Notice that kind of "misspelings" should be Tripwire ruleset work... right?
The good news is I reported it and now it's detected:
Content analysis details: (7.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.1 BAYES_80 BODY: Bayesian spam probability is 80 to 95%
[score: 0.8973]
2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[83.132.46.217 listed in sbl-xbl.spamhaus.org]
----- Original Message ----- From: "Chris Santerre" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 02, 2005 1:57 PM
Subject: RE: Typical spam not detected at all.. there is no rule for it :-\
How about an eval that counts the number of '|' in a message. Over 4 and you
got yourself a spam :)
--Chris
-----Original Message----- From: David Velásquez [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 02, 2005 1:46 PM To: [EMAIL PROTECTED] Subject: Typical spam not detected at all.. there is no rule for it :-\
Spam detection software, running on the system "co3.conexcol.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see [EMAIL PROTECTED] for details.
Content preview: US Oil and Gas Report Oi| C|imbs, Gains Soar We have the |eading track record for finding fast moving, Low-priced energy plays. Look at the moves made by our last 2 Hot Picks: SPRL .14 to .36 in 12 days, up 157% PRVB .10 to .265 in 8 days, up 165% [...]
Content analysis details: (-2.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
