I just want to mention that since using SA 3 my average spam score went up
from 20 to 35 with some spam scoring over 80!
Way cool - well done guys. Check out this one... :)
Content analysis details: (87.6 points, 5.0 required)
pts rule name description
---- ---------------------- ------------------------------------------------
--
4.1 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
3.8 MSGID_YAHOO_CAPS Message-ID has [EMAIL PROTECTED]
1.3 SUBJECT_DRUG_GAP_C Subject contains a gappy version of 'cialis'
3.8 MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant)
0.1 RCVD_BY_IP Received by mail server with no name
2.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
1.2 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
2.7 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received'
headers
1.8 LOCAL_OBFU_ONLY_XNX BODY: Obfuscated 'xanax' in body
1.8 LOCAL_OBFU_ONLY_VGR BODY: Obfuscated 'viagra' in body
1.8 LOCAL_OBFU_ONLY_CLS BODY: Obfuscated 'cialis' in body
1.8 LOCAL_OBFU_ONLY_VLM BODY: Obfuscated 'valium' in body
4.0 BIZ_TLD URI: Contains an URL in the BIZ top-level domain
0.0 HTML_40_50 BODY: Message is 40% to 50% HTML
2.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
3.4 HTML_OBFUSCATE_30_40 BODY: Message is 30% to 40% HTML obfuscation
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_BADTAG_40_50 BODY: HTML message is 40% to 50% bad tags
0.1 HTML_BACKHAIR_4 BODY: HTML tags used to obfuscate words
0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.2 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.6 SARE_HTML_BAD_FG_CLR RAW: Uses illegal color code
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?219.254.72.131>]
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[219.254.72.131 listed in sbl-xbl.spamhaus.org]
1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: sdf21.biz]
0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: sdf21.biz]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: sdf21.biz]
3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: sdf21.biz]
4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: sdf21.biz]
2.0 SARE_RAND_1 SARE_RAND_1
0.1 DRUGS_ANXIETY Refers to an anxiety control drug
0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
3.1 PERCENT_RANDOM PERCENT_RANDOM
2.7 DRUGS_DIET_OBFU Obfuscated reference to a diet drug
2.2 SARE_HTML_INV_TAG Message contains invalid HTML tag
1.5 SARE_RAND_1F SARE_RAND_1F
2.3 LONGWORDS Long string of long words
0.9 DRUGS_ERECTILE_OBFU Obfuscated reference to an erectile drug
3.5 DRUGS_ANXIETY_OBFU Obfuscated reference to an anxiety control drug
0.2 DRUGS_ERECTILE Refers to an erectile drug
4.1 RCVD_DOUBLE_IP_SPAM Bulk email fingerprint (double IP) found
0.6 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
1.5 SARE_HTML_COLOR_NWHT HTML contains nearly white color (F.F.F.)
2.4 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
0.0 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
0.0 DRUGS_DIET Refers to a diet drug
2.0 SARE_RAND_8 SARE_RAND_8
0.0 DRUGS_ANXIETY_EREC Refers to both an erectile and an anxiety drug
3.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
