FROM_LOCAL_NOVOWEL FP on myspace.com message

[David B Funk <db...@engineering.uiowa.edu>]

Saw a FP on a message from myspace.com, due in large part to
FROM_LOCAL_NOVOWEL (score 2.9). The from address contained one
of those coded action things which hit that rule.

Headers were:

 From XX|X|X|5h7rdl|_|rl5nlrrdnl5swnjz2sr1w@message.myspace.com Wed Oct 11 22:54:21 2006 -0500
 Return-Path: <XX...@message.myspace.com>
 Received: from vmta04.myspace.com (vmta04.myspace.com [204.16.32.71])
	by server07.icaen.uiowa.edu (8.13.5.20060308/8.12.9) with ESMTP id k9C3ij0g007557
	for <us...@engineering.uiowa.edu>;  (envelope-from <XX...@message.myspace.com>) Wed, 11 Oct 2006 22:44:47 -0500 (CDT)
 Message-Id: <AD...@server07.icaen.uiowa.edu>
 Received: from DBMQ02 (127.0.0.1) by vmta04.myspace.com id h5mt2u0a994d for <us...@engineering.uiowa.edu>; Wed, 11 Oct 2006 20:44:43 -0700 (envelope-from <XX...@message.myspace.com>)
 mime-version: 1.0
 from: "MySpace Friend Request"
  <XX...@message.myspace.com>
 to: user@engineering.uiowa.edu
 reply-to: "MySpace Friend Request"
  <XX...@message.myspace.com>
 date: 11 Oct 2006 20:44:43 -0700
 subject: {*** SPAM  7.7 } TheTheologian would like to be added as one of your friends!
 content-type: text/plain; charset=utf-8
 content-transfer-encoding: base64
 X-Spam-Status: LOW ; 77
 X-Spam-Level: *******+++++++
 X-Spam-Report: Checker-Version SpamAssassin 3.1.5 (2006-08-29) on server37.icaen.uiowa.edu
	Content analysis details:   (7.7 points, 6.0 required, autolearn=no)
	 pts rule name              description
	---- ---------------------- ------------------------------------------
	 1.0 L_MESSAGEID_MISSING    Missing Message-Id: header
	 2.9 FROM_LOCAL_NOVOWEL     From: localpart has series of non-vowel letters
	 0.3 RM_hm_EmtyMsgid        Message ID is empty, or just spaces - probable
	                            spamsign
	 0.7 FROM_HAS_ULINE_NUMS    From: contains an underline and numbers/letters
	-0.0 SPF_PASS               SPF: sender matches SPF record
	 0.0 BAYES_50               BODY: Bayesian spam probability is 40 to 60%
	                            [score: 0.4952]
	 0.2 MIME_BASE64_NO_NAME    RAW: base64 attachment does not have a file name
	 0.2 DNS_FROM_RFC_ABUSE     RBL: Envelope sender in abuse.rfc-ignorant.org
	 1.4 DNS_FROM_RFC_WHOIS     RBL: Envelope sender in whois.rfc-ignorant.org
	 1.0 MIME_BASE64_ILLEGAL    MIME_BASE64_ILLEGAL


-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{