At 02:44 PM 12/1/2006, you wrote:
I've got a simple rule that checks for "favorite financial
institution site" in the message body. I've assigned that rule a
default score of 10.0, however when the message arrives in my spam
trap, the SA score is 7.5, high enough to get it into the spam trap,
but clearly below 10.0.
What's up with that? Is the spammer (y'all know who they are) clever
enough to write a message that earns negative points? Just wondering
... thanks!
What do the SA headers say?
Should look like
Content analysis details: (9.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.3 SARE_SUB_SEXY subject has likely spammer phrase or word
1.7 SARE_ADLTSUB2 Contains possible adult words
1.3 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.9 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
0.1 TW_ZZ BODY: Odd Letter Triples with ZZ
1.0 SARE_ADULT2 BODY: Contains adult material
0.9 SARE_ADULT1 BODY: Contains adult material
0.8 INFO_TLD URI: Contains an URL in the INFO top-level domain
1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
above 50%
[cf: 100]
0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
