Daryl C. W. O'Shea wrote:
Can someone forward me a copy of the spam in question as an attachment?
Nevermind, I just found one. 16.4 on this particular one. My bayes rules are scored a little higher than default and I've got a few additional rules though:
* 0.0 DK_POLICY_SIGNSOME Domain Keys: policy says domain signs some * 1.0 WEB_301 Contains a web link that returns 301 * [URIs: http://geocities.yahoo.com.br/dalyfy59122/] * 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: * 0.5 GEOCITIES URI: A uri contained the token 'geocities' * 4.1 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 2.6 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org * [<http://dsbl.org/listing?218.238.201.49>] * 0.7 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy * [218.238.201.49 listed in combined.njabl.org] * 3.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL * [218.238.201.49 listed in zen.spamhaus.org] * 0.7 SARE_SPEC_XXGEOCITIE5 spamsign pointing to free webhost spam site * 0.0 SIQ_OI_IP_UNKNOWN Query returned IP reputation unknown * [SIQ: score: -1 queried: bolt.com/218.238.201.49] * 0.0 SIQ_OI_DOM_UNKNOWN Query returned domain reputation unknown * [SIQ: score: -1 queried: bolt.com/218.238.201.49] * 0.0 SIQ_OI_REL_UNKNOWN Query returned relative reputation unknown * [SIQ: score: -1 queried: bolt.com/218.238.201.49] * 1.5 SIQ_OI_00 Outbound Index Reputation: http://outboundindex.org/ * [SIQ: score: 0 queried: bolt.com/218.238.201.49]
