spam mail not being tagged as spam

[Julian Field]

Remember that MailScanner uses the envelope addresses in your maillog, and
not whatever happens to be in the headers.

At 19:20 28/03/2003, you wrote:
>Julian,
>
>  I felt that was the case but I checked
> /etc/MailScanner/rules/spam.whitelist.rules first and it does not have
> anything with yahoo.com, 'dommknotsvnub at yahoo.com', entered.  Could I be
> looking at the wrong whitelist file?
>
>  I just received the following spam with the same whitelist message and
> again I have nothing pointing to hotmail.com
>
>Lou.
>
>
>email header info:
>===================================================================================
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
>         boundary="3E..8F1_.B19_.0CCA"
>X-MailScanner: Found to be clean
>X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=13.2,
>         required 5, DATE_IN_FUTURE_03_06, FORGED_HOTMAIL_RCVD,
>         HTML_FONT_COLOR_BLUE, HTML_FONT_COLOR_RED, HTML_FONT_COLOR_UNSAFE,
>         HTML_FONT_COLOR_YELLOW, MAY_BE_FORGED, MIME_HTML_NO_CHARSET,
>         MIME_LONG_LINE_QP, MISSING_MIMEOLE, RCVD_IN_DSBL,
>         RCVD_IN_OSIRUSOFT_COM, SPAM_PHRASE_03_05, USER_AGENT_OE,
>         X_OSIRU_SPAM_SRC)
>Return-Path: SelanoX16R at hotmail.com
>X-OriginalArrivalTime: 28 Mar 2003 18:51:00.0349 (UTC)
>FILETIME=[F99D42D0:01C2F55A]
>
>--3E..8F1_.B19_.0CCA
>Content-Type: text/html
>Content-Transfer-Encoding: quoted-printable
>
>
>--3E..8F1_.B19_.0CCA--
>
>-----Original Message-----
>From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK]
>Sent: Friday, March 28, 2003 2:11 PM
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: spam mail not being tagged as spam
>
>
>Exactly as it says, it is in your MailScanner spam whitelist.
>
>At 19:00 28/03/2003, you wrote:
> >Hello,
> >
> >  After enabling the 'SpamAssassin Report' I now have the following
> > information. Can someone explain how SpamAssassin scores a 20 but
> > MailScanner states 'not spam'??
> >
> >Lou.
> >
> >mail header info:
> >=========================================================================
> ===============
> >Subject: {^} Teen Celebs - Totally Scandalous!
> >{^}                                5523-4
> >Date: Fri, 28 Mar 2003 09:33:38 +0900
> >MIME-Version: 1.0
> >Content-Type: multipart/mixed;
> >         boundary="----=_NextPart_000_00E5_68C85A6A.D2272A27"
> >X-Priority: 3
> >X-Mailer: AOL 7.0 for Windows US sub 118
> >Importance: Normal
> >X-MailScanner: Found to be clean
> >X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=20,
> >         required 5, BASE64_ENC_TEXT, BIG_FONT, FORGED_YAHOO_RCVD,
> HTML_50_70,
> >         HTML_WITH_BGCOLOR, MIME_MISSING_BOUNDARY, NASTY_GIRLS,
> NO_REAL_NAME,
> >         PORN_4, RCVD_FAKE_HELO_DOTCOM, RCVD_IN_DSBL, SPAM_PHRASE_00_01,
> >         SUBJ_HAS_SPACES, SUBJ_HAS_UNIQ_ID, TRACKER_ID, USER_AGENT_AOL)
> >Return-Path: dommknotsvnub at yahoo.com
> >X-OriginalArrivalTime: 28 Mar 2003 18:29:20.0112 (UTC)
> >FILETIME=[F29CD700:01C2F557]
> >
> >------=_NextPart_000_00E5_68C85A6A.D2272A27
> >Content-Type: text/html;
> >         charset="iso-8859-1"
> >Content-Transfer-Encoding: base6
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support