Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: domain of joao.gouveia@anubisnetworks.com
 designates 80.67.98.239 as permitted sender)
Date: Mon, 8 Nov 2010 15:24:08 +0000 (WET)
From: =?utf-8?Q?Jo=C3=A3o_Gouveia?= <joao.gouveia@anubisnetworks.com>
To: Ned Slider <ned@unixmail.co.uk>
Cc: users@spamassassin.apache.org
Message-ID: <1705401459.2087.1289229848635.JavaMail.root@zimbra>
In-Reply-To: <4CD7DC26.4040200@unixmail.co.uk>
Subject: Re: Sought False Positives
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


----- "Ned Slider" <ned@unixmail.co.uk> wrote:

> On 21/08/10 21:51, Ned Slider wrote:
> >
> > I'm still seeing FP hits against these rules despite a few sought
> rule
> > updates.
> >
> > It seems there's a few rules hitting on Facebook:
> >
> > # grep Facebook
> > /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf
> > body __SEEK_YDK7NN / to unsubscribe\. Facebook, Inc/
> > body __SEEK_GYJ_MA / If you do not wish to receive this type of
> email
> > from Facebook in the future, please follow the link below to
> > unsubscribe\. http:\/\/www\.facebook\.com\/ Facebook, Inc\. P\.O\.
> Box
> > 10005, Palo Alto, CA 94303 /
> > body __SEEK_Z4K_72 / sent you a message on Facebook/
> > body __SEEK_A5_EMW /Find people from your Gmail address book on
> Facebook\!/
> > body __SEEK_TKDQL_ /Sign in to Facebook and start connecting/
> > body __SEEK_X4HOA8 /Didn\'t sign up for Facebook\? Please let us
> know\.
> > If you do not wish to receive this type of email from Facebook in
> the
> > future, please click here to unsubscribe\.Facebook, Inc\. P\.O\.
> Box
> > 10005, Palo Alto, CA 94303/
> >
> >
>=20
> Apologies for bumping an old thread...
>=20
> I caught another FP yesterday for facebook:
>=20
> /var/lib/spamassassin/3.003001/sought_rules_yerp_org/20_sought.cf:body
>=20
> __SEEK_FMJXND  /\. If you do not wish to receive this type of email
> from=20
> Facebook in the future, please click here to unsubscribe\. Facebook,=20
> Inc\. P\.O\. Box 10005, Palo Alto, CA 94303 /

I'd guess this is caused by the spam wave that has been going on for some t=
ime now, which basically contains the same content as the Facebook mails bu=
t with spammy URIs instead.
Because of the South rules nature, I'd say that this kind of FPs are likely=
 to happen on such scenarios.

> But it's since been fixed (removed) in the latest update - good work
> on=20
> the quick fix!

--=20
Jo=C3=A3o Gouveia
AnubisNetworks