You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris Thielen <cm...@someone.dhs.org> on 2005/07/07 08:15:24 UTC
Re: (14.6) How can I correctly detect these spams?
Hi Thomas,
Your email scored nearly 25 on my system. Chickenpox contributed 4.2,
uribls contributed tons.
HTH :)
Thomas Booms wrote:
>Spam detection software, running on the system "ns1.sandgnat.com", has
>identified this incoming email as possible spam. The original message
>has been attached to this so you can view it (if it isn't spam) or label
>similar future email. If you have any questions, see
>the administrator of that system for details.
>
>Content preview: Hi all, I have set all BAYES tests to default values
> and put in the $GLOBAL all SORBS test in my users database. But since
> the last hours I got these following listed spams through without
> tagging as spam: [...]
>
>Content analysis details: (14.6 points, 5.0 required)
>
> pts rule name description
>---- ---------------------- --------------------------------------------------
>-0.0 SPF_PASS SPF: sender matches SPF record
> 1.8 SPLEL_NLN BODY: Obfuscated 'online' in body
> 0.6 J_CHICKENPOX_34 BODY: {3}Letter - punctuation - {4}Letter
> 0.6 J_CHICKENPOX_14 BODY: {1}Letter - punctuation - {4}Letter
> 0.6 J_CHICKENPOX_44 BODY: {4}Letter - punctuation - {4}Letter
> 0.6 J_CHICKENPOX_56 BODY: {5}Letter - punctuation - {6}Letter
> 0.6 J_CHICKENPOX_64 BODY: {6}Letter - punctuation - {4}Letter
> 0.6 J_CHICKENPOX_102 BODY: {10}Letter - punctuation - {2}Letter
> 1.8 LOBO_NLN BODY: Obfuscated 'online' in body
> 0.6 J_CHICKENPOX_53 BODY: {5}Letter - punctuation - {3}Letter
> 0.1 TW_DF BODY: Odd Letter Triples with DF
> 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
> [cf: 100]
> 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> [score: 1.0000]
> 1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
> 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
> [URIs: timestipulatecool.com treasureyourdevelopment.com militopnig.com]
> 0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
> [URIs: timestipulatecool.com militopnig.com]
> 3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
> [URIs: timestipulatecool.com treasureyourdevelopment.com militopnig.com]
> 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
> [URIs: timestipulatecool.com]
> 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
> [URIs: militopnig.com]
> -10 AWL AWL: From: address is in the auto white-list
>
>
>
>
> Hi all,
>
> I have set all BAYES tests to default values and put in the $GLOBAL
> all SORBS test in my users database.
>
> But since the last hours I got these following listed spams through
> without tagging as spam:
Re: How can I correctly detect these spams?
Posted by Chris Thielen <cm...@someone.dhs.org>.
Andy Jezierski wrote:
>
> Chris Thielen <cm...@someone.dhs.org> wrote on 07/07/2005
> 01:15:24 AM:
>
> > Hi Thomas,
> >
> > Your email scored nearly 25 on my system. Chickenpox contributed 4.2,
> > uribls contributed tons.
> >
> > HTH :)
> >
>
> As has been pointed out, make sure your network tests are turned on. I
> am surprised that I only got two chickenpox hits on my system though.
>
> Chris, what version do you have running? Mine is 1.18 dated 2004-4-5
Mine is actually older, hmmmm.. ver 1.15 dated 2004-02-06. Perhaps
Jennifer revised it later to get rid of false positives?
>
> X-Spam-Status: Yes, score=45.4 required=5.7 tests=BAYES_99,FUZZY_MILLION,
> HTML_80_90,HTML_FONT_BIG,HTML_MESSAGE,J_CHICKENPOX_102,
> J_CHICKENPOX_56,LG_4C_2V_3C,MIME_QP_LONG_LINE,PRIORITY_NO_NAME,
> RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,
> SARE_HEAD_XUNSENT,SARE_OBFU_PART_ING,URIBL_AB_SURBL,URIBL_BLACK,
>
> URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL
> autolearn=unavailable version=3.1.0-pre4-r208823
>
> Andy
Re: How can I correctly detect these spams?
Posted by Andy Jezierski <aj...@stepan.com>.
Chris Thielen <cm...@someone.dhs.org> wrote on 07/07/2005
01:15:24 AM:
> Hi Thomas,
>
> Your email scored nearly 25 on my system. Chickenpox contributed 4.2,
> uribls contributed tons.
>
> HTH :)
>
As has been pointed out, make sure your network tests are turned on. I am
surprised that I only got two chickenpox hits on my system though.
Chris, what version do you have running? Mine is 1.18 dated 2004-4-5
X-Spam-Status: Yes, score=45.4 required=5.7 tests=BAYES_99,FUZZY_MILLION,
HTML_80_90,HTML_FONT_BIG,HTML_MESSAGE,J_CHICKENPOX_102,
J_CHICKENPOX_56,LG_4C_2V_3C,MIME_QP_LONG_LINE,PRIORITY_NO_NAME,
RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,
SARE_HEAD_XUNSENT,SARE_OBFU_PART_ING,URIBL_AB_SURBL,URIBL_BLACK,
URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL
autolearn=unavailable version=3.1.0-pre4-r208823
Andy