| Main Archive Page > Month Archives > spamassassin-users archives |
SA rules don't seem to be getting hit
From: Brody <amltech_at_nospam>Date: Fri Mar 26 2010 - 22:44:19 GMT
To: users@spamassassin.apache.org
Hi,
I've got a linux box running sa 3.2.5
normally sa is invoked via amavis, however for this test I'm running it
via spamassassin -D <msg
It seems that sa isn't hitting any of the more useful rules i.e. ones
that should cause it to increase the score.
Below you will find a sanatized email message, that I believe should
have triggered at least 6 rules including STOCK_ALERT, however on my
setup the only rule hit was HTML_MESSAGE. I know this because I fed the
message through another machine's sa install and got the hits.
I have changed my config to match the other machine's but it doesn't
seem to affect it. I've also confirmed we're running the same version
of sa.
Here is the rules that mine matches
[13337] dbg: check: tests=HTML_MESSAGE
[13337] dbg: check:
subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__DOS_BODY_STOCK,__DOS_BODY_THU,__DOS_BODY_TUE,__DOS_BODY_WED,__DOS_HAS_ANY_URI,__DOS_RCVD_THU,__DOS_REF_TODAY,__DOS_RELAYED_EXT,__DOS_SINGLE_EXT_RELAY,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FB_PICK,__FB_S_PRICE,__FB_S_STOCK,__FM_MY_PRICE,__FM_STOCK_WORDS,__FRAUD_DBI,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,__KAM_LOTTO3,__LAST_UNTRUSTED_RELAY_NO_AUTH,__MIME_HTML,__MIME_VERSION,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TOCC_EXISTS,__TVD_BODY,__TVD_MIME_ATT_TP
vs what I expect.
[19709] dbg: check:
tests=ALL_TRUSTED,MISSING_DATE,MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,STOCK_ALERT
[19709] dbg: check:
subtests=__DOS_BODY_STOCK,__DOS_BODY_SUN,__DOS_BODY_THU,__DOS_BODY_TUE,__DOS_BODY_WED,__DOS_HAS_ANY_URI,__DOS_RCVD_THU,__DOS_REF_TODAY,__FB_NUM_PERCNT,__FB_PICK,__FB_S_PRICE,__FB_S_STOCK,__FM_MY_PRICE,__FM_STOCK_WORDS,__FRAUD_DBI,__FRAUD_MLY,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_RCVD,__KAM_LOTTO3,__MISSING_REF,__NONEMPTY_BODY,__TVD_BODY
Any help would be appreciated.
Return-Path: <finance@email.lookingglassprinting.com>
X-Original-To: email@domain.com
Delivered-To: email@domain.com
Received: from localhost (localhost [127.0.0.1])
by mail.mail.domain.com (Postfix) with ESMTP id 441AA8DBF
for <email@domain.com>; Thu, 25 Mar 2010 08:22:07 -0400 (EDT)
X-Virus-Scanned: amavisd-new at domain.com
Received: from mail.domain.com ([127.0.0.1])
by localhost (mail.domain.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id YkagjY6pTJBR for <email@domain.com>;
Thu, 25 Mar 2010 08:22:06 -0400 (EDT)
Received: from sun.lookingglassprinting.com
(sun.lookingglassprinting.com[205.207.85.201])
by mail.domain.com (Postfix) with ESMTP id ED90E8D01
for <email@domain.com>; Thu, 25 Mar 2010 08:22:05 -0400 (EDT)
Received: by sun.lookingglassprinting.com id hldaee000003 for
<email@domain.com>; Thu, 25 Mar 2010 07:19:50 -0500 (envelope-from
<finance@email.lookingglassprinting.com>)
Reply-To: <finance@email.lookingglassprinting.com>
Message-Id: <1269519020.eigicbh@email.lookingglassprinting.com>
From: "Your Stock Alert" <finance@email.lookingglassprinting.com>
To: <email@domain.com>
Subject: Did you make any money with our pick last week?
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="RORUZIYFFT-eigicbh.uoti1"
Date: Thu, 25 Mar 2010 07:19:51 -0500
Multipart message in MIME format.
--RORUZIYFFT-eigicbh.uoti1
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=iso-8859-1
UNLA NOW TRADING AT $0.64; UP 12% (+.07) FROM TUES, GAINED +.44 (+320%!)
SINCE FIRST ALERT!
Enable images / turn on "pictures" in your e-mail browser to load this
message completely.
Editor's Note: We've been alerting this stock to our members and the
general public alike for just a week now, and it's seen gains over over
300%.If that's not massive, I don't know what is. We think this thing
still has room to run to the upside, and there's still money to be made.
But ...if you like, you can continue to sit on your keister and make no
money, waiting for our April pick in grueling agony. No guarantees it'll
be a 300% gainer like UNLA!
