-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am Samstag, 8. Januar 2005 03:15 schrieb nadim:
> HI,
>
[..]
> The spam I get consist of a one single image. Is there something I can do
> to mark them?

I got not so many of these. I inspected one an it got a high score of 31.5 
points. Question back: Why are your messages not scored high enough?



        Thomas

PS: Here is the detailed report from one.

Content analysis details:   (31.5 points, 5.0 required)

 pts rule name              description
- ---- ---------------------- --------------------------------------------------
 1.2 HELO_DYNAMIC_DHCP      Relay HELO'd using suspicious hostname (DHCP)
 3.7 HELO_DYNAMIC_HCC       Relay HELO'd using suspicious hostname (HCC)
 4.4 HELO_DYNAMIC_IPADDR    Relay HELO'd using suspicious hostname (IP addr 1)
 0.1 RCVD_BY_IP             Received by mail server with no name
 1.3 DATE_IN_FUTURE_06_12   Date: is 6 to 12 hours after Received: date
 0.5 TA_urlQuestionmark     URI: URL contains ? after /  <<<=== This is one of 
my own rules. 
 0.0 HTML_TEXT_AFTER_HTML   BODY: HTML contains text after HTML close tag
 0.1 HTML_80_90             BODY: Message is 80% to 90% HTML
 0.1 HTML_TEXT_AFTER_BODY   BODY: HTML contains text after BODY close tag
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.0 BAYES_50               BODY: Bayesian spam probability is 40 to 60%
                            [score: 0.5056]
 0.1 MPART_ALT_DIFF         BODY: HTML and text parts are different
 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
                            [cf: 100]
 0.0 HTML_IMAGE_RATIO_02    BODY: HTML has a low ratio of text to image area
 1.0 HTML_IMAGE_ONLY_16     BODY: HTML: images with 1200-1600 bytes of words
 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 3.8 RCVD_IN_DSBL           RBL: Received via a relay in list.dsbl.org
                            [<http://dsbl.org/listing?69.227.205.124>]
 3.1 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                            [69.227.205.124 listed in sbl-xbl.spamhaus.org]
 1.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
                            [URIs: kasboesdf.com]
 0.4 URIBL_AB_SURBL         Contains an URL listed in the AB SURBL blocklist
                            [URIs: synonymous6hoechst.com kasboesdf.com]
 1.5 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
                            [URIs: synonymous6hoechst.com]
 3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: synonymous6hoechst.com kasboesdf.com]
 4.3 URIBL_SC_SURBL         Contains an URL listed in the SC SURBL blocklist
                            [URIs: synonymous6hoechst.com kasboesdf.com]
 0.0 UPPERCASE_25_50        message body is 25-50% uppercase
 0.0 MIME_BOUND_NEXTPART    Spam tool pattern in MIME boundary


>
> Cheers, Nadim.

- -- 
icq:133073900
http://www.t-arend.de
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFB35f1He2ZLU3NgHsRAgd2AJ4+2V7WotwkbvLa3odAxhmAa6ivggCfVdRt
XFoXUoBGSDzfD2oWFlMsGDE=
=49IW
-----END PGP SIGNATURE-----

Reply via email to