[Fwd: Re: [MAILSCANNER] High scoring SPAM getting through]

[Drew Marshall]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Oops, and this time to the list as intended...

/Note to self, check the whole message, including where you are sending it.

---------------------------- Original Message ----------------------------
Subject: Re: [MAILSCANNER] High scoring SPAM getting through
From:    "Drew Marshall" <drew at themarshalls.co.uk>
Date:    Mon, February 28, 2005 13:40
To:      "Martin Hepworth" <martinh at SOLID-STATE-LOGIC.COM>
--------------------------------------------------------------------------

Martin Hepworth said:
> Lance
>
> OK - well looking at the 'yeahs's in the score of the emails you
provided thay scores 4 and 5, so they get treated as non-spam.
>
> You might want to upgrade to Net::DNS 0.48 and it use the URIRBL's in
SA. This might help alot in catching the stuff.. or add in some mroe
site rules (esp from www.rulesemporium.com if not already using).

Yes, this is what I got:

pts rule name              description
---- ---------------------- ------------------------------------------------
 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level domain
-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000]
 1.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
                            [URIs: witpoli.com]
 1.5 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
                            [URIs: witpoli.com matterotherthanablac.com]
 3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: witpoli.com matterotherthanablac.com]
 4.3 URIBL_SC_SURBL         Contains an URL listed in the SC SURBL blocklist
                            [URIs: witpoli.com]

and the only thing that stopped it being nuked was the bayes score from
the MS list (I delete at 10 points - so the system works!). As you can see
URI tests add over 90% of the points.

Drew



--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!