lots of spam getting through all of a sudden

[Craig Retief]

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Raymond Dijkxhoorn
> Sent: 24 July 2006 03:25 PM
> To: MailScanner discussion
> Subject: Re: {Spam?} RE: lots of spam getting through all of a sudden
> 
> Hi!
> 
> > One particular mail that I see coming through alot lately is a stock
mail
> > from "Goldmark Industries (GDKI.PK)". The message structure is very
similar
> > with an inline gif that contains the info and then some text that
follows.
> 
> Start using the SARE stock rules.
> 
> http://www.rulesemporium.com/rules/70_sare_stocks.cf

I am using the Sare Stocks rule that comes with RulesDuJour and it doesn't
get flagged.

SpamAssassin 3.1.3
MailScanner 4.54.6
Sendmail 8.13.7
DCC, Pyzor and Razor are latest builds as well

RulesDuJour updates nightly

The rules that trigger for the mentioned mail are as follows:

0.00	BAYES_50	Bayesian spam probability is 40 to 60%
1.96	DATE_IN_FUTURE_03_06	Date: is 3 to 6 hours after Received: date
1.09	EXTRA_MPART_TYPE	Header has extraneous Content-type:...type=
entry
4.10	HELO_DYNAMIC_HCC	Relay HELO'd using suspicious hostname (HCC)
1.05	HTML_IMAGE_ONLY_32	HTML: images with 2800-3200 bytes of words
0.00	HTML_MESSAGE	HTML included in message
0.75	SARE_GIF_ATTACH	Email has a inline gif

Thanks again,

Craig

> 
> Bye,
> Raymond.
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!