On Sun, 2011-08-14 at 22:17 +0100, Ned Slider wrote:
> Hi all,
>
> The following email hits __HAS_ANY_URI and I'm not sure why:
>
> http://pastebin.com/jvFrFhA4
>
> When I run the message through SpamAssassin in debug mode I see:
>
> dbg: rules: __DOS_HAS_ANY_URI merged duplicates: __HAS_ANY_URI
> dbg: rules: ran uri rule __DOS_HAS_ANY_URI ======> got hit: "r"
>
> SpamAssassin version 3.3.2
>
I'm also running SA 3.3.2 and had a rules update yesterday. I see this:
Content analysis details: (5.1 points, 6.0 required)
pts rule name description
---- ---------------------- --------------------------------------------
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provide (flimson26[at]gmail.com)
0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is
CUSTOM_MED
1.0 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
(ram121153[at]live.com)
0.1 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
digit (flimson26[at]gmail.com)
2.8 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing
list
0.0 TO_NO_BRKTS_PCNT To: misformatted + percentage
0.0 T_TO_NO_BRKTS_FREEMAIL To: misformatted and free email service
> Any clues? I'm guessing it has something to do with the email address in
> the message body?
>
That's my guess - freemail URIs in boith body and headers: the body has
references to live.com and the sender is using gmail.com, so I'm
unsurprised about it getting those hits.
The only one that surprises me is NML_ADSP_CUSTOM_MED - whats that all
about, then?
Martin
