On 5/30/2016 10:24 PM, Shivram Krishnan wrote:
I am testing spamassassin on a SPAM/HAM corpus of mails. Spamassassin is
not picking up an obvious spam like in this case
http://pastebin.com/MbNRNFWy .
Your pastebin example didn't show the "last external" sending IP. Could
have have been there orginally, but was expunged from this sample? Could
there have also been a link in the body of the message that was likewise
removed?
it would be nice to be able to check those against respected low-FP DNSBLs.
Or, if the clickable link really wasn't in the original message, then
this particular example was probably a rare malfunctioned spam that will
be of no benefit to the spammer, and would then probably not be worth
investigating since the spammer then has no incentive to keep sending
these types.
--
Rob McEwen
