On Mon, 20 Feb 2017 17:40:15 +0000 David Jones wrote: > >From: David Niklas <do...@mail.com>
> > >Feb 18 04:24:46 [spamd] spamd: connection from ulgy_thing > >[127.0.0.1]:38282 to port 783, fd 5_ Feb 18 04:24:46 [spamd] spamd: > >setuid to me succeeded_ Feb 18 04:24:46 [spamd] spamd: checking > >message <201702181220.d3d7dc515...@account.t-firefly.com> for > >me:1000_ Feb 18 04:24:53 [spamd] spamd: identified spam (6.9/5.0) > >for me:1000 in 6.7 seconds, 4240 bytes._ Feb 18 04:24:53 [spamd] > >spamd: result: Y 6 - > >AWL,BAYES_00,CHARSET_FARAWAY_HEADER,FROM_EXCESS_BASE64, > >HTML_MESSAGE,MIME_CHARSET_FARAWAY,MIME_HTML_ONLY, > >RCVD_IN_MSPIKE_H2,RDNS_NONE,URIBL_BLOCKED > >scantime=6.7,size=4240,user=me,uid=1000,required_score=5.0, > >rhost=ulgy_thing,raddr=127.0.0.1,rport=38282,mid=<201702181220.d3d7dc515474@ac > >count.t-firefly.com>,bayes=0.000000,autolearn=no > >autolearn_force=no_ > > URIBL_BLOCKED is the problem. URIBL_BLOCKED is *a* problem that may cause FNs, but it didn't cause this FP. It's mostly English, but it's written in the GBK character set and it seems to have been excessively punished for that. It's strange because GBK encodes characters 0-127 as ASCII, like in UTF8. You might want to whitelist this site in some way.
