Re: [SAtalk] This spam scores too low

Scott Wed, 21 Jan 2004 10:07:59 -0800

Your email made it into my spam folder.  Mostly due to my very strict rules
(courtesy of my friend Chris):

[mail:root]# cat /etc/mail/spamassassin/local.cf
body RANDOM_WORD_10
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){10}/
describe RANDOM_WORD_10     string of 10+ random words
score RANDOM_WORD_10        1.0

body RANDOM_WORD_15
/(?:\b(?!(?:from|even|more|that|this|were|with)\b)[a-z]{4,12}\s+){15}/
describe RANDOM_WORD_15     string of 15+ random words
score RANDOM_WORD_15        3.0


Your's is the first false positive I've gotten from this, but you did include
the spam email to be fair.

-Scott

Jürgen R. Plasser wrote:

Spam detection software, running on the system "mail.troutpocket.org", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or block
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Hi all, in the last view days I experienced some (for
  me) "strange" kind of spam. The first part of the email is a random
  text (that's what I see in my email client when opening the email):
  [...]

Content analysis details: (5.9 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 1.0 RANDOM_WORD_10         BODY: string of 10+ random words
 3.0 RANDOM_WORD_15         BODY: string of 15+ random words
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.1 FVGT_TRIPWIRE_QA       FVGT_TRIPWIRE_QA
 0.1 FVGT_TRIPWIRE_QX       FVGT_TRIPWIRE_QX
 0.1 FVGT_TRIPWIRE_JR       FVGT_TRIPWIRE_JR
 0.1 FVGT_TRIPWIRE_WB       FVGT_TRIPWIRE_WB
 0.1 FVGT_TRIPWIRE_SJ       FVGT_TRIPWIRE_SJ
 0.1 FVGT_TRIPWIRE_QW       FVGT_TRIPWIRE_QW
 0.1 FVGT_TRIPWIRE_ZC       FVGT_TRIPWIRE_ZC
 0.1 FVGT_TRIPWIRE_YH       FVGT_TRIPWIRE_YH
 0.1 FVGT_TRIPWIRE_NX       FVGT_TRIPWIRE_NX
 0.1 FVGT_TRIPWIRE_PB       FVGT_TRIPWIRE_PB
 0.1 FVGT_TRIPWIRE_QK       FVGT_TRIPWIRE_QK
 0.1 FVGT_TRIPWIRE_MN       FVGT_TRIPWIRE_MN
 0.1 FVGT_TRIPWIRE_LX       FVGT_TRIPWIRE_LX
 0.1 FVGT_TRIPWIRE_QY       FVGT_TRIPWIRE_QY
 0.1 FVGT_TRIPWIRE_TQ       FVGT_TRIPWIRE_TQ
 0.1 FVGT_TRIPWIRE_KG       FVGT_TRIPWIRE_KG
 0.1 FVGT_TRIPWIRE_BD       FVGT_TRIPWIRE_BD
 0.1 FVGT_TRIPWIRE_NL       FVGT_TRIPWIRE_NL
 0.1 FVGT_TRIPWIRE_FZ       FVGT_TRIPWIRE_FZ
 0.1 FVGT_TRIPWIRE_QD       FVGT_TRIPWIRE_QD
 0.1 FVGT_TRIPWIRE_MQ       FVGT_TRIPWIRE_MQ
 0.1 FVGT_TRIPWIRE_DX       FVGT_TRIPWIRE_DX
 0.1 FVGT_TRIPWIRE_QH       FVGT_TRIPWIRE_QH
 0.1 FVGT_TRIPWIRE_WH       FVGT_TRIPWIRE_WH
 0.1 FVGT_TRIPWIRE_RQ       FVGT_TRIPWIRE_RQ

------------------------------------------------------------------------

Subject:
[SAtalk] This spam scores too low
From:
"Jürgen R. Plasser" <[EMAIL PROTECTED]>
Date:
Wed, 21 Jan 2004 11:56:34 +0100
To:
[EMAIL PROTECTED]

Hi all,

in the last view days I experienced some (for me) "strange" kind of spam.

The first part of the email is a random text (that's what I see in my
email client when opening the email):

<snip>
embedding rose abalone freedman havana bayport regretful menlo gate
blomquist
force parasitic infelicity crayon
insidious brasilia pinsky noel priestley fried praiseworthy gimmick even
</snip>

Makes no sense to me at all ;-)

And besides that, there is a html part with an ad section (scrambled
letter words) and below that an irritating set of words.

Is there any way to get rid (say: score > 5) of those mails with SA?
Some rules?

I have SA 2.61 and the latest Bigevel rules installed.

Best regards,
Jürgen

ps. Here is the email source

Return-Path: <[EMAIL PROTECTED]>
Received: from mailserver ([unix socket]) (authenticated user=cyrus bits=0)
    by mailserver (Cyrus v2.1.16) with LMTP; Wed, 21 Jan 2004 11:04:46
+0100
X-Sieve: CMU Sieve 2.2
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: by mailserver.example.com (Postfix, from userid 65534)
    id 1F70F60441F; Wed, 21 Jan 2004 11:04:46 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
    by mailserver.example.com (Postfix) with ESMTP
    id 0A0806042D6; Wed, 21 Jan 2004 11:04:44 +0100 (CET)
Received: from mailserver.example.com (localhost [127.0.0.1])
    by localhost (AvMailGate-2.0.1) id 23887-263A9B8D;
    Wed, 21 Jan 2004 11:04:44 +0100
Received: from pD954857A.dip.t-dialin.net (pD954857A.dip.t-dialin.net
[217.84.133.122])
    by mailserver.example.com (Postfix) with SMTP
    id AED3A6042D6; Wed, 21 Jan 2004 11:04:11 +0100 (CET)
Received: from [104.221.238.124] by 66.41.127.38 with HTTP;
       Wed, 21 Jan 2004 03:14:44 -0700
From: "Ruth Walden" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: kirchner acquaint sanctify acrobatic
Mime-Version: 1.0
X-Mailer: animadversion
Date: Wed, 21 Jan 2004 06:14:44 -0400
Reply-To: "Ruth Walden" <[EMAIL PROTECTED]>
Content-Type: multipart/alternative;
       boundary="5846461431537959"
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Checker-Version: SpamAssassin 2.61-myrulesjrp20040121
    (1.212.2.1-2003-12-09-exp) on mailserver.example.com
X-Spam-Level: **
X-Spam-Status: No, hits=2.6 required=5.0 tests=FORGED_HOTMAIL_RCVD2,
    HTML_MESSAGE autolearn=no version=2.61-myrulesjrp20040121


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] This spam scores too low

Reply via email to