AWL Problem?

[sp...@mail.designmedia.com]

Hi all,

Had a question about AWL.  Does it just look at the From header or does it
look at the sending IP as well?  Asking because I just start receiving
spam from this server with my email address as the From:

Received: from cm218-254-187-100.hkcable.com.hk
(cm218-254-187-100.hkcable.com.hk [218.254.187.100])

And SA 2.63 scored it like this:

X-Spam-Status: No, hits=-40.4 required=7.0
tests=AWL,BAYES_99,DRUGS_ERECTILE,
        DRUGS_ERECTILE_OBFU,MSGID_FROM_MTA_HEADER,RCVD_IN_BL_SPAMCOP_NET,
        RCVD_IN_DSBL,RCVD_IN_DYNABLOCK,RCVD_IN_NJABL,RCVD_IN_NJABL_PROXY,   
        RCVD_IN_SORBS,WS_URI_RBL autolearn=spam version=2.63       

So it hit a bunch of tests but the AWL score kicked to ham status (even
though autolearn thinks its spam).  So is there anything that can be done
about this type of spam?

Thanks.

Re: AWL Problem?

[sp...@mail.designmedia.com]

On Mon, Jul 26, 2004 at 12:45:43PM -0600, Ryan Thompson wrote:

> >Received: from cm218-254-187-100.hkcable.com.hk
> >(cm218-254-187-100.hkcable.com.hk [218.254.187.100])
> >
> >And SA 2.63 scored it like this:
> >
> >X-Spam-Status: No, hits=-40.4 required=7.0
> >tests=AWL,BAYES_99,DRUGS_ERECTILE,
> >       DRUGS_ERECTILE_OBFU,MSGID_FROM_MTA_HEADER,RCVD_IN_BL_SPAMCOP_NET,
> >       RCVD_IN_DSBL,RCVD_IN_DYNABLOCK,RCVD_IN_NJABL,RCVD_IN_NJABL_PROXY,
> >       RCVD_IN_SORBS,WS_URI_RBL autolearn=spam version=2.63
> 
> Maybe someone else will interpret this differently, but unless you have
> some really funky local ham rules (or over-aggressive manual
> whitelisting), it'd be hard to see AWL subtracting ~50 points from the
> email.
> 
> You can check the actual contents of the AWL database with the
> "check_whitelist" utility in the tools/ subdirectory of the SA
> distribution.
> 
> I'd suggest running that message through spamassassin -D -t to get a
> more detailed account of what's going on.

Thanks for the tip on check_whitelist.  I don't have any manual whitelists 
so that score has to be from AWL.  I looked through the AWL listing and 
found only one negative entry which matched:

   -20.3       (-20.3/3)  --  spam(at)designmedia.com|ip=218.254

That score doesn't seem enough to offset all those hits though.  Or is the 
-20.3 a multipler?  Is there a way to edit the AWL manually without feeding 
it an email?

Unfortunately, I've been deleting all these emails so I can't "-D -t" it to 
get more details but I will try to do so once more come in.

Thanks for the info.

--Henry Kwan

Re: AWL Problem?

[Ryan Thompson <sp...@sasknow.com>]

spam@mail.designmedia.com wrote to spamassassin-users@incubator.apache.org:

> Hi all,
>
> Had a question about AWL.  Does it just look at the From header or does it
> look at the sending IP as well?

http://wiki.apache.org/spamassassin/AutoWhitelist

1.2. How Does It Work?
The algorithm works using a database of entries. Each entry has a key
formed by the From: address of the mail, and the IP address it
originated at, and contains a TOTAL score and a COUNT number.

> Asking because I just start receiving
> spam from this server with my email address as the From:
>
> Received: from cm218-254-187-100.hkcable.com.hk
> (cm218-254-187-100.hkcable.com.hk [218.254.187.100])
>
> And SA 2.63 scored it like this:
>
> X-Spam-Status: No, hits=-40.4 required=7.0
> tests=AWL,BAYES_99,DRUGS_ERECTILE,
>        DRUGS_ERECTILE_OBFU,MSGID_FROM_MTA_HEADER,RCVD_IN_BL_SPAMCOP_NET,
>        RCVD_IN_DSBL,RCVD_IN_DYNABLOCK,RCVD_IN_NJABL,RCVD_IN_NJABL_PROXY,
>        RCVD_IN_SORBS,WS_URI_RBL autolearn=spam version=2.63

Maybe someone else will interpret this differently, but unless you have
some really funky local ham rules (or over-aggressive manual
whitelisting), it'd be hard to see AWL subtracting ~50 points from the
email.

You can check the actual contents of the AWL database with the
"check_whitelist" utility in the tools/ subdirectory of the SA
distribution.

I'd suggest running that message through spamassassin -D -t to get a
more detailed account of what's going on.

- Ryan

-- 
   Ryan Thompson <ry...@sasknow.com>

   SaskNow Technologies - http://www.sasknow.com
   901-1st Avenue North - Saskatoon, SK - S7K 1Y4

         Tel: 306-664-3600   Fax: 306-244-7037   Saskatoon
   Toll-Free: 877-727-5669     (877-SASKNOW)     North America