Dan Simmons wrote: > Hi All, > > I am having an issue with the following DRUG related spam. Does > anyone have any rules to catch this? > > Environment: SA 3.0.2 with network tests and the following SARE rule sets: <snip> > X-SA-SysThreshold: 6.0 > 0.8 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words > 0.1 HTML_40_50 BODY: Message is 40% to 50% HTML > 0.0 HTML_MESSAGE BODY: HTML included in message >
For your message I got the following (SA 2.64 with Mail::SpamCopURI) SpamAssassin (score=7.908, required 5, AB_URI_RBL 1.00, BAYES_00 -4.90, BLACK_URI_RBL 2.00, HTML_MESSAGE 0.10, HTTP_ESCAPED_HOST 1.51, INFO_GREYLIST_NOTDELAYED -0.00, JP_URI_RBL 1.00, OB_URI_RBL 2.10, SPAMCOP_URI_RBL 3.00, WS_URI_RBL 2.10) Most of that is URI blacklists from surbl (supported by SA 3.x by default), as well as uribl.com (not supported in default config but I added it by hand) I'd check to see if your URIBL's are working. SA 3.x supports them by default, but you need a relatively recent Net::DNS for them to work. Also, if you're using a ported package for your OS distribution instead of the official SA packages, make sure you've got an init.pre file in your configuration. If you don't, the URIBL plugin won't load.
