Well, just off the top of my head, I think the following might be worth a
point or two:
header FROM_BANG From =~ /!\s/
score FROM_BANG 1.2
header __SUBJ_BANG Subject =~ /!/
meta BANG_BANG FROM_BANG && __SUBJ_BANG
score BANG_BANG 2
describe BANG_BANG You're dead!
header X_HUH exists:X-Granda
score X_HUH 0.5
Untried, of course, and for all I know will hit on every message from AOL.
Loren
----- Original Message -----
From: "Larry Rosenman" <[email protected]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, August 19, 2004 1:09 AM
Subject: Why HAM learn on BAYES_99?
> Why did the below message get learned as HAM on a bayes_99?
>
> This is with 3.0.0-rc1.
>
> And, how can we trap this one?
>
> I've gotten like 3 of them, and all have made it to my mailbox....
>
> (I've relearned them as SPAM, but BAYES_99 is not sufficient to
> get it marked as SPAM).
>
> Ideas?
>
>
>
> --
> Larry Rosenman http://www.lerctr.org/~ler
> Phone: +1 972-414-9812 E-Mail: [email protected]
> US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749
>
> ---------- Forwarded message ----------
> Return-path: <[EMAIL PROTECTED]>
> Envelope-to: [email protected]
> Delivery-date: Thu, 19 Aug 2004 02:58:28 -0500
> Received: from mail4.finchdam.com ([208.184.186.215])
> by lerami.lerctr.org with esmtp (Exim 4.41)
> id 1BxhoZ-0003I6-9Y
> for [email protected]; Thu, 19 Aug 2004 02:58:28 -0500
> Message-ID:
>
<[EMAIL PROTECTED]>
> Date: Thu, 19 Aug 2004 03:57:55 -0400 (EDT)
> From: Urgent Real Estate! <[EMAIL PROTECTED]>
> Reply-To: Urgent Real Estate! <[EMAIL PROTECTED]>
> To: [email protected]
> Subject: Foreclosure Listing Site Shutting Down!
> Mime-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
> X-Unsubscribe: To stop receiving this, please send a message
> to <[EMAIL PROTECTED]> with "bye" in the subject
> X-Granda: neo 1 2ij 2k9172 8ng5sl
> X-Spam-Checker-Version: SpamAssassin 3.0.0-rc1 (2004-08-15) on
> lerami.lerctr.org
> X-Spam-Level: *
> X-Spam-Status: No, score=1.9 required=5.0 tests=BAYES_99 autolearn=ham
> version=3.0.0-rc1
>
> Dear larry,
>
> Where have you been?
>
> Did you get my last message. If not, listen up because I have some
startling news to share with you right now! This is so serious that it can't
wait until Friday. Don't even think about buying a foreclosure until you
read this urgent message.
>
> To get the story simply goto:
>
http://www.finchdam.com/dfeasder/aqq6zeiIqjl8tnIoznIiy0p4sIy1mI14/1/159?c=742
>
> <a
href="http://www.finchdam.com/dfeasder/aqq6zeiIqjl8tnIoznIiy0p4sIy1mI14/1/15
9?c=742">Story Here</a>
>
>
> Best Regards,
>
> L.V.
> President/CEO
>
>
> P.S You have to hurry because once I expose this scandal going on right
now in the foreclosure industry my site may be shut down. So this may be
your last chance to get the inside scoop.
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> To end contact:
> http://www.finchdam.com/kehdieyws/0/aqq6zeiIqjl8tnIoznIiy0p4sIy1mI14
>
>
> <a
href="http://www.finchdam.com/kehdieyws/0/aqq6zeiIqjl8tnIoznIiy0p4sIy1mI14";>
End Contact</a>
>
>
>
>
>
>
> Foreclosure World
> P.O.B. 859
> Norwalk, CT. 06856
>
>
>
>
>
