On Sun, 2005-09-18 at 01:34 -0700, Loren Wilton wrote: > > I'm getting this kind of email like once a day and it seems like it > > scores 0 everytime. I'm using spamasssin 3.1 and feeding them to > > sa-learn as spam aswell. > > Well, some obvious questions: > > 1. Is bayes really working for you normally?
yes it does - for all emails except this one. > 2 Do you have any local german-language spam rules? no, I don't > Now, I don't speak german, but a quick glance makes me think this is a > typical english spam translated to german by someone that doesn't know the > language well. sorry but I have to tell you that this emails are actually written in very good german - blame google for the translation. > To me, it looks like it is just full of things that would be easy to catch. > But then, since I don't speak the language and can't congugate a verb or > noun or whatever declines in German, I can't guess what trivial one-letter > changes would render any rules I wrote useless. I also don't know what > phrases or words that look like good catches might be just common German > phrases. > > I ran this thru SA here and got about 7 points. But 1.1 points was from a > rule that was English based and inapplicable to German, and 3 points were > from local rules that are inapplicable. That leaves 3.2 points from SURBL, > which isn't enough by itself to make this spam. > > Now I could knock out a handful of body rules to catch this for you, but > they would all be guesses, and probably some pretty bad guesses at that. I > would suggest that a simple thing to try would be to look through this and > stick some spammy-sounding phrases into a stock rule form, and then stick > those rules in your local.cf and see how they do. This isn't the apex of > rule writing, but it should certainly be good enough for this kind of spam. I know that I could write custom rules but I thought that maybe spamassassin is mature enough to detect this german crap without any additional rules. for testing purposes I also do forward this emails to my gmail account and guess what - there they get detected as spam. So it seems like these guys are doing something different because I can't imagine that they really do write custom rules. thanks anyway for your help, andreas
