Robert Nicholson wrote:
>
> Is the mail or checksum sent to a DCC server?
Checksum.
> Could you try this one. It's also low scoring in 2.61
Here's the output I got:
Received: from localhost [127.0.0.1] by coll.pair.com
with SpamAssassin (2.60 1.212-2003-09-23-exp);
Sat, 13 Dec 2003 12:26:35 -0500
From: Great Home Rates <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Receive offers from Multiple Lenders today!
Date: Sat, 13 Dec 2003 11:06:51 -0500
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
coll.pair.com
X-Spam-DCC: sonic.net: coll.pair.com 1156; Body=1 Fuz1=many Fuz2=many
X-Spam-Status: Yes, hits=11.1 required=5.0 tests=BAYES_99,DCC_CHECK,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_RFCI,RCVD_IN_SBL,RCVD_IN_SORBS
autolearn=no version=2.60
X-Spam-Level: ***********
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_3FDB4BCB.617C0234"
This is a multi-part message in MIME format.
------------=_3FDB4BCB.617C0234
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "coll.pair.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or block
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Home shopping? Want to refinance? You have come to the
right place! http://ab.getquickerstuff.com/newlc/go/2847 We can help
you save hundreds to thousands of dollars monthly on your home! Get
great home rates and low rate refinancing! [...]
Content analysis details: (11.1 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 0.9994]
2.9 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
[64.119.209.165 listed in dnsbl.sorbs.net]
0.1 RCVD_IN_RFCI RBL: Sent via a relay in
ipwhois.rfc-ignorant.org
[Inaccurate or missing WHOIS data]
1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?64.119.209.165>]
1.1 RCVD_IN_SBL RBL: Received via a relay in Spamhaus Block
List
[<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9538>]
------------=_3FDB4BCB.617C0234
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Received: (qmail 6542 invoked from network); 13 Dec 2003 16:06:47 -0000
Received: from thedealsmaster.com (64.119.209.165)
by grub.camros.com with SMTP; 13 Dec 2003 16:06:47 -0000
To: [EMAIL PROTECTED]
Date: Sat, 13 Dec 2003 11:06:51 -0500
Message-ID: <[EMAIL PROTECTED]>
From: Great Home Rates <[EMAIL PROTECTED]>
Return-Path: <[EMAIL PROTECTED]>
Reply-To: <[EMAIL PROTECTED]>
Subject: Receive offers from Multiple Lenders today!
X-MimeOLE: Prodigy Compatibility V 4.3f9be237 or later
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Lines: 21
Home shopping? Want to refinance?
You have come to the right place!
http://ab.getquickerstuff.com/newlc/go/2847
We can help you save hundreds to thousands
of dollars monthly on your home!
Get great home rates and low rate refinancing!
Receive up to 3 quotes from the best lenders
in the US for free now!
http://ab.getquickerstuff.com/newlc/go/2847
To have your address eliminated from
our mailing list, follow this link:
http://ab.getquickerstuff.com/unsub/central/[EMAIL PROTECTED]
------------=_3FDB4BCB.617C0234--
Bryan
>
> ------------------------------------------------------------------------
> Name: ex.txt
> ex.txt Type: Plain Text (text/plain)
> Encoding: 7bit
>
> ------------------------------------------------------------------------
>
> On Dec 13, 2003, at 10:21 AM, Bryan Hoover wrote:
>
> > Simon Byrnand wrote:
> >> Just a bit of a "me too" post, I checked my last two days email
> >> including
> >> Ham and Spam and checked the hitrate of DCC and RAZOR2 and here were
> >> the
> >> results:
> >>
> >> Ham: 0 DCC hits, 1 RAZOR2 hit out of 203 Ham messages.
> >> Spam: 174 DCC hits, 57 RAZOR2 hits out of 242 Spam messages.
> >>
> >> And out of the total message sample there weren't any FP's or FN's....
> >
> > Googling on the topic seems to confirm false positives are not a
> > problem
> > with DCC.
> >
> >> Interesting that DCC is triggering on about 71% of my Spam, far higher
> >> than I might have guessed. Meanwhile RAZOR2 hit on only 23% of Spam.
> >
> > I suppose because DCC is automatic -- I think anyway -- all incomming
> > mail gets reported to DCC server, which checksums, and counts, while
> > the
> > idea with Razor is that the mail is human confirmed spam before
> > submitting -- not sure, but I don't think Razor figures report
> > frequency.
> >
> >> I didn't check the overlap between the two. (Since it requires more
> >> than a
> >> simple search/grep and I can't be bothered ;)
> >
> > Well, of course not :). But now that you mention it, I suppose I'll
> > have to figure out how to do that, otherwise, this inferiority complex
> > is gonna get way out of hand.
> >
> > Bryan
> >
> >> Regards,
> >> Simon
> >
> > --
> > Nothing in the world has more potential for beauty than woman. Nothing
> > has more potential to destroy it, than the world. - (Anonymous)
> >
> > http://www.wecs.com/content.htm
> >
> > This signature file is generated by Pick-a-Tag !
> > Written by Jeroen van Vaarsel
> > http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag
> >
> >
> > -------------------------------------------------------
> > This SF.net email is sponsored by: IBM Linux Tutorials.
> > Become an expert in LINUX or just sharpen your skills. Sign up for
> > IBM's
> > Free Linux Tutorials. Learn everything from the bash shell to sys
> > admin.
> > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
> > _______________________________________________
> > Spamassassin-talk mailing list
> > [EMAIL PROTECTED]
> > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
--
Nothing in the world has more potential for beauty than woman. Nothing
has more potential to destroy it, than the world. - (Anonymous)
http://www.wecs.com/content.htm
This signature file is generated by Pick-a-Tag !
Written by Jeroen van Vaarsel
http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
