One of my users received a message today that landed in the spambucket. Upon
further review, it's a legit message from Paypal. In fact, SA even
recognized that it appeared to be a legit Paypal message, but since the
adjustment was a whopping -0.0 points, it wasn't enough to bring it back
below 5.0. Why doesn't this rule carry any negative weight, and what else
could I be doing that would avoid this sort of FP?
(In other news, I have NO idea why the SARE_SXLIFE rule was triggered. I
mean, I enjoy shopping on Ebay as much as the next geek, but it's not THAT
exciting!)
Full headers:
===
Return-Path: <[EMAIL PROTECTED]>
X-VirusScan-2: SUBMITTED
X-Find-Attachment: Scanned
X-ExtScanner: Niversoft's Find_Attachments
X-AMS-SpamSorted:Yes
Received: by mail.alfordmedia.com (CommuniGate Pro PIPE 4.2.10)
with PIPE id 4432221; Tue, 28 Feb 2006 17:38:46 -0600
X-Spam-Report:
* 0.8 SARE_SXLIFE BODY: Talks about your sex life
* 1.2 SARE_LWACT_QUICKLY BODY: Spammer thinks you should hurry.
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.5000]
* 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 2.6 HTML_EHTML2 RAW: HTML has doubled end HTML tag
* 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* -0.0 SARE_LEGIT_PAYPAL Has signs it's from paypal, from, headers, uri
X-Spam-Level: +++++
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on
mail.alfordmedia.com
X-Spam-Status: Yes, score=5.2 required=5.0 tests=BAYES_50,HTML_EHTML2,
HTML_MESSAGE,MIME_HTML_ONLY,RAZOR2_CHECK,SARE_LEGIT_PAYPAL,
SARE_LWACT_QUICKLY,SARE_SXLIFE autolearn=no version=3.1.0
X-Spam-Flag: YES
Received: from email-85.paypal.com ([206.165.246.85] verified)
by mail.alfordmedia.com (CommuniGate Pro SMTP 4.2.10)
with ESMTP id 4432215 for [EMAIL PROTECTED]; Tue, 28 Feb 2006
17:38:32 -0600
Received-SPF: pass
receiver=mail.alfordmedia.com; client-ip=206.165.246.85;
[EMAIL PROTECTED]
DomainKey-Signature: a=rsa-sha1;
h=Date:From:Subject:To:X-Header-CompanyDBUserName:Errors-To:List-Unsubscribe
:Reply-To:X-Header-MasterId:X-Header-Versions:Message-ID:MIME-Version:Conten
t-Type;
b=bl0/dtor/Y3+VNPdJelqkharT8AFtc9BdV/zNC337lZhLRMaI3DilevSd1d5T60za9H5IehGx3
MB08T9gkQTj+Ze+sd4CSGQu71+nFQM0BmlAc9mWeGDKCDLBVhPLj4t; c=nofws;
d=email.paypal.com; q=dns; s=yesmail1
Date: Tue, 28 Feb 2006 15:38:08 PST
From: PayPal <[EMAIL PROTECTED]>
Subject: Protect Yourself from Fake Emails
To: "Thomas Watkins" <[EMAIL PROTECTED]>
X-Header-CompanyDBUserName: paypal
Errors-To: [EMAIL PROTECTED]
List-Unsubscribe:
<mailto:[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
X-Header-MasterId: 903934
X-Header-Versions: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
X-TFF-CGPSA-Version: 1.4
X-AMS-CGPSA-Filter: Scanned
--
Dave Pooser
Cat-Herder-in-Chief, Pooserville.com
"...Life is not a journey to the grave with the intention of arriving
safely in one pretty and well-preserved piece, but to slide across the
finish line broadside, thoroughly used up, worn out, leaking oil, and
shouting GERONIMO!!!" -- Bill McKenna
