I've been getting alot of leak-through with 3.02 lately and I thought this one was interesting, particularly that there are plenty of rules that look for a certain word that rhymes with "truck" (YKWIM), but no header rules that look for the word with an "ing" on the end of it.
I only see one body rule in 20_porn.cf that looks for this string in message bodies, but it scores pretty low. I have a hunch that this word might be somewhat common in ham, but rarely in the subject or anywhere else in the headers of ham... here's a link to the message text:
http://www.timuel.com/badmessage.txt
Also, I can't find a complete list of what rules that I used in 2.64 were obsoleted by the 3.x series. Perhaps this would be good wiki fodder. I will post the rules that I am left with after my migration to 3.02 (below my sig) and anyone who feels up to it can correct me. =]
Thanks...
-- Tim Wesemann
== Rules that were left after upgrade to 3.02 === 10_misc.cf 20_anti_ratware.cf 20_body_tests.cf 20_compensate.cf 20_dnsbl_tests.cf 20_drugs.cf 20_fake_helo_tests.cf 20_head_tests.cf 20_html_tests.cf 20_meta_tests.cf 20_phrases.cf 20_porn.cf 20_ratware.cf 20_uri_tests.cf 23_bayes.cf 25_body_tests_es.cf 25_hashcash.cf 25_spf.cf 25_uribl.cf 30_text_de.cf 30_text_fr.cf 30_text_nl.cf 30_text_pl.cf 50_scores.cf 60_whitelist.cf 70_sare_bayes_poison_nxm.cf 70_sare_genlsubj0.cf 70_sare_genlsubj1.cf 70_sare_header0.cf 70_sare_header1.cf 70_sare_html0.cf 70_sare_html1.cf 70_sare_oem.cf 70_sare_random.cf 70_sare_specific.cf 70_sare_spoof.cf 70_sare_unsub.cf 70_sare_uri0.cf 70_sare_uri1.cf 70_sc_top200.cf 72_sare_redirect_post3.0.0.cf 88_FVGT_Bayes_Poison.cf 88_FVGT_body.cf 88_FVGT_subject.cf 88_FVGT_uri.cf 99_FVGT_Tripwire.cf 99_FVGT_meta.cf 99_sare_adult.cf 99_sare_biz_market_learn_post25x.cf 99_sare_fraud_post25x.cf antidrug.cf backhair.cf bogus-virus-warnings.cf cheat.cf chickenpox.cf evilnumbers.cf languages mangled.cf mime_validate.cf mr_wiggly.cf random.current.cf rnd_uc_char.cf rolex.cf useless.cf weeds.cf wordword.cf x_headers.cf =================================
