Physics Computing Services

Spam Scoring and Filtering with SpamAssassin

Example of spam-tagged message

Before
Subject: Get What You Want
From: eDiets Motivation <motivation@EDIETS.COM>

After
Subject: [PCS_SPAM-09.50] Get What You Want
From: eDiets Motivation <motivation@EDIETS.COM>
The number after the word "SPAM-" indicates the score the system assigned to the "spammy" email.

All email, regardless of whether it's spam or not, will carry a line of "X-Spam-Status" evaluation in the header. This tells you what spam patterns were discovered by the system when evaluating your email. Here is an example:

Received: from localhost by metromaster.physics.ucsb.edu
    with SpamAssassin (2.63 2004-01-11);
    Fri, 12 Mar 2004 11:36:59 -0800
From: "Sonia Guerrero" <mnxund837@digi.com.br>
To: <webmaster@physics.ucsb.edu>
Subject: [PCS_SPAM-21.27] get the better job - buy a diploma today isbpqiizduc
Date: Fri, 12 Mar 04 15:29:48 GMT
Message-Id: <09o507$j$7n6-$eya8@ote0i5>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
    metromaster.physics.ucsb.edu
X-Spam-Status: Yes, hits=21.3 required=5.0 tests=BAYES_99,DATE_IN_PAST_03_06,
    DATE_SPAMWARE_Y2K,FORGED_MUA_OUTLOOK,FROM_ENDS_IN_NUMS,HTML_60_70,
    HTML_FONT_BIG,HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
    MISSING_MIMEOLE,OBFUSCATING_COMMENT autolearn=no version=2.63
X-Spam-Level: *********************
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4052115B.64D72A51"

Spam detection software, running on the server mail.physics.ucsb.edu, has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or block
similar future email. If you have any questions, contact
Physics Computing Services at pcs@physics.ucsb.edu for details.
For more information on spam detection, scoring and filtering, see:
http://www.physics.ucsb.edu/~pcs/apps/faq/spam.html
Content preview: GET GET YOUR UNIVERSITY DIPLOMA Do you want a
prosperous future, increased earning power more money and the respect
of all? [...]

Content analysis details:   (21.3 points, 5.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
1.0 FROM_ENDS_IN_NUMS      From: ends in numbers
4.2 DATE_SPAMWARE_Y2K      Date header uses unusual Y2K formatting
5.4 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
0.1 HTML_60_70             BODY: Message is 60% to 70% HTML
0.3 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
0.1 HTML_MESSAGE           BODY: HTML included in message
0.3 HTML_FONT_BIG          BODY: HTML has a big font
0.4 DATE_IN_PAST_03_06     Date: is 3 to 6 hours before Received: date
4.2 OBFUSCATING_COMMENT    HTML comments which obfuscate text
1.6 MISSING_MIMEOLE        Message has X-MSMail-Priority, but no X-MimeOLE
1.1 MIME_HTML_ONLY_MULTI   Multipart message only has text/html MIME parts
2.6 FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.

What if I need help? If you have problems with or questions about spam scoring and filtering, please contact pcs@physics.ucsb.edu.

Physics Computing Services, pcs@physics.ucsb.edu
Last updated March 12, 2004 by Jennifer L. Mehl