On Tue, 18 Oct 2016, Sue Mey wrote:

Spam score details (in lieu of printscreen). I tried GetResonse help first but they seem stumped as to the reason for this. In the meantime I am just stuck.

Spam Assassin results


BODY: Uses a mis-spelled version of cialis.

Absent the actual rule names, this is all stabbing in the dark...

(1) there is no rule with that description in the current base rule set provided by the SpamAssassin project.

(2) the base SA rules that do look for "cialis" obfuscation did not hit on the text you provided in my local testbed. Note, however, that what you provided is not a complete properly-formed email message so take that test with a grain of salt. But based on a visual inspection there doesn't appear to be anything in your message that the current base SA rules would consider misspelled "cialis".

If you're willing to privately mail me just the HTML content as a file, I can test that part a bit more thoroughly. The HTML in the sample you provided was not really usable because it was embedded in a bunch of MSFT HTML Email markup garbage that I wasn't willing to try to strip off.

(3) the base SA rules that do look for "cialis" obfuscation are all currently scored at 2.1 points or less.

So: you do need to work with GetResponse on this. It appears that one or more of the following are true, none of which we can help you with:

(1) they are using old rules, or an old version of SA that is no longer getting rule updates from the SA project

(2) they are using custom rules that are not part of the base rules currently provided by the SA project, or possibly are changing the descriptions of base rules

(3) they are setting local scores that are higher than what the current base rules are providing

A recommendation for GetResponse: include the names of the rule hits in that report. It won't have meaning to most nontechnical users, but if it reaches the point you have reached it will really help the analysis.

 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org    FALaholic #11174     pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
  Vista is at best mildly annoying and at worst makes you want to
  rush to Redmond, Wash. and rip somebody's liver out.      -- Forbes
 301 days since the first successful real return to launch site (SpaceX)

Reply via email to