealth-toolkit.com/multiplestreams14/marketing/button 1.gif" width=150 border=0 alt=""></a> <br><font face="Arial, Helvetica, sans-serif" size=3><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html>view here</a></font><br><p><font face="Arial, Helvetica, sans-serif" size=5><b><a href=http://pxe.hsmlistcluster182643.com/logic/oh.pl?j=2189Przwfstw21 381589hPoszEtY186.html>Well would you?</a></b></font></p></center><P> <P> <P><center><FONT face="arial" size="1.5">To discontinue the receipt of emails, visit the following link: <A href="http://hsmlistcluster182643.com/cgi-bin/ohun.cgi?email= [EMAIL PROTECTED]">http://hsmlistcluster182643.com/cgi-bin/ohun.cgi?e [EMAIL PROTECTED] </a><br><br><a href="http://hsmlistcluster182643.com/cgi- bin/lohun.cgi"><img src="http://tfs2.hsmlistcluster182643.com/images/header/footjoy.gif"; border="0" alt=""></a></center> Kai ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
![http://tfs2.hsmlistcluster182643.com/images/header/footjoy.gif"](http://tfs2.hsmlistcluster182643.com/images/header/footjoy.gif"){kind=link}