Did you upgrade an existing install to 2.63? It looks like your rules didn't
match most others.
As Nick showed there are a bunch of stock rules that it should have hit but
with yours it didn't.
pts rule name description
---- ---------------------- --------------------------------------------------
2.0 FROM_NO_LOWER 'From' has no lower-case characters
0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 HTML_MESSAGE BODY: HTML included in message
0.3 HTML_IMAGE_RATIO_10 BODY: HTML has a low ratio of text to image area
-0.0 BAYES_44 BODY: Bayesian spam probability is 44 to 50%
[score: 0.4742]
3.0 BigEvilList_62 URI: Generated BigEvilList_62
0.1 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
1.6 HEADER_COUNT_CTYPE Multiple Content-Type headers found
1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
Also, do you have bayes enabled?
Gary Smith
________________________________
From: Steve Dimoff [mailto:[EMAIL PROTECTED]
Sent: Wed 3/31/2004 10:29 AM
To: Spamassassin-Users (E-mail)
Subject: How to stop HTML Porn emails?
We keep getting these emails in.... and everyday the URL changes, so even if I
create a rule to look for this, the next day or even a couple hours, it's
something new.
Does anyone have a rule set that will work for checking stuff like this? Or do
I just need to turn up the HTML /BIZ top level domain?
Thanks,
Steve
Subject: Local G spot hangout
Date: Wed, 31 Mar 2004 07:25:19 -0800
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0020_CCA733DF.CF34DE01"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
X-AntiVirus: Checked by Dr.Web (http://www.drweb.net)
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on usn-mx1
X-Spam-Status: No, hits=2.7 required=3.0 tests=BIZ_TLD,FROM_ENDS_IN_NUMS,
HTML_30_40,HTML_FONT_FACE_BAD,HTML_MESSAGE autolearn=no version=2.63
X-Spam-Report:
* 0.9 FROM_ENDS_IN_NUMS From: ends in numbers
* 0.8 HTML_30_40 BODY: Message is 30% to 40% HTML
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.2 HTML_FONT_FACE_BAD BODY: HTML font face is not a word
* 0.8 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
This is a multi-part message in MIME format.
------=_NextPart_000_0020_CCA733DF.CF34DE01
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
------=_NextPart_000_0020_CCA733DF.CF34DE01
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_0020_CCA733DF.CF34DE01--
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="MSHTML 6.00.2800.1276" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=093192920-17022004>
<center>
<a href="
<http://www.lisahomepage.biz/w13/gsm/logs1/index.html";><img>
