RE: [SAtalk] New Obfuscation Technique?

2003-11-14 Thread Bret Miller
> It did however use a trick to avoid the standard > FROM_AND_TO_SAME so your > rule can help out by adding some score.. However, 104.1 is a > bit excessive, > since there's no white list to over-ride. (Bret is smart and did not > whitelist_from himself). No whitelist of myself necessary here as t

RE: [SAtalk] New Obfuscation Technique?

2003-11-10 Thread Kenneth Porter
--On Monday, November 10, 2003 8:20 PM -0500 Matt Kettler <[EMAIL PROTECTED]> wrote: It did however use a trick to avoid the standard FROM_AND_TO_SAME so your rule can help out by adding some score.. However, 104.1 is a bit excessive, since there's no white list to over-ride. (Bret is smart and d

RE: [SAtalk] New Obfuscation Technique?

2003-11-10 Thread Matt Kettler
At 03:00 PM 11/10/2003, Chris Santerre wrote: This is the spammer trick of saying the email is from you, to you. So it got Whitelisted. No it did not Chris.. Read The Fine List of rules it matched.. no WHITELIST_* or AWL rules match this. X-Spam-Tests: tests=BANG_MORE,BAYES_60,HTML_FONTCOLOR_RED

RE: [SAtalk] New Obfuscation Technique?

2003-11-10 Thread Bret Miller
> This is the spammer trick of saying the email is from you, to > you. So it got Whitelisted. Here is _A_ solution. I believe > the newest version of SA also solves this: Actually, if you'd checked the SA headers, you'd notice that AWL didn't seem to come into play here. It just didn't hit enoug

RE: [SAtalk] New Obfuscation Technique?

2003-11-10 Thread Chris Santerre
> > Saw a few of these come through last week. Guess I need a > rule upgrade to catch this? > > > --- the forwarded message follows --- This is the spammer trick of saying the email is from you, to you. So it got Whitelisted. Here is _A_ solution. I believe the newest version of SA also solv