-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am Samstag, 8. Januar 2005 03:15 schrieb nadim: > HI, > [..] > The spam I get consist of a one single image. Is there something I can do > to mark them?
I got not so many of these. I inspected one an it got a high score of 31.5 points. Question back: Why are your messages not scored high enough? Thomas PS: Here is the detailed report from one. Content analysis details: (31.5 points, 5.0 required) pts rule name description - ---- ---------------------- -------------------------------------------------- 1.2 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) 3.7 HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC) 4.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) 0.1 RCVD_BY_IP Received by mail server with no name 1.3 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date 0.5 TA_urlQuestionmark URI: URL contains ? after / <<<=== This is one of my own rules. 0.0 HTML_TEXT_AFTER_HTML BODY: HTML contains text after HTML close tag 0.1 HTML_80_90 BODY: Message is 80% to 90% HTML 0.1 HTML_TEXT_AFTER_BODY BODY: HTML contains text after BODY close tag 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.5056] 0.1 MPART_ALT_DIFF BODY: HTML and text parts are different 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50% [cf: 100] 0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area 1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org [<http://dsbl.org/listing?69.227.205.124>] 3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL [69.227.205.124 listed in sbl-xbl.spamhaus.org] 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist [URIs: kasboesdf.com] 0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: synonymous6hoechst.com kasboesdf.com] 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: synonymous6hoechst.com] 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: synonymous6hoechst.com kasboesdf.com] 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: synonymous6hoechst.com kasboesdf.com] 0.0 UPPERCASE_25_50 message body is 25-50% uppercase 0.0 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary > > Cheers, Nadim. - -- icq:133073900 http://www.t-arend.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) iD8DBQFB35f1He2ZLU3NgHsRAgd2AJ4+2V7WotwkbvLa3odAxhmAa6ivggCfVdRt XFoXUoBGSDzfD2oWFlMsGDE= =49IW -----END PGP SIGNATURE-----