2 identical Phishing scams came in yesterday:

        From:     [EMAIL PROTECTED]
        Subject:        SunTrust Bank INFORMS YOU
        Date:   November 22, 2004 10:04:25 PM PST

My 2.63 production machine scored them at 11.5:

X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on my.do.main
X-Spam-Status: Yes, hits=11.5 required=5.0 tests=AWL,BAYES_99, FROM_ENDS_IN_NUMS,FROM_HAS_ULINE_NUMS,HTML_50_60, HTML_FONTCOLOR_UNSAFE,HTML_IMAGE_ONLY_04,HTML_MESSAGE, HTML_TAG_BALANCE_A,HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES, MIME_HTML_ONLY autolearn=no version=2.63
X-Spam-Level: ***********


X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on my.do.main
X-Spam-Status: Yes, hits=11.5 required=5.0 tests=BAYES_99,FROM_ENDS_IN_NUMS, FROM_HAS_ULINE_NUMS,HTML_50_60,HTML_FONTCOLOR_UNSAFE, HTML_IMAGE_ONLY_04,HTML_MESSAGE,HTML_TAG_BALANCE_A,HTTP_ESCAPED_HOST, HTTP_EXCESSIVE_ESCAPES,MIME_HTML_ONLY autolearn=no version=2.63
X-Spam-Level: ***********


My 3.01 (bog-standard, no changes to defaults yet) testbed machine
scored them at 4.9 and let them through!

X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on myother.do.main
X-Spam-Level: ****
X-Spam-Status: No, score=4.9 required=5.0 tests=ALL_TRUSTED,DNS_FROM_RFC_POST, FROM_ENDS_IN_NUMS,FROM_HAS_ULINE_NUMS,HTML_60_70, HTML_FONT_LOW_CONTRAST,HTML_IMAGE_ONLY_08,HTML_MESSAGE, HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,MIME_HTML_ONLY, NORMAL_HTTP_TO_IP,WEIRD_PORT autolearn=no version=3.0.1


X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on myother.do.main
X-Spam-Level: ****
X-Spam-Status: No, score=4.9 required=5.0 tests=ALL_TRUSTED,DNS_FROM_RFC_POST, FROM_ENDS_IN_NUMS,FROM_HAS_ULINE_NUMS,HTML_60_70, HTML_FONT_LOW_CONTRAST,HTML_IMAGE_ONLY_08,HTML_MESSAGE, HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,MIME_HTML_ONLY, NORMAL_HTTP_TO_IP,WEIRD_PORT autolearn=no version=3.0.1


I'm sure the "ALL_TRUSTED" isn't helping any, but that doesn't
completely explain the 6.2 drop in score.  Did all the tests
that are common to the two scores/versions get lowered scores
or something?!?

        - Greg



Reply via email to