Spamassassin negative score? {Scanned}

[Peter Nitschke]

Was just reading on the SA list that apparently this is a giveaway.

> X-Mailer: mPOP Web-Mail 2.19

So suggested rule to add to SA is:

header    RM_hxm_mPOPwebMail     X-Mailer =~ /mPOP Web-Mail/
score   RM_hxm_mPOPwebMail      5.0

Peter



*********** REPLY SEPARATOR  ***********

On 14/01/2004 at 9:57 AM SW wrote:

>Hi folks,
>
>I'm just trying to figure out how lately lots of spam gets a 'negative'
>score resulting in not being seen as spam? Do I need to make some changes
>in
>Mailscanner.conf to fix this problem or is this a known loophole spammers
>use?
>
>Here is an example of an e-mail w/ a Spamassassin score of -4.7:
>
>Return-Path: <bqwkhmczr at el-nacional.com>
>Received: from dhcp15-67.cable.conwaycorp.net
>(JeW_91122_ at dhcp15-67.cable.conwaycorp.net [24.144.15.67] (may be forged))
> by wppi.com (8.10.2/8.10.2) with SMTP id i0EDvdf00591
> for <ae at wppi.com>; Wed, 14 Jan 2004 08:57:39 -0500
>Received: from [24.144.15.67] by 3001hosting.comIP with HTTP;
> Wed, 14 Jan 2004 14:49:27 +0100
>From: "Chasity" <bqwkhmczr at el-nacional.com>
>To: ae at wppi.com
>Subject: Re: YQBNAMQ, voice resounded over {Scanned}
>Mime-Version: 1.0
>X-Mailer: mPOP Web-Mail 2.19
>X-Originating-IP: [3001hosting.comIP]
>Date: Wed, 14 Jan 2004 14:58:27 +0100
>Reply-To: "Sorensen" <bqwkhmczr at el-nacional.com>
>Content-Type: multipart/alternative;
> boundary="--ALT--VKRT28948427261974"
>Message-Id: <KUHJGFR-0003467606015 at cruelty>
>X-WPPi-MailScanner-Information: Please contact WPPi for more information
>X-WPPi-MailScanner: Found to be clean
>X-WPPi-MailScanner-SpamCheck: not spam, SpamAssassin (score=-4.7, required
>4,
> BAYES_00 -4.90, HTML_MESSAGE 0.10, NORMAL_HTTP_TO_IP 0.10)
>X-UIDL: joV"!$mT"!"!E!!%!3!!
>
>
>
>-------------------------------------------------
>        WPPi.com        |        WPPi.Net
>-------------------------------------------------
>  http://www.wppi.com   |  http://www.wppi.net
>-------------------------------------------------
>WPPi.com & WPPi.Net MailScanner Signature
>This message has been scanned for viruses
>and dangerous content by WPPi MailScanner,
>and has been found to be clean.
>-------------------------------------------------