Return-Path: Delivered-To: apmail-spamassassin-users-archive@www.apache.org Received: (qmail 31381 invoked from network); 12 Sep 2007 15:05:59 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 12 Sep 2007 15:05:59 -0000 Received: (qmail 8566 invoked by uid 500); 12 Sep 2007 15:05:42 -0000 Delivered-To: apmail-spamassassin-users-archive@spamassassin.apache.org Received: (qmail 8541 invoked by uid 500); 12 Sep 2007 15:05:42 -0000 Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@spamassassin.apache.org Received: (qmail 8532 invoked by uid 99); 12 Sep 2007 15:05:42 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 12 Sep 2007 08:05:42 -0700 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of wilson-ml@bubba.org designates 208.113.175.8 as permitted sender) Received: from [208.113.175.8] (HELO smarty.dreamhost.com) (208.113.175.8) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 12 Sep 2007 15:07:14 +0000 Received: from gower.dreamhost.com (gower.dreamhost.com [64.111.110.10]) by smarty.dreamhost.com (Postfix) with ESMTP id 93327EE2B1 for ; Wed, 12 Sep 2007 08:04:43 -0700 (PDT) Received: by gower.dreamhost.com (Postfix, from userid 105671) id 6A862CC694; Wed, 12 Sep 2007 08:04:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by gower.dreamhost.com (Postfix) with ESMTP id 5693788470 for ; Wed, 12 Sep 2007 08:04:43 -0700 (PDT) Date: Wed, 12 Sep 2007 08:04:40 -0700 (PDT) From: Brian Wilson To: users@spamassassin.apache.org Subject: debbie-dealz / frosty-saver / got-hyrda / aero-dog spam Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Checked: Checked by ClamAV on apache.org I've somehow made it onto spam list that isn't being picked up by RBLs or by bayes. All messages have a url that looks like this (where X's are all digits): http://aero-dog.com/1-23-28276-45381XXXXXXX.html All messages are originating from 206.131.x.x and I have been submitting them to spamcop. A sample message is here: http://bubba.org/spam/newspam1.txt Any suggestions for detecting this? My bayes has been pretty much spot on for months, so this has me puzzled. Thanks, Brian