Quoting LuKreme <krem...@kreme.com>:
Scores 1.0 for me
<http://home.kreme.com/spam20090521.txt>
X-Spam-Report:
* 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
* [93.86.56.82 listed in dnsbl.sorbs.net]
* -0.0 SPF_PASS SPF: sender matches SPF record
* -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
white-list
* -1.3 DKIM_VERIFIED Domain Keys Identified Mail: signature passes
* verification
* -1.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4986]
* 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
* 2.2 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
* 2.0 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
* 1.7 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe
* naught else
* 0.0 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
* -0.7 ENV_AND_HDR_DKIM_MATCH Env and Hdr From used in default DKIM WL
* Match
total of -6.3 if ham scores, sigh.
Gotten multiples of this spam on multiple accounts, include one that
ONLY gets spam.
Stock SA v3.2.5, no additional rules:
X-Spam-Status: Reqd:5.0 Hits:7.7 Learn:disabled
Tests:HTML_IMAGE_ONLY_04=1.462,
HTML_MESSAGE=0.001,HTML_SHORT_LINK_IMG_1=1.078,MPART_ALT_DIFF=1.143,
RCVD_IN_SORBS_WEB=1.117,SPF_PASS=-0.001,TVD_SPACE_RATIO=2.899
