Unbelievably, I haven't gotten any stock spams since that last one! I'll reply with the SA headers when I get another one ... yeesh. Thanks for the reply, tho'.
*********** REPLY SEPARATOR *********** On 12/1/06 at 2:49 PM Evan Platt wrote: >At 02:44 PM 12/1/2006, you wrote: >>I've got a simple rule that checks for "favorite financial >>institution site" in the message body. I've assigned that rule a >>default score of 10.0, however when the message arrives in my spam >>trap, the SA score is 7.5, high enough to get it into the spam trap, >>but clearly below 10.0. >> >>What's up with that? Is the spammer (y'all know who they are) clever >>enough to write a message that earns negative points? Just wondering >>... thanks! > >What do the SA headers say? > >Should look like > >Content analysis details: (9.4 points, 5.0 required) > > pts rule name description >---- ---------------------- >-------------------------------------------------- > 0.3 SARE_SUB_SEXY subject has likely spammer phrase or word > 1.7 SARE_ADLTSUB2 Contains possible adult words > 1.3 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO > 0.9 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' >headers > 0.1 TW_ZZ BODY: Odd Letter Triples with ZZ > 1.0 SARE_ADULT2 BODY: Contains adult material > 0.9 SARE_ADULT1 BODY: Contains adult material > 0.8 INFO_TLD URI: Contains an URL in the INFO top-level >domain > 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level > above 50% > [cf: 100] > 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) > 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% > [cf: 100]
