You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Daniel Lemke <le...@jam-software.com> on 2011/07/26 09:21:16 UTC
Low score on mail with typical spam content
Hi there,
A few days ago a mail passed our SpamAssassin and I was a bit surprised when
I looked at the mail content.
It does contain typical spam words like ‘drug’ etc.
Mail content can be found on pastebin: http://pastebin.com/k8xptZbd
If blacklist and Bayes score are not included in spam score calculation,
score is even zero.
Why are there no regexes triggering this typical spam words?
Best regards,
Daniel
--
View this message in context: http://old.nabble.com/Low-score-on-mail-with-typical-spam-content-tp32137871p32137871.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Low score on mail with typical spam content
Posted by Martin Gregorie <ma...@gregorie.org>.
On Tue, 2011-07-26 at 00:21 -0700, Daniel Lemke wrote:
> Hi there,
>
> A few days ago a mail passed our SpamAssassin and I was a bit surprised when
> I looked at the mail content.
> It does contain typical spam words like ‘drug’ etc.
>
Actually, it contains very little that might not appear in an e-mail
from your doctor.
> Mail content can be found on pastebin: http://pastebin.com/k8xptZbd
>
The URL is a redirect via the ff.ly URL shortener, a common form of
obfuscation and was correctly spotted by two URIBLs. It redirects to
arslania.com (registered in Turkey) which in turn redirects to a Russian
pharmacy, which is probably the URL that Spamhaus and Barracuda picked
up on.
> If blacklist and Bayes score are not included in spam score calculation,
> score is even zero.
>
I get a score of 9.8 after subtracting local rules and that's without
Bayes, which didn't fire.
> Why are there no regexes triggering this typical spam words?
>
Try writing one. It would be hard to write a meta rule, let alone a
single regex, that won't FP on ham but that will reliably recognise more
spam than this one message.
What have you got against blacklists anyway?
Martin
Re: Low score on mail with typical spam content
Posted by Martin Gregorie <ma...@gregorie.org>.
On Tue, 2011-07-26 at 01:49 -0700, Daniel Lemke wrote:
> Ummh, thanks for the hint, copied the wrong sample :) (removed some header
> information by myself to test something…)
> This is the right one: http://pastebin.com/Cmu15YY2
>
Exactly the same remarks (and identical score!) apply to this one too.
I'm running SA 3.3.2 with the default ruleset apart from some local
rules and a couple of plugins that didn't fire in this case.
BTW, I miscalculated the score - the barebones SA 3.3.2 would have
scored 8.3:
0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[77.230.60.158 listed in zen.spamhaus.org]
1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[77.230.60.158 listed in
bb.barracudacentral.org]
1.8 URIBL_BLACK Contains an URL listed in the URIBL
blacklist
[URIs: ff.ly]
1.7 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
[URIs: ff.ly]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 HK_PNIS BODY: HK_PNIS
1.5 MPART_ALT_DIFF_COUNT BODY: HTML and text parts are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_URIBL_BLACK_OVERLAP T_URIBL_BLACK_OVERLAP
Martin
Re: Low score on mail with typical spam content
Posted by RW <rw...@googlemail.com>.
On Tue, 26 Jul 2011 01:49:50 -0700 (PDT)
Daniel Lemke wrote:
> Ummh, thanks for the hint, copied the wrong sample :) (removed some
> header information by myself to test something…)
> This is the right one: http://pastebin.com/Cmu15YY2
BTW your local rule JAM_REPLACED_I_BD doesn't seem to be working
correctlty.
Re: Low score on mail with typical spam content
Posted by Daniel Lemke <le...@jam-software.com>.
Axb wrote:
>
> What's wrong in the word "drug"?
> It's regularly used in medicine, science, press, etc.
> If that's a "spam word" for you, nothing prevents you from writing a
> rule to score that word.. (not really wise)
>
I accept that the word drug itself does not tag the mail as spam as the
whole concept of SpamAssassin is based on only giving small scores. But I
would at least have expected it to detect words like 'drug', 'potency' and
so on. It's ok to manually adjust the scores when necessary but the filter
should already have included rules for detecting spam signs like this (like
it’s done with HTML_MESSAGE BODY which does score 0 by default).
> As there is not SA markup in that sample so I'm assuming this was never
> passed through Spamassassin.
>
Ummh, thanks for the hint, copied the wrong sample :) (removed some header
information by myself to test something…)
This is the right one: http://pastebin.com/Cmu15YY2
Thanks!
Daniel
--
View this message in context: http://old.nabble.com/Low-score-on-mail-with-typical-spam-content-tp32137871p32138336.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Low score on mail with typical spam content
Posted by Axb <ax...@gmail.com>.
On 2011-07-26 9:21, Daniel Lemke wrote:
>
> Hi there,
>
> A few days ago a mail passed our SpamAssassin and I was a bit surprised when
> I looked at the mail content.
> It does contain typical spam words like ‘drug’ etc.
> Mail content can be found on pastebin: http://pastebin.com/k8xptZbd
> If blacklist and Bayes score are not included in spam score calculation,
> score is even zero.
> Why are there no regexes triggering this typical spam words?
>
> Best regards,
> Daniel
>
What's wrong in the word "drug"?
It's regularly used in medicine, science, press, etc.
If that's a "spam word" for you, nothing prevents you from writing a
rule to score that word.. (not really wise)
The sender IP is in XBL so it be tagged, the URL is blacklsited in SURBL
& URIBL... etc,etc
As there is not SA markup in that sample so I'm assuming this was never
passed through Spamassassin.
Re: Low score on mail with typical spam content
Posted by RW <rw...@googlemail.com>.
On Tue, 26 Jul 2011 00:21:16 -0700 (PDT)
Daniel Lemke wrote:
>
> Hi there,
>
> A few days ago a mail passed our SpamAssassin and I was a bit
> surprised when I looked at the mail content.
> It does contain typical spam words like ‘drug’ etc.
> Mail content can be found on pastebin: http://pastebin.com/k8xptZbd
> If blacklist and Bayes score are not included in spam score
> calculation, score is even zero.
Consider using greylisting, so your spam get delayed a little. By the
time I tested it the score had risen to 10