On Tue, 18 Oct 2016, Sue Mey wrote:
Spam score details (in lieu of printscreen). I tried GetResonse help
first but they seem stumped as to the reason for this. In the meantime I
am just stuck.
Spam Assassin results
description
points
BODY: Uses a mis-spelled version of cialis.
3.10
Absent the actual rule names, this is all stabbing in the dark...
(1) there is no rule with that description in the current base rule set
provided by the SpamAssassin project.
(2) the base SA rules that do look for "cialis" obfuscation did not hit on
the text you provided in my local testbed. Note, however, that what you
provided is not a complete properly-formed email message so take that test
with a grain of salt. But based on a visual inspection there doesn't
appear to be anything in your message that the current base SA rules would
consider misspelled "cialis".
If you're willing to privately mail me just the HTML content as a file, I
can test that part a bit more thoroughly. The HTML in the sample you
provided was not really usable because it was embedded in a bunch of MSFT
HTML Email markup garbage that I wasn't willing to try to strip off.
(3) the base SA rules that do look for "cialis" obfuscation are all
currently scored at 2.1 points or less.
So: you do need to work with GetResponse on this. It appears that one or
more of the following are true, none of which we can help you with:
(1) they are using old rules, or an old version of SA that is no longer
getting rule updates from the SA project
(2) they are using custom rules that are not part of the base rules
currently provided by the SA project, or possibly are changing the
descriptions of base rules
(3) they are setting local scores that are higher than what the current
base rules are providing
A recommendation for GetResponse: include the names of the rule hits in
that report. It won't have meaning to most nontechnical users, but if it
reaches the point you have reached it will really help the analysis.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Vista is at best mildly annoying and at worst makes you want to
rush to Redmond, Wash. and rip somebody's liver out. -- Forbes
-----------------------------------------------------------------------
301 days since the first successful real return to launch site (SpaceX)
