> -----Original Message-----
> From: Thomas Arend [mailto:[EMAIL PROTECTED]
> Sent: Friday, February 11, 2005 1:41 PM
> To: users@spamassassin.apache.org
> Subject: Re: Humor: "The Ultimate Spam Email"
>
> Am Donnerstag, 10. Februar 2005 22:46 schrieb Jim Maul:
> > Mike Jackson wrote:
> > >> http://lowendmac.com/lite/05/0210.html
> > >
> > > I sent it to myself...
> > >
> > > X-Spam-Report:
> > > * 1.8 URG_BIZ BODY: Contains urgent matter
> > > * 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
> > > * 0.7 SARE_URGBIZ BODY: Contains urgent matter
> > > * 2.6 NA_DOLLARS BODY: Talks about a million North
> American dollars
> > > * 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
> > > * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> > > * [score: 0.0003]
> > > * 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
> > > * [URIs: walla.com]
> > > * 1.7 SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam
> > > * 1.7 SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam
> > > * 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam
> > > message 1+
> > > * 1.7 SARE_FRAUD_X5 Matches 5+ phrases commonly used in
> fraud spam
> > > * 1.7 SARE_FRAUD_X6 Matches 6+ phrases commonly used in
> fraud spam
> > > * 1.2 MISSING_SUBJECT Missing Subject: header
> > > * 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam
> > > message 2+
> > > * 1.7 SARE_FRAUD_X3 Matches 3+ phrases commonly used in
> fraud spam
> > > * 1.7 SARE_FRAUD_X4 Matches 4+ phrases commonly used in
> fraud spam
> > > * 1.7 SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam
> > > * 1.7 SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam
> > > * 1.7 SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam
> > > * 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam
> > > message 3+
> > > * 1.7 SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam
> > > * 0.9 SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam
> > > * -15 AWL AWL: From: address is in the auto white-list
> > >
> > > The AWL hit is because I sent it from my work address.
> The low Bayes
> > > score surprises me; my Bayes database should be loaded with crap
> > > like that.
> >
> > I just tried saving the text to a file and running spamc on it. It
> > didnt have any headers or anything but it still managed a score of
> > 10.6 on my system without any add on rules...pretty good i
> think. My
> > bayes hit with a BAYES_44.
> >
> > -Jim
>
> Without the SARE rules I got the following low scores. One
> rule is my own TA_Save_b01.
>
> Thomas
>
> Content analysis details: (6.0 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> -3.3 ALL_TRUSTED Did not pass through any untrusted hosts
> 1.8 URG_BIZ BODY: Contains urgent matter
> 0.5 TA_Save_b01 BODY: Promise to save
> 2.6 NA_DOLLARS BODY: Talks about a million North
> American dollars
> 0.4 US_DOLLARS_3 BODY: Mentions millions of $
> ($NN,NNN,NNN.NN)
> 0.0 BAYES_50 BODY: Bayesian spam probability
> is 40 to 60%
> [score: 0.5000]
> 0.6 NIGERIAN_BODY2 Message body looks like a
> Nigerian spam message 2+
> 3.4 NIGERIAN_BODY1 Message body looks like a
> Nigerian spam message 1+
> 0.1 NIGERIAN_BODY3 Message body looks like a
> Nigerian spam message 3+
X-Spam-Report:
* -0.0 SPF_PASS SPF: sender matches SPF record
* 2.3 MANGLED_FREE BODY: mangled free
* 0.3 OFFER BODY: Offers you Something
* 1.0 SARE_OEM_SOFT_IS BODY: Software that is OEM
* 0.8 SARE_OEM_OEMCD BODY: Mentions a OEM cd
* 0.4 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)
* 1.8 URG_BIZ BODY: Contains urgent matter
* 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha
* 0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
* 0.7 SARE_URGBIZ BODY: Contains urgent matter
* 2.6 NA_DOLLARS BODY: Talks about a million North American dollars
* 1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 3.4 NIGERIAN_BODY1 Message body looks like a Nigerian spam
message 1+
* 1.2 MISSING_SUBJECT Missing Subject: header
* 0.6 NIGERIAN_BODY2 Message body looks like a Nigerian spam
message 2+
* 3.0 NIGERIAN_BODY_2 More Nigerian scum body content
* 0.1 NIGERIAN_BODY3 Message body looks like a Nigerian spam
message 3+
* -7.0 AWL AWL: From: address is in the auto white-list
Scores pretty well (14.3, 9.0 required), though, I heard that SpamAssassin
3+ included the SARE_FRAUD rules (or similiar). But looking at the report, I
don't see any fraud-hits from SpamAssassin :-/
Would it be wise to re-add SARE_FRAUD as a extra ruleset to SpamAssassin?
Kind Regards,
Sander Holthaus
