It found "xon, OX" in "Aylesbury Road, Thame, Oxon, OX9 3AT"
It's an aggressive rule that finds anything that might be an
obfuscated Xanax. It only scores 0.8 points because it can produce FPs
like this.
Actually that is my private, custom score. I think the default is 2.8
or something like that.
*@travelodge.co.uk emails should be scoring much lower in SA around
the Internet running sa-update regularly as long as there is an
SPF_PASS and/or DKIM_VALID_AU hits.
Setup OpenDKIM and DKIM signing on those outbound emails for even
better delivery results. This applies to any domain.
I highly recommend setting up DMARC reporting to everyone out there to
get feedback on your SPF and DKIM results. It can be very interesting
to see who is trying to spoof your domain and who is auto-forwarding
your emails.
I stay at Travelodge regularly, it doesn't hit their marketing emails,
but Booking Confirmations and Invoices, come out with the following for me:
X-Spam-Status: No, score=1.3 required=5.0 tests=AWL,BAYES_00,FUZZY_XPILL,
HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,MIME_HTML_ONLY,T_FILL_THIS_FORM_SHORT,
T_RP_MATCHES_RCVD autolearn=no autolearn_force=no version=3.4.1
X-Spam-Report:
* -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
* domain
* 2.8 FUZZY_XPILL BODY: Attempt to obfuscate words in spam
* 0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to
* background
* 0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
* [score: 0.0000]
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
* information
* -0.3 AWL AWL: Adjusted score from AWL reputation of From: address
It is still a bit way off before it could be considered SPAM.
