Cyrillic spam mail

[Daniel Lemke <le...@jam-software.com>]

Hi, following mail got through SpamAssassin today: 
http://pastebin.com/Z50yqmij

I was just wondering why there were nearly none of standard SpamAssassin
rules hitting, it's even been whitelisted by HostKarma.

X-Spam-Status: No, hits=2.0, required= 5.0, autolearn=no, shortcircuit=no
X-Spam-Report: *  1.0 JAM_CYRILLIC_CHARSET_HEADER Cyrillic windows charset
is used in mail
	*       header
	* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, low
	*      trust
	*      [38.108.96.45 listed in list.dnswl.org]
	* -0.1 RCVD_IN_HOSTKARMA_W RBL: HostKarma: relay in white list (first pass)
	*      [38.108.96.45 listed in hostkarma.junkemailfilter.com]
	*  0.2 JAM_LONG_LINK BODY: Very long link in mail, possibly filled up with
	*      random words by bulk mailer
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
	*      [score: 0.5000]
	*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
	*      valid
	*  1.5 JAM_CYRILLIC_CHARSET Cyrillic windows charset is used in mail header
	*       and mail body
	* -2.0 RCVD_IN_HOSTKARMA_WL RBL: HostKarma: unique whitelisted
	*  0.5 KHOP_RCVD_UNTRUST DNS-whitelisted sender is not verified


Daniel
-- 
View this message in context: http://old.nabble.com/Cyrillic-spam-mail-tp28327931p28327931.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Cyrillic spam mail

[Per Jessen <pe...@computer.org>]

Daniel Lemke wrote:

> 
> Hi, following mail got through SpamAssassin today:
> http://pastebin.com/Z50yqmij
> 
> I was just wondering why there were nearly none of standard
> SpamAssassin rules hitting, it's even been whitelisted by HostKarma.

It isn't spam, it's by-subscriber advertising from Schneider/APC. 


/Per Jessen, Zürich