Robert Nicholson wrote:
>
> Attached is an example.
>
> It would appear that I was wrong about double reply-to's. that's just
> something that OSX's Mail.app is doing.
This is what I got before teaching it to Bayes:
debug: is spam? score=5.621 required=5
tests=BAYES_50,DCC_CHECK,MISSING_OUTLOOK_NAME,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL
The above the last line of debug output.
>From [EMAIL PROTECTED] Fri Dec 12 16:28:13 2003
Received: from localhost [127.0.0.1] by coll.pair.com
with SpamAssassin (2.60 1.212-2003-09-23-exp);
Sat, 13 Dec 2003 10:07:21 -0500
From: Advance in Pay <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Need cash in the bank ASAP?
Date: Fri, 12 Dec 2003 17:28:24 -0500
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
coll.pair.com
X-Spam-DCC: sonic.net: coll.pair.com 1156; Body=1 Fuz1=many Fuz2=22
X-Spam-Status: Yes, hits=5.6 required=5.0 tests=BAYES_50,DCC_CHECK,
MISSING_OUTLOOK_NAME,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SBL
autolearn=no
version=2.60
X-Spam-Level: *****
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_3FDB2B29.D7724CEE"
This is a multi-part message in MIME format.
------------=_3FDB2B29.D7724CEE
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "coll.pair.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or block
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Get $500 by tomorrow. It's quick, easy and
confidential. Your cash advance is electronically deposited directly
into your checking account within 24 hours. It's secure and safe.
http://lc.orderfreebies.com/newlc/go/2746 [...]
Content analysis details: (5.6 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
[score: 0.5322]
2.9 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?216.109.86.52>]
1.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus Block
List
[<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10587>]
0.1 MISSING_OUTLOOK_NAME Message looks like Outlook, but isn't
#####################################
And after Bayes:
Content analysis details: (11.0 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 0.9990]
2.9 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?216.109.86.52>]
1.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus Block
List
[<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL10587>]
0.1 MISSING_OUTLOOK_NAME Message looks like Outlook, but isn't
Bryan
>
> ------------------------------------------------------------------------
> Name: ex.txt
> ex.txt Type: Plain Text (text/plain)
> Encoding: 7bit
>
> ------------------------------------------------------------------------
>
> On Dec 13, 2003, at 12:00 AM, Bryan Hoover wrote:
>
> > Robert Nicholson wrote:
> >>
> >> Anybody who's installed A 2.61
> >>
> >> Can you tell me what the score for the following email was
> >>
> >> From: Advance in Pay <[EMAIL PROTECTED]>
> >> Subject: Need cash in the bank ASAP?
> >> Date: December 12, 2003 4:28:24 PM CST
> >> To: Robert David Nicholson <[EMAIL PROTECTED]>
> >> Reply-To: <[EMAIL PROTECTED]>
> >> <[EMAIL PROTECTED]>
> >>
> >> i'm refering to the spammer who's using double reply-to's with angle
> >> brackets.
> >
> > <snip (other exp's)>
> >
> >> Are these getting high scores with 2.61?
> >>
> >> In 2.60 I'm seeing them score 0.0
> >
> > I wasn't aware 2.61 was addressing this - haven't installed it yet
> > either, so pardon me for barging in, but have you been following the
> > first thread you started on this:
> >
> > news://news.gmane.org/[EMAIL PROTECTED]
> >
> > Within the thread, the double reply-to's are covered, and then the
> > thread continues to
> > the more abstract matching of words in both From:, and Subject:, which
> > was also a pattern in the first set of examples you posted. None of
> > it's been formalized into an SA usable rule yet though.
> >
> > Your spammer seems rather specific. I wonder if anyone else is getting
> > such mails. If they are, as mentioned in the previous thread, I would
> > think razor, and surely, dcc would be picking them up -- though neither
> > of these would likely be enough to score as spam.
> >
> > You never mentioned, from the first thread - what's in the body of the
> > messages?
> >
> > Bryan
> >
> >> -------------------------------------------------------
> >> This SF.net email is sponsored by: IBM Linux Tutorials.
> >> Become an expert in LINUX or just sharpen your skills. Sign up for
> >> IBM's
> >> Free Linux Tutorials. Learn everything from the bash shell to sys
> >> admin.
> >> Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
> >
> > --
> > Nothing in the world has more potential for beauty than woman. Nothing
> > has more potential to destroy it, than the world. - (Anonymous)
> >
> > http://www.wecs.com/content.htm
> >
> > This signature file is generated by Pick-a-Tag !
> > Written by Jeroen van Vaarsel
> > http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag
> >
> >
> >
> > -------------------------------------------------------
> > This SF.net email is sponsored by: IBM Linux Tutorials.
> > Become an expert in LINUX or just sharpen your skills. Sign up for
> > IBM's
> > Free Linux Tutorials. Learn everything from the bash shell to sys
> > admin.
> > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
> > _______________________________________________
> > Spamassassin-talk mailing list
> > [EMAIL PROTECTED]
> > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
--
Nothing in the world has more potential for beauty than woman. Nothing
has more potential to destroy it, than the world. - (Anonymous)
http://www.wecs.com/content.htm
This signature file is generated by Pick-a-Tag !
Written by Jeroen van Vaarsel
http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
