I was shuffling my
SA-Exim
logs, after realizing that I had more than 1G of spam mail saved, I also found the highest scored spam ever: 86.2!
In the meantime, I also found that my anti-spam software has blocked more than 70,000 spams on my server. Go me! :)
Subject: SPAM: 86.2: ºô¸ô¶}©±Àu´f¤è®×¡I ¦n§·m¥ý³ø¡I
X-Spam-Status: Yes, score=86.2 required=7.0 tests=BAYES_99,BIZ_TLD,
DOMAIN_RATIO,FORGED_IMS_HTML,FORGED_MUA_IMS,FORGED_YAHOO_RCVD,
HEAD_ILLEGAL_CHARS,HELO_DYNAMIC_DHCP,HELO_DYNAMIC_IPADDR,HTML_90_100,
HTML_CHARSET_FARAWAY,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_WEB_BUGS,
HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,MIME_BASE64_TEXT,
MIME_BOUND_DD_DIGITS,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
MISSING_MIMEOLE,MPART_ALT_DIFF,MSGID_SPAM_CAPS,MSGID_YAHOO_CAPS,
RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_BY_IP,RCVD_DOUBLE_IP_SPAM,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_IN_NJABL_DUL,
RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RCVD_IN_XBL,SPF_HELO_SOFTFAIL,
SUBJ_ILLEGAL_CHARS,TO_MARCNEWS autolearn=spam
version=3.0.3-mmrules_20041125
X-Spam-Report:
* 3.8 MSGID_YAHOO_CAPS Message-ID has ALLCAPS@yahoo.com
* 1.2 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
* 4.1 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
* 4.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
* 4.0 TO_MARCNEWS To marc_news
* 3.8 MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant)
* 0.1 RCVD_BY_IP Received by mail server with no name
* 2.9 SUBJ_ILLEGAL_CHARS Subject contains too many raw illegal characters
* 3.1 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
* [SPF failed: Please see
http://spf.pobox.com/why.html?sender=rr.com
&ip;
=24.95.54.50
&receiver;
=magic.merlins.org]
* 2.1 HEAD_ILLEGAL_CHARS Header contains too many raw illegal characters
* 2.7 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
* 0.5 HTTP_ESCAPED_HOST URI: Uses %-escapes inside a URL's hostname
* 2.3 BIZ_TLD URI: Contains an URL in the BIZ top-level domain
* 0.2 HTTP_EXCESSIVE_ESCAPES URI: Completely unnecessary %-escapes inside a URL
* 3.2 DOMAIN_RATIO BODY: Message body mentions many internet domains
* 0.0 HTML_WEB_BUGS BODY: Image tag intended to identify you
* 1.8 HTML_MESSAGE BODY: HTML included in message
* 0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
* 4.0 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
* [cf: 100]
* 5.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 3.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
* 0.0 HTML_90_100 BODY: Message is 90% to 100% HTML
* 0.3 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
* 7.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* 3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
* [24.95.54.50 listed in sbl-xbl.spamhaus.org]
* 0.0 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
* [24.95.54.50 listed in dnsbl.sorbs.net]
* 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
* [24.95.54.50 listed in dnsbl.sorbs.net]
* 3.0 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
* [http://dsbl.org/listing?24.95.54.50]
* 6.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
* [Blocked - see http://www.spamcop.net/bl.shtml?24.95.54.50]
* 0.1 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
* [24.95.54.50 listed in combined.njabl.org]
* 4.1 RCVD_DOUBLE_IP_SPAM Bulk email fingerprint (double IP) found
* 2.4 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
* 0.0 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
* 2.4 FORGED_MUA_IMS Forged mail pretending to be from IMS
* 2.0 FORGED_IMS_HTML IMS can't send HTML message only
* 0.5 HTML_CHARSET_FARAWAY A foreign language charset used in HTML markup