I'm getting many spams in the last few days, with spam scores far above my
4.0 threshold, which are still being delivered. Wondering if it's to do with
the fact that they all seem to have no sender.
I've included the source of a recent one:
********** SOURCE STARTS HERE ************
Return-path: <>
Envelope-to: myu...@mydomain.co.uk
Delivery-date: Wed, 11 May 2011 10:25:05 +0800
Received: from mail by s1.snowweb.info with spam-scanned (Exim 4.67)
id 1QJz6l-0005lL-EX
for myu...@mydomain.co.uk; Wed, 11 May 2011 10:25:04 +0800
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on s1.snowweb.info
X-Spam-Flag: YES
X-Spam-Level: ******************
X-Spam-ASN: AS24560 122.161.32.0/20
X-Spam-Status: Yes, score=18.4 required=4.0 tests=BAYES_99,EMPTY_MESSAGE,
FH_FROMEML_NOTLD,FORGED_OUTLOOK_TAGS,FROM_NO_USER,FSL_HELO_NON_FQDN_1,
HELO_NO_DOMAIN,RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RCVD_IN_RP_RNBL,
RCVD_IN_SORBS_DUL,RCVD_IN_XBL,RDNS_NONE shortcircuit=no autolearn=no
version=3.3.1
X-Spam-Relay-Country: IN
X-Spam-Report:
* 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
* [score: 1.0000]
* 1.5 FSL_HELO_NON_FQDN_1 FSL_HELO_NON_FQDN_1
* 1.1 FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.)
* 0.8 FROM_NO_USER From: has no local-part before @ sign
* 1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
* [122.161.46.234 listed in bb.barracudacentral.org]
* 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
* https://senderscore.org/blacklistlookup/
* [122.161.46.234 listed in bl.score.senderscore.com]
* 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
* [122.161.46.234 listed in zen.spamhaus.org]
* 0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
* 0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
address
* [122.161.46.234 listed in dnsbl.sorbs.net]
* 0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
* 2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
* Subject: text
* 1.2 RDNS_NONE Delivered to internal network by a host with no
rDNS
* 1.5 HELO_NO_DOMAIN Relay reports its domain incorrectly
Received: from [122.161.46.234] (helo=ghar9abff6bacf)
by s1.snowweb.info with smtp (Exim 4.67)
id 1QJz6k-0005gw-LH
for myu...@mydomain.co.uk; Wed, 11 May 2011 10:25:03 +0800
Received: (qmail 8554 by uid 554); Wed, 11 May 2011 07:58:07 -0530
From: "" <>
To: myu...@mydomain.co.uk
Subject:
Date: Wed, 11 May 2011 07:42:20 -0530
Message-ID: <004201cc0fb1$90daace0$b29006a0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0041_01CC0FB1.90DAACE0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcjoDfb1RXqDPAYPRxyGAGXqi79COA==
Content-Language: en-us
------=_NextPart_000_0041_01CC0FB1.90DAACE0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
------=_NextPart_000_0041_01CC0FB1.90DAACE0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_0041_01CC0FB1.90DAACE0--
************* end of source **********************
By the way, does anyone have the trim email button figured out? I pressed it
and entered the address that I wanted obfuscate, but it didn't seem to
obfuscate anything, so I changed my address in the message source manually
to myu...@mydomain.co.uk.
Thanks for your help in advance.
Peter
--
View this message in context:
http://old.nabble.com/X-Spam-Status%3A-Yes%2C-score%3D18.4---Still-delivered.-tp31591656p31591656.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
