You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Amir Caspi <ce...@3phase.com> on 2019/07/26 20:52:11 UTC
FSL_BULK_SIG firing on only one of two identical spams?
Hi all,
In recent weeks I've been receiving many of my spams in doubles -- essentially identical spam except for the faked From and the various "Bayes poison" random text. I just got one such pair where FSL_BULK_SIG fired on one spam, but not the other, even though their content (except for the above exceptions) is essentially identical.
Does FSL_BULK_SIG need to be tweaked?
Spample 1 -- no hit:
https://pastebin.com/D4eBSgEj
Spample 2 -- FSL_BULK_SIG hits:
https://pastebin.com/nN3rSjbV
That one hit, plus the Razor update in the (literally) 15 seconds between receipt of the two spams, was enough to properly bin the second one.
Thoughts?
Thanks!
--- Amir
Re: FSL_BULK_SIG firing on only one of two identical spams?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 26 Jul 2019, at 16:52, Amir Caspi wrote:
> Hi all,
>
> In recent weeks I've been receiving many of my spams in doubles --
> essentially identical spam except for the faked From and the various
> "Bayes poison" random text. I just got one such pair where
> FSL_BULK_SIG fired on one spam, but not the other, even though their
> content (except for the above exceptions) is essentially identical.
>
> Does FSL_BULK_SIG need to be tweaked?
Not so much...
> Spample 1 -- no hit:
> https://pastebin.com/D4eBSgEj
Not flagged by Razor2
> Spample 2 -- FSL_BULK_SIG hits:
> https://pastebin.com/nN3rSjbV
Flagged by Razor2
> That one hit, plus the Razor update in the (literally) 15 seconds
> between receipt of the two spams, was enough to properly bin the
> second one.
>
> Thoughts?
FSL_BULK_SIG is a meta rule which depends on a message being flagged by
at least one of Razor2, Pyzor, or DCC. The above case is entirely normal
and to be expected.
Re: FSL_BULK_SIG firing on only one of two identical spams?
Posted by Henrik K <he...@hege.li>.
On Fri, Jul 26, 2019 at 04:50:21PM -0600, Amir Caspi wrote:
>
> If only the first spam had come 15 seconds later, Razor would have caught it.
No, it could be 15 seconds or 15 minutes later or never. Razor is not a
magic de-poisoner, it still calculates different hashes for these mails.
Re: FSL_BULK_SIG firing on only one of two identical spams?
Posted by Amir Caspi <ce...@3phase.com>.
On Jul 26, 2019, at 4:24 PM, RW <rw...@googlemail.com> wrote:
>
> Most of the difference in score came from RAZOR2_CHECK and
> RAZOR2_CF_RANGE_51_100 rather than FSL_BULK_SIG.
Thanks to both you and Bill for the clarification. If only the first spam had come 15 seconds later, Razor would have caught it. What a difference a few seconds make! (Yes, I know I should implement greylisting which would have culled at least the first spam, if not both... I'm working up to it but there are other considerations that I have to work through.)
--- Amir
Re: FSL_BULK_SIG firing on only one of two identical spams?
Posted by RW <rw...@googlemail.com>.
On Fri, 26 Jul 2019 14:52:11 -0600
Amir Caspi wrote:
> Hi all,
>
> In recent weeks I've been receiving many of my spams in doubles --
> essentially identical spam except for the faked From and the various
> "Bayes poison" random text. I just got one such pair where
> FSL_BULK_SIG fired on one spam, but not the other, even though their
> content (except for the above exceptions) is essentially identical.
>
> Does FSL_BULK_SIG need to be tweaked?
>
> Spample 1 -- no hit:
> https://pastebin.com/D4eBSgEj
>
> Spample 2 -- FSL_BULK_SIG hits:
> https://pastebin.com/nN3rSjbV
>
> That one hit, plus the Razor update in the (literally) 15 seconds
> between receipt of the two spams, was enough to properly bin the
> second one.
>
> Thoughts?
>
The rule requires one or more of DCC_CHECK, RAZOR2_CHECK and
PYZOR_CHECK, The first hit none of these, the second hit RAZOR2_CHECK.
Most of the difference in score came from RAZOR2_CHECK and
RAZOR2_CF_RANGE_51_100 rather than FSL_BULK_SIG.