Who has a popular social networking website, a low-cost 3G cellular
Internet USB modem (providing incredible consumer exposure), an Internet
yellow pages providing search and services to consumers and businesses,
and tele-com ops in every state as well as wireless in eleven?
THE STOCK WE'VE LOVED ALL WEEK -- UNILAVA [UNLA]!
Membership on it's social networking site is amazing, which may mean
great advertising revenue!
Also ...
* It's "yellow-pages" and search services provide value to the
entireweb!
* Local, long distance and cellular telephone coverage gives
consumers a discount choice
* Provides us smaller investors an opportunity to get into one of
themost profitable industries in the world for little capital investment!
Social Networking Websites Advertising Revenues Expected to Exceed $1B
in2010!
* Advertising on social networking sites is to expand to well over a
billion bucks in 2010!
* UNLA is in the unique positionto capitalize and profit on this
withboth it's social networking website and it's search "yellow pages" site!
Even more reasons we love UNLA ...
* The stock has more than tripled since our original alert went out
to members last Wednesday!
* We believe the stock still has more room to run and when the
shortsare squeezed, look out above!
* The company has exposure in some of the very few industries that
are actually SEEING PROFITS CONTINUE TO RISE.
* From a technical stand-point, UNLA is in un-charted territory and
has no significant resistance to upwards price movement.
Cellular Broadband Card Making a Big Splash (and Potential Big Revenues!)
"Unilava Corp. ... today announced the availability of the 3G USB
Portable Laptop Stick, Broadband Bullet, offering business customers
seamless connectivity to the Internet from their laptop while on the go
via nationwide and international 3G wireless broadband service in over
120 countries.The Company has already pre-sold the Broadband Bullet
through its sales and distribution channels."
Investors - do not close this e-mail without doing your
due-diligenceon this company!
UNLA (UNILAVA CORPORATION)
ALERT PRICE.: $0.17 - $0.20 (CURRENTY @ $0.64; +320%)
Shares Outstanding: 100mm (market cap; $64 million)
If you'd prefer not to receive our alerts and newsletter you may send us
an e-mail to unsubscribe@email.lookingglassprinting.com with the text
"Unsubscribe" in the body and/or subject line.
Alternately, you may write to us at E-MAIL NEWSLETTER, 3155 E Russell Rd
Suite A-4 #301, Las Vegas, NV, 89120.
And as always, our newsletter's famous disclaimer: Do not trade or
investon the companies featured in our newsletter unless you can afford
to lose your investment. Always do your due diligence before investing;
our investment and trading style may not suit your risk parameters or
desired targets.
No statement or expression of opinion, or any other matter herein,
directly or indirectly, is an offer or the solicitation of an offer to
buy or sell the securities or financial instruments mentioned. While we
believe the sources of information to be reliable, we in no way
represent or guarantee the accuracy of the statements made herein. The
authors of this e-mail do not provide individual investment counseling,
act as an investment advisor, or individually advocate the purchase or
sale of any security orinvestment. The publisher, editors and
consultants of this newslettermayactively trade in the investments
discussed in this newsletter. They mayhave substantial positions in the
securities recommended and may increase or decrease such positions
without notice. Neither the publisher nor the editors are registered
investment advisors. Subscribers should not viewthis publication as
offering personalized legal or investment counseling. Investments
recommended in this publica
tion should be made only after consulting with your investment advisor
and only after reviewing the prospectus or financial statements of the
company in question.
