> If you can post the full email (headers and body), I'll run it over my > system which has lots and lots of third party add on rules from > www.rulesemporium.com and others and see if I can make SA > score it high > enough for Amavisd-new to block the email..
Thanks. http://www.rocsca.it/INBOX I get the following score: >From [EMAIL PROTECTED] Wed Mar 14 07:13:02 2007 Return-Path: <[EMAIL PROTECTED]> X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on av6.stt.vir X-Spam-Level: ** X-Spam-Status: No, score=2.5 required=5.0 tests=AWL,BAYES_50,HTML_30_40, HTML_MESSAGE,HTML_TEXT_AFTER_BODY,MIME_HTML_ONLY,SARE_PROLOSTOCK_SYM3 autolearn=no version=3.1.8 X-Original-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: by posta.sttspa.it (Postfix, from userid 7011) id 8F9A51098056; Wed, 14 Mar 2007 07:14:06 +0100 (CET) Received: from av6.stt.vir (smtp02.sttspa.it [80.74.176.141]) by posta.sttspa.it (Postfix) with ESMTP id 6858B1098004; Wed, 14 Mar 2007 07:14:06 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by av6.stt.vir (Postfix) with ESMTP id 7777F7500A7; Wed, 14 Mar 2007 07:14:06 +0100 (CET) X-Virus-Scanned: amavisd-new at stt.vir Received: from av6.stt.vir ([127.0.0.1]) by localhost (av6.stt.vir [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I3LCVzlxLfiv; Wed, 14 Mar 2007 07:14:03 +0100 (CET) Received: from kbra3qsxm9mslhj (203-118-114-113.static.asianet.co.th [203.118.114.113]) by av6.stt.vir (Postfix) with SMTP id 362367500A2; Wed, 14 Mar 2007 07:13:14 +0100 (CET) Message-ID: <[EMAIL PROTECTED]> Reply-To: "IParker NDickey" <[EMAIL PROTECTED]> From: "IParker NDickey" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]> Subject: transmitting wolf Date: Wed, 14 Mar 2007 13:13:02 +0700 MIME-Version: 1.0 Content-Type: text/html <html> <head> </head> <body> <p align="center"><b>Our Next Winner for<font color="#FF0000"> March 14th</font><br> <font color="#FF0000">CEO AMERICA INC </font><br> Tick : CEOA<br> <font color="#008080">Priced : $0.07</font><br> Won't last long at this stage, This one is going to<font color="#008080"> $1.00</font><br> Grab yourself some<font color="#0000FF"> tomorrow </font>avoid the rush<br> And experience a <font color="#008080">10 bagger.</font></p> <p align="center"><br> <font size="2">FAA said the rule change -- a temporary one -- was made for safety reasons. The NTSB's<br> of starting that fire with murder. A light wind was cited by federal investigators = San Benardino National Forest to its very core and shocked the entire world."<br> October 26 in Southern California's San Jacinto Mountains.=ttempted a U-turn with only 1,300 feet of room for the turn. To make a successful turn, </font></b></p> </body> </html> ) Spam detection software, running on the system "av6.stt.vir", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Our Next Winner for March 14th CEO AMERICA INC Tick : CEOA Priced : $0.07 Won't last long at this stage, This one is going to $1.00 Grab yourself some tomorrow avoid the rush And experience a 10 bagger. [...] Content analysis details: (2.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.7 SARE_PROLOSTOCK_SYM3 BODY: Last week's hot stock scam 0.1 HTML_TEXT_AFTER_BODY BODY: HTML contains text after BODY close tag 0.4 HTML_30_40 BODY: Message is 30% to 40% HTML 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.5547] 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.3 AWL AWL: From: address is in the auto white-list
