I just noticed some really inconsistant mailscanner/spamassassin results and thought it was pretty interesting. I wonder if anyone else has seen things like this? I am using chirpy's mailscanner/spamassassin solution.
I received two identical pieces of spam at about the same time, to two different clients. There is no doubt it is spam.
For one piece, here are the scanning results,
----------------------------------------------
SpamAssassin Score: 1.00
Score Matching Rule Description
cached not
score=1.006
6 required
0.00 BAYES_50 Bayesian spam probability is 40 to 60%
0.91 RCVD_IN_PBL Received via a relay in Spamhaus PBL
0.10 RDNS_NONE Delivered to trusted network by a host with no rDNS
Here is the other
--------------------
SpamAssassin Score: 12.46
Score Matching Rule Description
cached not
score=12.466
5 required
2.00 BAYES_80 Bayesian spam probability is 80 to 95%
0.99 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
0.00 FH_HELO_EQ_D_D_D_D Helo is d-d-d-d
4.39 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
0.88 RCVD_IN_SORBS_DUL SORBS: sent directly from dynamic IP address
0.10 RDNS_DYNAMIC Delivered to trusted network by host with dynamic-looking rDNS
1.93 TVD_RCVD_IP
I received two identical pieces of spam at about the same time, to two different clients. There is no doubt it is spam.
For one piece, here are the scanning results,
----------------------------------------------
SpamAssassin Score: 1.00
Score Matching Rule Description
cached not
score=1.006
6 required
0.00 BAYES_50 Bayesian spam probability is 40 to 60%
0.91 RCVD_IN_PBL Received via a relay in Spamhaus PBL
0.10 RDNS_NONE Delivered to trusted network by a host with no rDNS
Here is the other
--------------------
SpamAssassin Score: 12.46
Score Matching Rule Description
cached not
score=12.466
5 required
2.00 BAYES_80 Bayesian spam probability is 80 to 95%
0.99 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
0.00 FH_HELO_EQ_D_D_D_D Helo is d-d-d-d
4.39 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
0.88 RCVD_IN_SORBS_DUL SORBS: sent directly from dynamic IP address
0.10 RDNS_DYNAMIC Delivered to trusted network by host with dynamic-looking rDNS
1.93 TVD_RCVD_IP
