On Tue, May 5, 2009 at 9:37 PM, Michael Bimmler <mbimmler(a)gmail.com> wrote:
No one approved it (see headers, there is no
Approved-on line). But I
found a legacy entry in the "Always accept posts from these
non-members" filter for anthere(a)wikimedia.org... Well, I removed that
line now, as Anthere is not using a @wikimedia.org address anymore.
I realize we shouldn't be white-listing by domain name, but if a
garden variety spam-bot was able to convincingly spoof the return
address, imagine the confusion a real person could have caused.
X-Spam-Score: 7.9 (+++++++)
X-Spam-Report: Spam detection software, running on the system
"lily.knams.wikimedia.org", has
identified this incoming email as possible spam. If you have any
questions, see the administrator of that system for details.
Content analysis details: (7.9 points, 4.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[201.244.70.114 listed in
zen.spamhaus.org]
0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
[201.244.70.114 listed in
dnsbl.sorbs.net]
1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: oiwcvjoe.cn]
1.1 SORTED_RECIPS Recipient list is sorted by address
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.4995]
1.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: oiwcvjoe.cn]
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
I think David Gerard said human postings generally do not score above
2.0 unless their vocabulary suggests a background in SEO, then it's
higher.
—C.W.