High Score

[dhanna]

Never seen one above 12 or so, so when I got one with a score of 50.6, I was a little surprised.

X-Priority: 3

X-MSMail-Priority: Normal

X-spam-Flag: YES

X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade6

X-spam-Level: **************************************************

X-spam-Status: hits=50.6 tests=CLICK_BELOW,DATE_IN_PAST_03_06,

DATE_SPAMWARE_Y2K,FORGED_IMS_HTML,FORGED_MUA_IMS,GENERIC_VIAGRA,

HTML_60_70,HTML_FONTCOLOR_BLUE,HTML_FONTCOLOR_RED,HTML_FONT_BIG,

HTML_FONT_INVISIBLE,HTML_LINK_CLICK_HERE,HTML_MESSAGE,IMPOTENCE,

J_BACKHAIR_14,J_BACKHAIR_22,J_BACKHAIR_23,J_BACKHAIR_24,J_BACKHAIR_25,

J_BACKHAIR_26,J_BACKHAIR_32,J_BACKHAIR_33,J_BACKHAIR_34,J_BACKHAIR_35,

J_BACKHAIR_44,J_BACKHAIR_45,J_BACKHAIR_46,J_BACKHAIR_55,J_BACKHAIR_56,

J_CHICKENPOX_23,LINES_OF_YELLING,LOCAL_DRUGS_ANXIETY,

LOCAL_DRUGS_ANXIETY_MALEDYS,LOCAL_DRUGS_DEPRESSION,

LOCAL_DRUGS_DEPRESSION_MALEDYS,LOCAL_DRUGS_DIET,

LOCAL_DRUGS_DIET_MALEDYS,LOCAL_DRUGS_MALEDYSFUNCTION,

LOCAL_DRUGS_MANYKINDS,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,

MISSING_MIMEOLE,MISSING_OUTLOOK_NAME,OFFERS_ETC,SORTED_RECIPS,

SUSPICIOUS_RECIPS version=2.63

X-spam-Report:

* 4.4 DATE_SPAMWARE_Y2K Date header uses unusual Y2K formatting

* 4.3 GENERIC_VIAGRA BODY: Mentions Generic Viagra

* 0.2 OFFERS_ETC BODY: Stop the offers, coupons, discounts etc!

* 4.2 IMPOTENCE BODY: Impotence cure

* 0.6 J_CHICKENPOX_23 BODY: {2}Letter - punctuation - {3}Letter

* 0.1 HTML_LINK_CLICK_HERE BODY: HTML link text says "click here"

* 0.1 HTML_60_70 BODY: Message is 60% to 70% HTML

* 0.1 HTML_FONTCOLOR_BLUE BODY: HTML font color is blue

* 0.0 HTML_MESSAGE BODY: HTML included in message

* 0.1 HTML_FONT_BIG BODY: HTML has a big font

* 0.0 LINES_OF_YELLING BODY: A WHOLE LINE OF YELLING DETECTED

* 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

* 0.4 HTML_FONT_INVISIBLE BODY: HTML font color is same as background

* 0.1 HTML_FONTCOLOR_RED BODY: HTML font color is red

* 1.0 J_BACKHAIR_56 BODY: 5 letters - Unsightly html tag - 6 letters

* 1.0 J_BACKHAIR_44 BODY: 4 letters - Unsightly html tag - 4 letters

* 1.0 J_BACKHAIR_33 BODY: 3 letters - Unsightly html tag - 3 letters

* 1.0 J_BACKHAIR_32 BODY: 3 letters - Unsightly html tag - 2 letters

* 1.0 J_BACKHAIR_55 BODY: 5 letters - Unsightly html tag - 5 letters

* 1.0 J_BACKHAIR_35 BODY: 3 letters - Unsightly html tag - 5 letters

* 1.0 J_BACKHAIR_34 BODY: 3 letters - Unsightly html tag - 4 letters

* 1.0 J_BACKHAIR_26 BODY: 2 letters - Unsightly html tag - 6 letters

* 1.0 J_BACKHAIR_22 BODY: 2 letters - Unsightly html tag - 2 letters

* 1.0 J_BACKHAIR_45 BODY: 4 letters - Unsightly html tag - 5 letters

* 1.0 J_BACKHAIR_25 BODY: 2 letters - Unsightly html tag - 5 letters

* 1.0 J_BACKHAIR_23 BODY: 2 letters - Unsightly html tag - 3 letters

* 1.0 J_BACKHAIR_14 BODY: 1 letters - Unsightly html tag - 4 letters

* 1.0 J_BACKHAIR_46 BODY: 4 letters - Unsightly html tag - 6 letters

* 1.0 J_BACKHAIR_24 BODY: 2 letters - Unsightly html tag - 4 letters

* 0.7 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

* 3.0 SUSPICIOUS_RECIPS Similar addresses in recipient list

* 4.3 SORTED_RECIPS Recipient list is sorted by address

* 0.0 LOCAL_DRUGS_DIET LOCAL_DRUGS_DIET

* 0.0 CLICK_BELOW Asks you to click below

* 0.0 LOCAL_DRUGS_ANXIETY LOCAL_DRUGS_ANXIETY

* 1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

* 0.0 LOCAL_DRUGS_DEPRESSION LOCAL_DRUGS_DEPRESSION

* 1.2 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

* 1.1 FORGED_MUA_IMS Forged mail pretending to be from IMS

* 4.3 FORGED_IMS_HTML IMS can't send HTML message only

* 1.0 LOCAL_DRUGS_MALEDYSFUNCTION LOCAL_DRUGS_MALEDYSFUNCTION

* 0.1 MISSING_OUTLOOK_NAME Message looks like Outlook, but isn't

* 1.0 LOCAL_DRUGS_ANXIETY_MALEDYS LOCAL_DRUGS_ANXIETY_MALEDYS

* 1.0 LOCAL_DRUGS_DIET_MALEDYS LOCAL_DRUGS_DIET_MALEDYS

* 1.0 LOCAL_DRUGS_DEPRESSION_MALEDYS LOCAL_DRUGS_DEPRESSION_MALEDYS

* 1.0 LOCAL_DRUGS_MANYKINDS LOCAL_DRUGS_MANYKINDS

X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 68.6.19.2 24.43.22.215

X-SpamCop-Disposition: Blocked bl.spamcop.net

[WB8TYW]

It would seem that allowing something to reach a score higher than the acceptable threshold would be very innefficient, and should only show up in a debug mode.

I would want a spam filter to use simplest checks most likely to determine ham/spam first and only go for the more expensive and more risky checks if needed.

And once I have confirmed that it is spam, stop doing the checks.

-John

Personal Opinion Only.

[EOC_Jason]

I think I had one hit 80+ before... lol... but it was before I set spam assassin to delete spam.

The reason it does all the checks is because high scoring spam can be run through the bays engine if you have the self-learning flag turned on.