Yeah, all of them match the HTML_IMAGE_ONLY_12 rule, but not the rest of them. As an initial measure I raised the score for that rule, but I understand that's not the solution.
Ruben > These are caught quite easily on my home system: > > Content analysis details: (42.1 points, 5.0 required) > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > 1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= > entry > 2.0 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: > date > 2.0 BIZ_TLD URI: Contains an URL in the BIZ top-level > domain > 1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of > words > 0.0 HTML_MESSAGE BODY: HTML included in message > 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99% > [score: 0.9555] > 1.0 M_K_N0N0_WORDS_BODY RAW: The body contains n0n0 words > 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level > above 50% > [cf: 100] > 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) > 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% > [cf: 100] > 2.2 DCC_CHECK Listed in DCC > (http://rhyolite.com/anti-spam/dcc/) > 3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL > [201.220.121.72 listed in sbl- > xbl.spamhaus.org] > 1.6 URIBL_SBL Contains an URL listed in the SBL blocklist > [URIs: bambooo.MUNGED.biz] > 3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL > blocklist > [URIs: bambooo.MUNGED.biz] > 4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL > blocklist > [URIs: bambooo.MUNGED.biz] > 2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL > blocklist > [URIs: bambooo.MUNGED.biz] > 3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL > blocklist > [URIs: bambooo.MUNGED.biz] > 4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL > blocklist > [URIs: bambooo.MUNGED.biz] > 0.8 DIGEST_MULTIPLE Message hits more than one network digest > check > 1.6 HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image > 1.0 SAGREY Adds 1.0 to spam from first-time senders > > -- > Chris > Registered Linux User 283774 http://counter.li.org > 17:11:40 up 26 days, 22:58, 1 user, load average: 0.06, 0.15, 0.19 > Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk
