----- "Ned Slider" <n...@unixmail.co.uk> wrote: > On 21/08/10 21:51, Ned Slider wrote: > > > > I'm still seeing FP hits against these rules despite a few sought > rule > > updates. > > > > It seems there's a few rules hitting on Facebook: > > > > # grep Facebook > > /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf > > body __SEEK_YDK7NN / to unsubscribe\. Facebook, Inc/ > > body __SEEK_GYJ_MA / If you do not wish to receive this type of > email > > from Facebook in the future, please follow the link below to > > unsubscribe\. http:\/\/www\.facebook\.com\/ Facebook, Inc\. P\.O\. > Box > > 10005, Palo Alto, CA 94303 / > > body __SEEK_Z4K_72 / sent you a message on Facebook/ > > body __SEEK_A5_EMW /Find people from your Gmail address book on > Facebook\!/ > > body __SEEK_TKDQL_ /Sign in to Facebook and start connecting/ > > body __SEEK_X4HOA8 /Didn\'t sign up for Facebook\? Please let us > know\. > > If you do not wish to receive this type of email from Facebook in > the > > future, please click here to unsubscribe\.Facebook, Inc\. P\.O\. > Box > > 10005, Palo Alto, CA 94303/ > > > > > > Apologies for bumping an old thread... > > I caught another FP yesterday for facebook: > > /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf:body > > __SEEK_FMJXND /\. If you do not wish to receive this type of email > from > Facebook in the future, please click here to unsubscribe\. Facebook, > Inc\. P\.O\. Box 10005, Palo Alto, CA 94303 /
I'd guess this is caused by the spam wave that has been going on for some time now, which basically contains the same content as the Facebook mails but with spammy URIs instead. Because of the South rules nature, I'd say that this kind of FPs are likely to happen on such scenarios. > But it's since been fixed (removed) in the latest update - good work > on > the quick fix! -- João Gouveia AnubisNetworks
