lots of spam getting through all of a sudden

[Julian Field]

Raymond Dijkxhoorn wrote:
> Hi!
> 
>> I keep getting this  GDKI.PK spam as well. I have all the SARE rules, 
>> including SARE_STOCKS (from July 15th) but it gets
>>
>> not spam, SpamAssassin (score=4.992, required 6, BAYES_40 -0.18, 
>> DATE_IN_PAST_06_12 0.83, EXTRA_MPART_TYPE 1.09, HTML_IMAGE_ONLY_32 
>> 1.05, HTML_MESSAGE 0.00, RCVD_IN_SORBS_WEB 1.46, SARE_GIF_ATTACH 0.75)
>>
>> Any ideas if anything is wrong or I am missing something?
> 
> SARE_STOCK is last modifies 14-07. Seems you dont update it properly.

I use Rulesdujour to do the updates. The last mod date was 14/07 and I 
updated my copy on 15/07 so the update is working fine. GDKI does not 
appear as a string in that rules cf file at all.

I have added your suggested rule below, let's hope that has some effect.
Thanks,
Jules.

> 
> You could try with adding:
> 
> body            PROLO_STOCK_SYM4                
> /\b(?:WBRS\.PK|HLUN\.PK|GDKI\.PK|ILKG\.PK|VNGP\.PK|DPER\.PK|FCYI\.PK|KMAG\.PK|DPEK\.PK|EPLJ\.PK|KFTG\.PK|HYWI|FCYI\.PK|LITL\.PK|TGVI\.PK|VMCI\.PK|AGHG\.PK|DPGP\.PK|AVCP\.PK|FPPL\.PK|CTFE\.PK|UBTA\.PK|Mhpt.pk|BDWH\.PK|BIGN.PK|CRHI\.OB|CBIO\.PK|SWNM.PK)\b/ 
> 
> score           PROLO_STOCK_SYM4                2
> 
> Bye,
> Raymond.

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.