SpamAssassin does not scan consistently

[Motty Cruz <mo...@gmail.com>]

Although both of this emails were blocked, both emails were really spammy;
one received high score while the other was percentage point away from
passing through. My question pertains to spamassassin not consistently given
"razor score, URIBL, T_REMOTE_IMAGE" to all emails. It is not being more
aggressive? 

 

X-Quarantine-ID: <ZKYOBJRfTWRD>

X-Spam-Flag: YES

X-Spam-Score: 5.502

X-Spam-Level: *****

X-Spam-Status: Yes, score=5.502 tag=-999.9 tag2=5.4 kill=5.5

        tests=[BAYES_999=0.2, BAYES_99=5.3, HTML_FONT_LOW_CONTRAST=0.001,

        HTML_MESSAGE=0.001] autolearn=no autolearn_force=no

Received: from m1.fqdn.com ([127.0.0.1])

 

X-Quarantine-ID: <YdGxAsXfBOD0>

X-Spam-Flag: YES

X-Spam-Score: 16.578

X-Spam-Level: ****************

X-Spam-Status: Yes, score=16.578 tag=-999.9 tag2=5.4 kill=5.5

        tests=[BAYES_999=0.2, BAYES_99=5.3, HTML_MESSAGE=0.001,

        RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.886,

        RAZOR2_CHECK=2.5, T_REMOTE_IMAGE=1.99, URIBL_BLACK=1.7,

        URIBL_DBL_SPAM=2.5, URI_TRY_USME=0.001]

        autolearn=no autolearn_force=no

 

local.cf

## Optional Score Increases

score DCC_CHECK 4.000

score RAZOR2_CHECK 2.500

score BAYES_99 5.300

score BAYES_90 4.500

score BAYES_80 4.000

# For scores have a look at /usr/local/share/spamassassin/50_scores.cf

# file.

score HTML_FONT_INVISIBLE 3

score HTML_FONTCOLOR_UNKNOWN 2

score ORDER_NOW 1.5

score CLICK_BELOW 1

score LIMITED_TIME_ONLY 1

# This rule might be extreme but html only spams get through too easy.

# In other words, if you can't take the time to write something and are

# posting an image only, then you're 86'd!

score HTML_IMAGE_ONLY_02 2

score HTML_IMAGE_ONLY_04 2

score OFFERS_ETC 2

score HTML_LINK_CLICK_HERE 1

score LINES_OF_YELLING 1

score RP_MATCHES_RCVD 0

# adding more feb 8 2017

score BODY_ENHANCEMENT 5.213

 

Thanks, 
Motty

Re: SpamAssassin does not scan consistently

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 09.02.17 09:34, Motty Cruz wrote:
>Although both of this emails were blocked, both emails were really spammy;
>one received high score while the other was percentage point away from
>passing through. My question pertains to spamassassin not consistently given
>"razor score, URIBL, T_REMOTE_IMAGE" to all emails. It is not being more
>aggressive?

network tests and BAYES change over time. early recipients don't get hits
when mail is received, but they often do later.

other rules change, when SA is updated with new rules...

>## Optional Score Increases
>
>score DCC_CHECK 4.000
>
>score RAZOR2_CHECK 2.500

DCC indicates bulkiness, while RAZOR indicated spamminess.
I really wonder why you put DCC higher score than RAZOR...


-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Silvester Stallone: Father of the RISC concept.