On Friday 23 June 2006 13:24, Michael Monnerie wrote: > On Freitag, 23. Juni 2006 20:56 Brian Godette wrote: > > Spammer is using a ham corpus message and including the entire plain > > text inside an HTML comment (<-- -->). > > Seems to be "pas problem" for SA: > X-Spam-Status: Yes, hits=16.9 required=5.0 > tests=BAYES_99=3.5,DCC_CHECK=2.17, > DIGEST_MULTIPLE=0.765,FORGED_RCVD_HELO=0.135,HTML_90_100=0.113, > HTML_MESSAGE=0.001,MIME_HTML_ONLY=0.001,RAZOR2_CF_RANGE_51_100=0.5, > RAZOR2_CF_RANGE_E8_51_100=1.5,RAZOR2_CHECK=0.5,SARE_UNI=0.591, > SPF_NEUTRAL=1.069,URIBL_BLACK=3,URIBL_OB_SURBL=3.008 autolearn=spam > bayes=1.0000 > > mfg zmi
Uh no. It still got marked as spam here, for other reasons. However the spammer is trying to lower the bayes score by including a ham corpus message inside an HTML comment. Also note that a large amount of your score was from DCC, Razor, and URIBLs that didn't hit at the initial receipt of this message. This is only really an issue for people who use site-wide bayes as per-user bayes has a lower chance of having seen true ham similar to the encapsulated ham.
