Below is a header added to the message by our anti-spam service, from an actual piece of junk e-mail:
X-Spam-Score: (******************************) 30.6
BAYES_70,CLICK_BELOW,DATE_IN_FUTURE_03_06,FORGED_HOTMAIL_RCVD,
FORGED_MUA_OUTLOOK,HGH,HTML_70_80,HTML_FONT_BIG,HTML_FONT_COLOR_BLUE,
HTML_FONT_COLOR_GRAY,HTML_FONT_COLOR_RED,HTML_SHOUTING4,
HTML_TITLE_UNTITLED,LINK_TO_NO_SCHEME,MIME_HTML_ONLY,MISSING_MIMEOLE,
PENIS_ENLARGE2,REMOVE_PAGE,SUBJ_HAS_SPACES,VIAGRA
Using your favorite e-mail client, you can write a filter that takes action on all messages that contain the string "X-Spam-Score: (*****". (5 asterisks if you want to filter on a score of 5).
And here is the informational file that is attached to that piece of spam:
---- Start SpamAssassin results
30.60 points, 4 required;
* 2.3 -- Subject contains lots of white space
* 0.6 -- BODY: Plugs Viagra
* 15.0 -- BODY: Information on getting a larger penis or breasts (2)
* 1.6 -- BODY: Human Growth Hormone
* 0.3 -- BODY: Message is 70% to 80% HTML
* 0.1 -- BODY: HTML font color is red
* 4.0 -- BODY: Bayesian classifier says spam probability is 70 to 80%
[score: 0.7559]
* 0.3 -- BODY: FONT Size +2 and up or 3 and up
* 0.1 -- BODY: HTML font color is blue
* 0.8 -- BODY: HTML has very strong "shouting" markup
* 0.1 -- BODY: HTML title contains "Untitled"
* 0.1 -- BODY: HTML font color is gray
* 0.1 -- BODY: Contains link without http:// prefix
* 0.3 -- URI: URL of page called "remove"
* 1.1 -- Forged hotmail.com 'Received:' header found
* 2.1 -- Forged mail pretending to be from MS Outlook
* 0.1 -- Message only has text/html MIME parts
* 0.1 -- Message has X-MSMail-Priority, but no X-MimeOLE
* 0.0 -- Asks you to click below* 1.5 -- Date: is 3 to 6 hours after Received: date
---- End of SpamAssassin results
