http://bugzilla.spamassassin.org/show_bug.cgi?id=2934
------- Additional Comments From [EMAIL PROTECTED] 2004-01-16 13:37 ------- The message is encoded with base64, decoded it is: <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=big5"> <meta name="GENERATOR" content="Microsoft FrontPage 4.0"> <meta name="ProgId" content="FrontPage.Editor.Document"> <title>�s����1</title> </head> <body> <p><img border="0" src="cid:email13��.jpg"; width="566" height="800"></p> </body> </html> There is nothing to scan in this text, the payload is the attached JPG file. SA does not do image recognition so there isn't much left to scan. When I process this message using spamassassin -t<msg.txt I get the following: Content analysis details: (23.7 points, 6.6 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.3 NO_REAL_NAME From: does not include a real name 1.2 RATWARE_HASH_2 Bulk email fingerprint (hash 2) found 1.4 RCVD_FAKE_HELO_DOTCOM Received contains a faked HELO hostname 2.4 RATWARE_HASH_2_V2 Bulk email fingerprint (hash 2 v2) found 0.1 HTML_60_70 BODY: Message is 60% to 70% HTML 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 HTML_MESSAGE BODY: HTML included in message 2.2 HTML_IMAGE_ONLY_02 BODY: HTML: images with 0-200 bytes of words 1.6 FRONTPAGE BODY: Frontpage used to create the message 1.1 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding 4.3 FROM_ILLEGAL_CHARS From contains too many raw illegal characters 1.5 DNS_FROM_RFCI_DSN RBL: From: sender listed in dsn.rfc-ignorant.org 2.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see <http://www.spamcop.net/bl.shtml?203.99.157.162>] 0.2 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary 1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts 1.2 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE 0.1 MISSING_OUTLOOK_NAME Message looks like Outlook, but isn't 1.3 FVGT_combo_IMAGEONLY1 Image only type spam? 0.1 FVGT_m_HIBIT_CHRS_05 Contains 5 sequential non-alpha-numeric characters 0.0 FVGT_TRIPLE_EQ FVGT_TRIPLE_EQ 1.1 FVGT_m_MULTI_ODD2 Contains multiple odd letter combinations 0.3 FVGT_m_MULTI_ODD3 Contains multiple odd letter combinations A few of these are my own personal tests but not enough to do anything special. I would assume this message is skipped due to size limitations of spamC. Are you using spamC? This message was 344k and I am fairly sure the cutoff for spamC is 250k. Consider increasing the option for Max Message size. ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.
![cid:email13��.jpg"](cid:email13´Á.jpg"){kind=link}