I've got a user on my system whose spam doesn't seem to be marked
correctly. It comes in marked as [SPAM] in the subject, but the
X-Spam-Status header seems to be incorrect. (SA works properly for
all other users on my system, so i'm not sure what the problem is)
Example below: the X-Spam-Status is "No, hits=3.2 required=6.0" but
when SpamAssassin marks up the email, it clearly scores it a 9.1.
anyone have any ideas?
Subject: [SPAM] Plan for your kids benefit
Date: Thu, 20 Nov 2003 16:31:38 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------=_3FBD5DE1.48A6D1AE"
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
grommit.grommit.com
X-Spam-Level: ***
X-Spam-Status: No, hits=3.2 required=6.0
tests=FROM_HAS_MIXED_NUMS,HTML_50_60,
HTML_FONTCOLOR_BLUE,HTML_MESSAGE,HTML_TAG_EXISTS_TBODY,LOTS_OF_STUFF,
MAILTO_SUBJ_REMOVE,MAILTO_TO_REMOVE,NORMAL_HTTP_TO_IP,US_DOLLARS_3
autolearn=no version=2.60
This is a multi-part message in MIME format.
------------=_3FBD5DE1.48A6D1AE
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "grommit.grommit.com",
has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or
block
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: News Letter
URI:http://26.bluerocketonline.com/m/l?2k3-702s-1-3sbj-p7yt
URI:http://69.6.21.236/arf/media/images/email7_01.gif
URI:http://26.bluerocketonline.com/m/l?2k3-702s-2-3sbj-p7yt
URI:http://69.6.21.236/arf/media/images/email7_02.jpg [...]
Content analysis details: (9.1 points, 6.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.3 FROM_HAS_MIXED_NUMS From: contains numbers mixed in with
letters
0.3 LOTS_OF_STUFF BODY: Thousands or millions of
pics/movies/etc
0.6 US_DOLLARS_3 BODY: Mentions millions of $
($NN,NNN,NNN.NN)
0.1 HTML_FONTCOLOR_BLUE BODY: HTML font color is blue
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 HTML_TAG_EXISTS_TBODY BODY: HTML has "tbody" tag
0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME
parts
1.5 HTML_IMAGE_ONLY_04 BODY: HTML: images with 200-400 bytes of
words
1.3 MAILTO_SUBJ_REMOVE BODY: mailto URI includes removal text
0.2 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in
URL
0.0 MAILTO_TO_REMOVE URI: Includes a 'remove' email address
2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?69.6.16.126>]
1.3 RCVD_IN_SBL RBL: Received via a relay in Spamhaus
Block List
[<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL6636>]
--
stephen lau | [EMAIL PROTECTED] | www.whacked.net | gpg 0x09E5CD21
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
