This is a discussion on Re: Casino scams - SpamAssassin ; On Sat, 2008-11-01 at 23:19 +0100, Karsten Bräckelmann wrote: > Yes, there is. Your MUA, Evolution, features pre-formatted paragraphs in > the Composer. But I don't feel like repeating myself today. > True enough. It usually merely annoys me when ...
On Sat, 2008-11-01 at 23:19 +0100, Karsten Bräckelmann wrote:
> Yes, there is. Your MUA, Evolution, features pre-formatted paragraphs in
> the Composer. But I don't feel like repeating myself today.
True enough. It usually merely annoys me when replying to messages sent
some, probably MS, MUA that sends paragraphs as one long line. Its not
identifying itself, but it uses a message id of
hex_coded_string@another_hex_coded_string which should be rather
distinctive. I must remember to use it selectively to prevent line
> > describe MG_CASINO Casino gambling
> > body __MG_CAS1 /(csnaio|casino)/i
> > header __MG_CAS2 Subject =~ /casino/i
> > header __MG_CAS3 From =~ /casino/i
> > body __MG_CAS4 /(\$[0-9]+|[0-9]+ *euro|gold|real deal|invite.*play)/i
> > meta MG_CASINO ((__MG_CAS1||__MG_CAS2||__MG_CAS3)&&__MG_CAS4)
> > score MG_CASINO 2.0
> Hmm, it might be worth for local rules, to score at least a few of
> them on sight with a low score, yet keeping them in the meta. (Yes,
> single word rules are generally bad, but scoring a From header that
> contains specific words might help catch these.) I'd enforce word
> breaks, though.
....and reduce the meta score to compensate?
Has the Perl regex syntax changed since Perl4? If it has I think I need
to get another Perl book before venturing away from the simple subset
I'm comfortable with.
> This one would have been flagged as spam when using the default
> required_score spam threshold of 5.0.
I'm thinking about reducing that back to the default. I initially set it
higher while finding out how to use SA.
> Also, I notice you're apparently
> not using Bayes, which likely could raise the score above your 6.0
> threshold, when trained on these.
Not entirely. Its enabled but I'm only using auto-learn with default
thresholds. However its probably not doing much at present because I
recently reset it by deleting the bayes database.
> On my check the sample also scored 0.8 for SPF_HELO_SOFTFAIL. Plus
> Pyzor, which is not enabled by default unless you install Pyzor.
> URIBL_BLACK as well as SURBL JP and OB triggered for me. These might
> very well be updated *after* you received that mail, but it won't hurt
> to check, if they are working for you at all.
Yes, they are now scoring here too.
> Oh, and then I got a custom rule worth 0.5 for any single Relay, direct
> client to MX mail.
Nope, I'm not seeing that one.
Thanks for your input.