2 identical Phishing scams came in yesterday:
From: [EMAIL PROTECTED] Subject: SunTrust Bank INFORMS YOU Date: November 22, 2004 10:04:25 PM PST
My 2.63 production machine scored them at 11.5:
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on my.do.main
X-Spam-Status: Yes, hits=11.5 required=5.0 tests=AWL,BAYES_99, FROM_ENDS_IN_NUMS,FROM_HAS_ULINE_NUMS,HTML_50_60, HTML_FONTCOLOR_UNSAFE,HTML_IMAGE_ONLY_04,HTML_MESSAGE, HTML_TAG_BALANCE_A,HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES, MIME_HTML_ONLY autolearn=no version=2.63
X-Spam-Level: ***********
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on my.do.main
X-Spam-Status: Yes, hits=11.5 required=5.0 tests=BAYES_99,FROM_ENDS_IN_NUMS, FROM_HAS_ULINE_NUMS,HTML_50_60,HTML_FONTCOLOR_UNSAFE, HTML_IMAGE_ONLY_04,HTML_MESSAGE,HTML_TAG_BALANCE_A,HTTP_ESCAPED_HOST, HTTP_EXCESSIVE_ESCAPES,MIME_HTML_ONLY autolearn=no version=2.63
X-Spam-Level: ***********
My 3.01 (bog-standard, no changes to defaults yet) testbed machine scored them at 4.9 and let them through!
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on myother.do.main
X-Spam-Level: ****
X-Spam-Status: No, score=4.9 required=5.0 tests=ALL_TRUSTED,DNS_FROM_RFC_POST, FROM_ENDS_IN_NUMS,FROM_HAS_ULINE_NUMS,HTML_60_70, HTML_FONT_LOW_CONTRAST,HTML_IMAGE_ONLY_08,HTML_MESSAGE, HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,MIME_HTML_ONLY, NORMAL_HTTP_TO_IP,WEIRD_PORT autolearn=no version=3.0.1
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on myother.do.main
X-Spam-Level: ****
X-Spam-Status: No, score=4.9 required=5.0 tests=ALL_TRUSTED,DNS_FROM_RFC_POST, FROM_ENDS_IN_NUMS,FROM_HAS_ULINE_NUMS,HTML_60_70, HTML_FONT_LOW_CONTRAST,HTML_IMAGE_ONLY_08,HTML_MESSAGE, HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,MIME_HTML_ONLY, NORMAL_HTTP_TO_IP,WEIRD_PORT autolearn=no version=3.0.1
I'm sure the "ALL_TRUSTED" isn't helping any, but that doesn't completely explain the 6.2 drop in score. Did all the tests that are common to the two scores/versions get lowered scores or something?!?
- Greg