How do you score?

[Trevor Dodds <tr...@avusa.co.za>]

Hi,

 

I've recently seen a lot more spam emails passing through our
spamassassin filters.  I continually train Bayes on emails that score
low.  Please can you tell me what scores you receive on the attached two
emails.

 

Thanks

Trevor
 
This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored.  
 
Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

Re: How do you score?

[Evan Platt <ev...@espphotography.com>]

It's generally not a good idea to post spam to the list. If you need 
to, put it on a website somewhere and place a link to it.

I ran one message through an older install of SA I have (non 
production), 3.2.3, and it scored a 16.8:

ontent analysis details:   (16.8 points, 5.0 required)

  pts rule name              description
---- ---------------------- --------------------------------------------------
  0.1 RDNS_NONE              Delivered to trusted network by a host 
with no rDNS
  5.0 BOTNET                 Relay might be a spambot or virusbot
                             [botnet0.7,ip=196.44.3.90,nordns]
  1.3 RCVD_NUMERIC_HELO      Received: contains an IP address used for HELO
  0.6 ALL_NATURAL            BODY: Spam is 100% natural?!
  0.8 SARE_URI_MEDS          URI: domain selling meds
  3.4 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                             [URIs: mymedsinformation.com]
  2.6 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                             [URIs: mymedsinformation.com]
  3.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                             [URIs: mymedsinformation.com]

I'll try and run the other one later.

Happy Thanskgiving.

Evan

At 07:50 AM 11/22/2007, Trevor Dodds wrote:
>Hi,
>
>I've recently seen a lot more spam emails passing through our 
>spamassassin filters.  I continually train Bayes on emails that 
>score low.  Please can you tell me what scores you receive on the 
>attached two emails.
>
>Thanks
>Trevor

Re: How do you score?

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 22.11.07 17:50, Trevor Dodds wrote:
> I've recently seen a lot more spam emails passing through our
> spamassassin filters.  I continually train Bayes on emails that score
> low.  Please can you tell me what scores you receive on the attached two
> emails.

X-Spam-Status: Yes, score=16.5 required=3.5 tests=BAYES_99,HTML_IMAGE_ONLY_32,
        HTML_IMAGE_RATIO_04,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,
        RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,RCVD_NUMERIC_HELO,URIBL_BLACK,
        URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_WS_SURBL autolearn=disabled
        version=3.2.3

X-Spam-Status: Yes, score=11.0 required=3.5 tests=BAYES_99,HTML_MESSAGE,
        RAZOR2_CHECK,RCVD_NUMERIC_HELO,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL
        autolearn=disabled version=3.2.3

however the network checks may be misleading. when checkning the same message
again it may produce higher score because it appears in more blacklists than
before

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Micro$oft random number generator: 0, 0, 0, 4.33e+67, 0, 0, 0...