Here is what I found running spamc on the full message (including attachments).
It does not look like a forged hotmail message. Should I just lower the FAILURE_NOTICE_2 score? Dan Content analysis details: (10.90 points, 5 required) NO_REAL_NAME (0.8 points) From: does not include a real name FAILURE_NOTICE_1 (-0.3 points) Mailer daemon failure notice (1) VBOUNCE_POSTMASTER (1.0 points) Message from the postmaster MLM (0.8 points) BODY: Multi Level Marketing mentioned WEIRD_QUOTING (1.5 points) BODY: Weird repeated double-quotation marks in body FAILURE_NOTICE_2 (-0.4 points) BODY: Mailer daemon failure notice (2) HTML_COMMENT_8BITS (2.9 points) BODY: HTML comment has 3 consecutive 8-bit characters HTML_10_20 (1.4 points) BODY: Message is 10% to 20% HTML HTML_SHOUTING4 (0.5 points) BODY: HTML has very strong "shouting" markup MAILTO_TO_SPAM_ADDR (0.4 points) URI: Includes a link to a likely spammer email address FORGED_HOTMAIL_RCVD (1.1 points) Forged hotmail.com 'Received:' header found UPPERCASE_25_50 (1.2 points) message body is 25-50% uppercase > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Evan > Platt > Sent: Tuesday, September 30, 2003 12:05 PM > To: SpamAssassin > Subject: Re: [SAtalk] False Positive: Delivery Status Notification > (Failure) > > > --On Tuesday, September 30, 2003 11:28 AM -0600 Dan Tappin > <[EMAIL PROTECTED]> wrote: > > > I have a bunch of these hotmail failure notices being tagged as SPAM. > > Does any one have a quick fix for this? > > > > I am guessing a rule to give a low score to the <> return path combined > > with a '[EMAIL PROTECTED]' from header. > > > > I am pretty new to SA so any help on creating a rule would be great. I > > searched the archives but I could not find much on this. > > What scores is it hitting, and what version of SpamAssassin? > > Running just the headers through 2.55 (yeah we need to upgrade) scores a > whopping 2.4: > > Return-Path: <> > Received: from mc2-s18.hotmail.com ([65.54.237.67]) by firewall.orourke.ca > (Post.Office MTA v3.5.3 release 720 ID# 1001-62929U100L10S0V35) > with ESMTP id ca for <[EMAIL PROTECTED]>; > Tue, 30 Sep 2003 04:39:14 -0600 > Received: from mc2-f10.hotmail.com ([65.54.237.17]) by mc2-s18.hotmail.com > X-Mail-Format-Warning: Bad RFC2822 header formatting in with Microsoft > SMTPSVC(5.0.2195.5600); > Mon, 29 Sep 2003 16:25:10 -0700 > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Date: Mon, 29 Sep 2003 16:25:06 -0700 > MIME-Version: 1.0 > Content-Type: multipart/report; report-type=delivery-status; > boundary="9B095B5ADSN=_01C3868B939607480000A928mc2?f10.hotmail." > Message-ID: <[EMAIL PROTECTED]> > Subject: Delivery Status Notification (Failure) > Return-Path: <> > X-OriginalArrivalTime: 29 Sep 2003 23:25:10.0143 (UTC) > FILETIME=[ECE060F0: 01C386E0]t > X-Spam-Status: No, hits=2.4 required=5.0 > tests=DATE_IN_PAST_06_12,FAILURE_NOTICE_1,FORGED_HOTMAIL_RCVD, > NO_REAL_NAME > version=2.55 > X-Spam-Level: ** > X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) > > > Evan > > > ------------------------------------------------------- > This sf.net email is sponsored by:ThinkGeek > Welcome to geek heaven. > http://thinkgeek.com/sf > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
