Typical case is that you were one of the lucky early recipients before the spam
made it into all the blocklists, so it got a low score.
You should have got a pretty hefty score from the local tests, but there is
another 10+ points in net tests there too.
It looks like bayes should have caught it with your 4.0 limit. This makes me
suspect bayes didn't run. Look at the original mail tagging and see, if you
have a setup where you have non-spam tagging. (and if not, fix things so you
do, it makes this easier to debug.)
Loren
----- Original Message -----
From: Craig
To: users@spamassassin.apache.org
Sent: Friday, December 01, 2006 8:47 AM
Subject: How does some spam pass through?
Below are the results from a Spamassassin -D test of a message that was
previously delivered this morning. How does something like this pass through-
when I run the checks on the email after it is delivered the system clearly
knows its spam.
Thanks
Craig
X-Spam-Status: Yes, score=20.3 required=4.0 tests=BAYES_99,BOTNET,
BOTNET_CLIENT,BOTNET_CLIENTWORDS,BOTNET_IPINHOSTNAME,
HTML_IMAGE_ONLY_12,HTML_MESSAGE,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,
RCVD_IN_XBL,SHORT_HELO_AND_INLINE_IMAGE autolearn=spam version=3.1.7
X-Spam-Report:
* 0.0 BOTNET_CLIENTWORDS Hostname contains client-like substrings
* 0.0 BOTNET_IPINHOSTNAME Hostname contains its own IP address
* 1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
* [80.171.36.179 listed in dnsbl.sorbs.net]
* 3.9 RCVD_IN_XBL RBL: Received via a relay in S pamhaus XBL
* [80.171.36.179 listed in sbl-xbl.spamhaus.org]
* 1.9 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
* [80.171.36.179 listed in combined.njabl.org]
* 1.0 SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image
* 0.0 BOTNET_CLIENT Hostname looks like a client hostname
* 5.0 BOTNET Any Botnet rule hit
