On 28/03/11 23:44, Daniel McDonald wrote:
I just got a spam that scored relatively low (mostly due to DNSWL_MED). But
it also contained an html attachment that would have scored significantly
more had it been part of the main message.
I put it at http://pastebin.com/vXF0vGVS
When I run the complete message, I only get a few hits, mostly relating to
the headers:
X-Spam-Status: Yes, score=5.534 tagged_above=-99 required=4.5
<snip>
NSL_RCVD_FROM_USER=1.226,
Personally I score this rule way up and would have no hesitation with
outright blocking at smtp level - it's as good an indication of spam as
I've ever seen. Scoring at 6pts here and never seen a FP.
