Hi folks, I got two spams through today and I'm a little confused as to why.
Spam 1:
From [EMAIL PROTECTED] Sat Apr 22 01:28:34 2006
Return-Path: <[EMAIL PROTECTED]>
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on quadzilla
X-Spam-Level: **
X-Spam-Status: No, score=2.0 required=5.0 tests=BAYES_80 autolearn=no
version=3.1.1
Received: from fen.com ([221.155.184.221])
by quadzilla.doki-doki.net (8.13.1/8.13.1) with SMTP id
k3M5SUHj028409
for <[EMAIL PROTECTED]>; Sat, 22 Apr 2006 01:28:32 -0400
Message-ID: <[EMAIL PROTECTED]>
Date: Fri, 21 Apr 2006 23:11:16 -0700
From: "Lyle Grisham" <[EMAIL PROTECTED]>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4)
Gecko/20030624 Sylera/1.2.4
MIME-Version: 1.0
To: <[EMAIL PROTECTED]>
Subject: FWD: Cathy Caparula, Ref # QG3836-I34V
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV version 0.88, clamav-milter version 0.87 on
localhost
X-Virus-Status: Clean
Status: R
Content-Length: 215
X-Keywords:
ATTN: Cathy Caparula,
After a lookover of all your infomation, I'm delighted to inform you of
your acceptance.
http://5ag420.iscool.net
Just fill-out your details on our web site above.
God Bless,
Lyle Grisham
Now, I run it through sa manually, and the report looks like:
Content analysis details: (10.0 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
4.0 CATHY_CAPARULA BODY: Email addressed to Cathy Caparula
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?221.155.184.221>]
3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[221.155.184.221 listed in
sbl-xbl.spamhaus.org]
-2.9 AWL AWL: From: address is in the auto white-list
The second spam is almost identical to the first.
I guess the question is: why such radically different scores? is the
auto-scanning not using my custom CATHY_CAPARULA rule?
