Darn, i forgot where that website was with SA rule...

[Matt Kettler]

Rob Morin wrote:
> Weird as here is the body of the message that generated a score of 18! 
> This is too messed up, it looks legit to me???

Yes, the parts of the message you quoted look legit. However, you quoted just
the body text, post-rendering by your client.

If it's a multi-part/alternative message, there's more to the body than what you
quoted.

The FM_MULTI_ODD* also doesn't seem to match the text you quoted.

> 
> here is the score....
> 
> Nov 16 11:48:59 peter MailScanner[4750]: Message 3A21F69008A.53354 from
> 207.99.47.70 (dplatt at domain.com) to reboxcorp.com is spam, SpamAssassin
> (score=18.497, required 4, BAYES_80 2.00, FB_4WORD_DOLLARe 1.28,
> FB_SINGLE_0WORD 0.34, FB_SINGLE_1WORD 1.01, FB_WORD2_END_DOLLAR 1.39,
> FB_WORD_01DOLLAR1 0.90, FM_MULTI_ODD2 1.10, FM_MULTI_ODD3 0.70,
> FM_MULTI_ODD4 0.70, FM_MULTI_ODD5 0.90, FM_N0N0_WORDS 3.20,
> OBSCURED_EMAIL 2.10, SARE_RAND_2 2.50, UPPERCASE_50_75 0.37)
> Nov 16 11:48:59 peter MailScanner[4750]: Spam Actions: message
> 3A21F69008A.53354 actions are delete
> 
>