Friday, April 4, 2008

SpamAssassin's multiple personality disorder

SpamAssassin has become a bit overly aggressive in its filtering as of late. A few of my friends' e-mails are getting sucked up in there, so I've had to monitor it a bit more closely.

Today, however, I found this gem in there. Clearly, it was conflicted as to whether the e-mail was spam or not, though ultimately it decided it was (and was correct in this determination). What amazes me is that, even with 12.3 positive points subtracted, this e-mail still scores as spam.
Content analysis details:   (8.6 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.0 NO_REAL_NAME From: does not include a real name
0.1 FORGED_RCVD_HELO Received: contains a forged HELO
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
-4.3 RCVD_IN_BSP_TRUSTED RBL: Sender is in Bonded Sender Program (trusted
relay)
[Return Path SenderScore Certified (formerly]
[Bonded Sender) - ]
1.6 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: selleis.com]
3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: selleis.com]
4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: selleis.com]
2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: selleis.com]
3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: selleis.com]
4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: selleis.com]
0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
-8.0 AWL AWL: From: address is in the auto white-list

No comments: