On Thu, 2010-03-11 at 08:18 -0500, Carlos Mennens wrote: > On Wed, Mar 10, 2010 at 6:04 PM, Martin Gregorie <mar...@gregorie.org> wrote: > > Post the entire message to pastebin or a similar site and send the URL > > here together with your explanation of what happened so we have > > something to work with. > > I am sorry I didn't post enough data. > > http://pastebin.com/r8Swp1mu > > As for the body of the message...it only had a hyper link embedded to > some site to buy male enhancement junk. Nothing else. > That 'male enhancement junk' advert may well contain something that could be the basis of an additional rule - don't omit *anything* in future, at least until you understand how to write custom rules. Spammers often use an algorithm to generate their destination websites. This algorithm often generates patterns that can be matched with an SA rule. However, it may be reasonable to obscure your own and/or your user's address, e.g. by changing it to u...@example.com.
In fact, when I ran your message through SA 3.3.0 the standard rules gave a score of 5.2 even without the body text. That is enough to treat it as spam if you were using the default required score. Why did you change your required score to 6.3? That is a pretty specific value. Since this spam was sent via Yahoo webmail you could also try passing it to ab...@yahoo.com, though if they're still routing ab...@yahoo.com to /dev/null that won't do any good apart from maybe making you feel better. Martin
