John
only a few in few hours (china daily ones) or so, but not yukon ones...here's my hit list for one I did catch.. (note I've bumoe my BAYES_99 score to the pre SA3.0 score!)
5.40 BAYES_99 Bayesian spam probability is 99 to 100%
2.29 BIZ_TLD Contains an URL in the BIZ top-level domain
3.02 FB_FORWARD
1.00 FB_SPACED_MORTG_PT2
0.45 FM_WHITEONWHITE
1.40 FU_TLD_BIZ
0.14 HTML_FONT_BIG HTML tag for a big font size
0.00 HTML_MESSAGE HTML included in message
0.60 J_CHICKENPOX_42 {4}Letter - punctuation - {2}Letter
0.00 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary
2.67 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
0.18 MIME_HTML_ONLY Message only has text/html MIME parts
2.44 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
0.14 MORTGAGE_BEST Information on mortgages
0.07 MPART_ALT_DIFF HTML and text parts are different
0.11 RCVD_IN_SBL Received via a relay in Spamhaus SBL
1.14 SARE_MSGID_EMPTY Message ID is empty, or just spaces
2.00 SARE_SELL_STOCK2
0.85 SARE_SUB_INVESTMENTS Spammer subject - credit or money
4.00 URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html
3.21 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
1.00 URIBL_SBL Contains an URL listed in the SBL blocklist
1.46 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
0.01 URI_REDIRECTOR Message has HTTP redirector URI-- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300
John Andersen wrote:
I've been seeing a lot of stock-spams slipping through lately
and none of them seem to hit any of the standard stock rule sets.
These guys are often not even tripping bayes rules, and come in under the radar even though I run surbl and razor
rules at elevated scores.
The body clearly mentions stocks, and virtually the same email will arrive via different routes all trying to sell me
gold mining stocks in the Yukon. Anybody else seeing these?
**********************************************************************
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.
This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean.
**********************************************************************
