Net tests and the BigEvil will do the trick.
3.0 BigEvilList_191 URI: Generated BigEvilList_191 1.1 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org [<http://dsbl.org/listing?ip=213.228.170.247>] 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see <http://www.spamcop.net/bl.shtml?213.228.170.247>] 1.1 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy [213.228.170.247 listed in dnsbl.njabl.org] 1.8 RCVD_IN_NJABL RBL: Received via a relay in dnsbl.njabl.org [213.228.170.247 listed in dnsbl.njabl.org]
Mike, If you look at Rich's X-spam status header, he's already using bigevil and netchecks, but at the time the message ran, the IP's were not in spamcop (or he's got this particular DNSBL disabled)
This is the set of tests it matched when he ran it...
X-Spam-Status: No, hits=5.9 required=6.0 tests=BAYES_50,BigEvilList_191, HTML_MESSAGE,NORMAL_HTTP_TO_IP,RCVD_IN_NJABL,RCVD_IN_NJABL_PROXY, RCVD_IN_SORBS,RCVD_IN_SORBS_SOCKS,SUBJECT_LIGHT autolearn=no version=2.61
Looks like he's partially being hurt by a high threshold. Bayes isn't very useful against this message due to large quantities of random garbage. bigevil and net checks were not enough for this case.
------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
