Well, we send emails on behalf of clients, and so we are trying catch phishing spam before they are sent out. Since the email aren't sent yet, we had to generate a mock email for SA. The header in the example is what we THINK the headers will be when they are actually sent out.
When you tried it with your SA, I assume you didn't change any headers? If that's the case, then it should still work. I guess I didn't setup SA correctly? Jari Fredriksson wrote: > > On 14.4.2010 17:54, yongke wrote: >> >> Hi guys >> >> Is there anyway to filter out phishing emails using spam assassin? My >> current test email wasn't blocked and SA had a score 0f 0: >> > > You sample was not a real email with all headers, or so it looked. > > However, I sent to my SA, and here is the result. > > ---------------------------------------------------------------- > > Content analysis details: (11.0 points, 5.0 required) > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > 0.0 FREEMAIL_FROM Sender email is freemail > (globalskyinc[at]aol.com) > -0.0 NO_RELAYS Informational: message was not relayed via > SMTP > 3.4 FILL_THIS_FORM_LONG BODY: Fill in a form with personal information > 0.2 BAYES_50 BODY: Bayes spam probability is 40 to 60% > [score: 0.5016] > 3.0 FROM_EQUALS_TO From: and To: have the same username > 0.0 T_FILL_THIS_FORM Fill in a form with personal information > -0.0 NO_RECEIVED Informational: message has no Received headers > 1.4 MISSING_DATE Missing Date: header > 3.0 AE_DETAILS_WITH_MONEY Has form and mentions much money > 0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL > > ---------------------------------------------------------------- > > So it would have been caught here. > > But yes, there were no Received: -headers and other important headers, > so the result is not much good. > > Have you trained youe Bayes and made sa-update after installation? > > -- > http://www.iki.fi/jarif/ > > Q: What is orange and goes "click, click?" > A: A ball point carrot. > > > > -- View this message in context: http://old.nabble.com/How-do-I-filter-out-phishing-email--tp28243762p28244615.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
