Sue Mey wrote:
> Here is a Printscreen of the Spam score:

Screenshots are generally frowned on since anyone who might do some
quick inspection and testing can't then copy-paste any relevant
fragments for local testing.  Also, attached images bulk up a message
quite a lot.

> Below is the body of my newsletter – with images (which have links to my
> site)
> 
> I have a ‘Special Offers’ section on my website and have been using
> those words and links for years without a problem. I do not use the word
> ‘specialist’ at all.
> 
> After reading about the word ‘specialist’ earlier today, I removed the
> words ‘Special Offers’ and replaced text with ‘this page’, although the
> link still contains the words ‘special offer’

I saved the message and dug up a copy of the FB_CIALIS_LEO3 rule RW
mentioned;  I note that as he said it's not part of the current live
rules, and in fact checking further it looks like it's been commented
out entirely in the rules development sandbox, so it's not even
considered for testing.

Running the saved message through SA with the rule pasted into a
temporary rules definition file, I found:

dbg: rules: ran body rule FB_CIALIS_LEO3 ======> got hit: "Calm All is"

(from "NW1826 All is Calm All is Bright")

which is probably a good example of why this rule is no longer present.

Sooner or later you get some very bizarre things misfires due to trying
to create rules that match the very bizarre things spammers have done to
get their message past filters.

-kgd

Reply via email to