--RORUZIYFFT-eigicbh.uoti1
Content-Type: text/html; charset=iso-8859-1
<html>
<head>
<title>MARKET NEWS LETTER FOR THURSDAY</title>
</head>
<body style="width: 700px; font-family: Arial, Helvetica, sans-serif">
<table width="100%" border="0" bgcolor="#CCCC11">
<tr>
<td><strong><font size="-1">UNLA NOW TRADING AT $0.64; UP 12% (+.07)
FROM TUES, GAINED +.44 (+320%!) SINCE FIRST ALERT!</font></strong></td>
</tr>
</table>
<p><font size="-1" color="red"> <strong>Enable images / turn on
"pictures" in your e-mail browser to load this message
completely.</strong></font></p>
<p><strong>Editor's Note: </strong>We've been alerting this stock to our
members and the general public alike for just a week now, and it's seen
gains over <strong>over 300%</strong>. If that's not massive, I don't
knowwhat is. We think this thing <strong>still has room to run to the
upside</strong>, and there's still money to be made. But ... if you
like, you can continue to sit on your keister and make no money, waiting
for our April pick in grueling agony. No guarantees it'll be a 300%
gainer like <font color="blue"><strong>UNLA</strong></font>!</p>
<p>Who has a popular social networking website, a low-cost 3G cellular
Internet USB modem (providing incredible consumer exposure), an Internet
yellow pages providing search and services to consumers and businesses,
andtele-com ops in every state as well as wireless in eleven?</p>
<p><font size="+2">THE STOCK WE'VE LOVED ALL WEEK -- <strong>UNILAVA
[<font color="blue">UNLA</font>]</strong>!</font></p>
<table width="100%" border="0" bgcolor="#CCCCC0">
<tr>
<td><p>Membership on it's social networking site is
<strong>amazing</strong>, which may mean great advertising revenue!<br>
Also ...</p>
<ul>
<li>It's "yellow-pages" and search services provide
value to the entire web!</li>
<li>Local, long distance and cellular telephone coverage gives
consumers a discount choice</li>
<li>Provides us smaller investors an opportunity to get into one
of the most profitable industries in the world for little capital
investment!</li>
</ul></td>
</tr>
</table>
<p><em><strong>Social Networking Websites Advertising Revenues Expected
to Exceed $1B in 2010!</strong></em></p>
<ul>
<li>Advertising on social networking sites is to expand to well
<strong>over a billion</strong> bucks in 2010!</li>
<li><strong><font color="blue">UNLA</font></strong> is in the unique
positionto <strong>capitalize</strong> and <strong>profit</strong> on
this with both it's social networking website and it's search
"yellow pages" site!</li>
</ul>
<table width="100%" border="0" bgcolor="#CCCCC0">
<tr>
<td><p><em><strong>Even more reasons we love <font
color="blue">UNLA</font> ...</strong></em></p>
<ul>
<li>The stock has more than <strong>tripled</strong> since our
original alert went out to members last Wednesday!</li>
<li>We believe the stock still has more room to run and when the
<strong>shorts are squeezed</strong>, look out above!</li>
<li>The company has exposure in some of the very few industries
that are actually <strong>SEEING PROFITS CONTINUE TO RISE.</strong></li>
<li>From a technical stand-point, UNLA is in un-charted
territoryand has no significant resistance to upwards price movement.</li>
</ul></td>
</tr>
</table>
<p><strong><em>Cellular Broadband Card Making a Big Splash (and
PotentialBig Revenues!)</em></strong></p>
<p><font size="-1"><em>"Unilava Corp. ... today announced the
availability of the 3G USB Portable Laptop Stick, Broadband Bullet,
offering business customers seamless connectivity to the Internet from
their laptop while on the go via nationwide and international 3G
wireless broadband service in over 120 countries. The Company has
already pre-sold the Broadband Bullet through its sales and
distribution channels."</em></font></p>
<blockquote>
<p><em>Investors - do not close this e-mail without doing your
due-diligence on this company!<br>
<br>
</em><font color="blue"><strong>UNLA</strong></font> (UNILAVA
CORPORATION)<br />
<strong>ALERT PRICE</strong>.: $0.17 - $0.20 <strong>(CURRENTY @
$0.64; +320%)</strong><br />
Shares Outstanding: <strong>100mm</strong> (market cap; $64 million)</p>
</blockquote>
<hr noshade />
<p> If you'd prefer not to receive our alerts and newsletter you may
sendus an e-mail to <a
href="mailto:unsubscribe@email.lookingglassprinting.com"
target="_blank">unsubscribe@email.lookingglassprinting.com</a> with the
text "Unsubscribe" in the body and/or subject line.
<br><img src="http://img.lookingglassprinting.com/1.gif?e=eigicbh"
width="1" height="1" border="0" />
<br>
Alternately, you may write to us at E-MAIL NEWSLETTER, 3155 E Russell Rd
Suite A-4 #301, Las Vegas, NV, 89120.<br>
<br>
And as always, our newsletter's famous disclaimer:
Do not trade or invest on the companies featured in our newsletter
unlessyou can afford to lose your investment. <strong>Always do your due
diligence before investing; our investment and trading style may not
suit yourrisk parameters or desired targets.</strong><br>
<br>
<font size="-1">No statement or expression of opinion, or any other
matter herein, directly or indirectly, is an offer or the solicitation
of an offer to buy or sell the securities or financial instruments
mentioned. While we believe the sources of information to be reliable,
we in no way represent or guarantee the accuracy of the statements
made herein. The authors of this e-mail do not provide individual
investment counseling, act as an investment advisor, or individually
advocate the purchase or sale of any security or investment. The
publisher, editors and consultants of this newslettermay actively
trade in the investments discussed in this newsletter. They may have
substantial positions in the securities recommended and may increase
or decrease such positions without notice. Neither the publisher nor
the editors are registered investment advisors. Subscribers should not
view this publication as offering personalized legal or investment
counseling.
Investments recommended in this publication should be made only
afterconsulting with your investment advisor and only after reviewing
the prospectus or financial statements of the company in
question.</font></p>
</body>
</html>
--RORUZIYFFT-eigicbh.uoti1--