I'm using SA through exim/exiscan, and I've got it set up to only report if it is spam. Guess I should change that.
The SA logs showing it getting a score of 0. SA is working really well for me the other 99% of the time.
Jerry
Jerry Bell wrote:
This spam went through with a score of 0. I'm using 3.01 with most of the sare rulesets. Any ideas on how to catch these?
Thanks,
Jerry http://www.syslog.org
Return-path: <[EMAIL PROTECTED]> Envelope-to: [EMAIL PROTECTED], [EMAIL PROTECTED] Delivery-date: Thu, 25 Nov 2004 14:53:39 -0500 Received: from [222.76.179.18] (helo=irishlover.net) by stelesys.com with smtp (Exim 4.43 (FreeBSD)) id 1CXPgN-000EzG-OE; Thu, 25 Nov 2004 14:53:39 -0500 Message-ID: <[EMAIL PROTECTED]> Date: Thu, 25 Nov 2004 21:24:31 +0000 From: "abe pasquino" <[EMAIL PROTECTED]> User-Agent: fostering Program V Mail Client 5.0 MIME-Version: 1.0 To: "thurman rand" <[EMAIL PROTECTED]> Subject: internet rx refill-great deals on meds Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit
overnight delivery for orders
meds hotline--low priced meds
Over 600 meds available for sexual health, allergy, asthma, sleeping disorder, obesity, pain relief, sexual health, anxiety relief and hypertension.
lower price the pharmacy could offfer
http://Lu.Yr.goodofurs.com/?Bdyqebamvl9Pq9&Nb1Cld778629Rl=233166Hwk
It is really FAST and EASY for me. Just get the rx refilled online with internet pharmacy. Virginia
`Hark!' said The Vengeance. `Listen, then! Who comes?'As if a train of powder laid from the outermost bound of the Saint Antoine Quarter to the wine-shop door, hada bitter day, he wore no coat, but carried one slung over his shoulder. His shirt-sleeves were rolled up, too,jttmaille51 nurkanvaltaukset 01 nostrilsmarjukka apulaisverotarkastajalle
Umm..i dont see any SA headers..you sure this message was actually scanned?
-Jim
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.9 DATE_MISSING Missing Date: header
2.0 FROM_NO_LOWER 'From' has no lower-case characters
-0.0 BAYES_44 BODY: Bayesian spam probability is 44 to 50%
[score: 0.4638]
1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100
[cf: 100]
1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
I am running 2.64 with no extra rules. Had this been received at my system, the bayes score would most likely have been higher as well.
-Jim
