You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Asif Iqbal <va...@gmail.com> on 2008/02/28 00:18:11 UTC
Reduce the spam score
What is short of putting the sender email to white list to reduce the
score of this email. It is a valid email. Here is the report
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
qmail.home.net
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.4 required=5.0 tests=BAYES_00,MISSING_DATE,
MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,SARE_GIF_ATTACH,
SARE_RMML_Stock9,TW_BF,TW_FW,TW_FZ,TW_GJ,TW_GK,TW_GM,TW_GN,TW_GQ,TW_HX,TW_KD,
TW_KG,TW_KK,TW_LR,TW_NB,TW_NR,TW_SG,TW_TN,TW_TX,TW_VF,TW_VP,TW_VX,TW_WB,TW_WG,
TW_WX,TW_XC,UNPARSEABLE_RELAY autolearn=no version=3.2.3
X-Spam-Report:
* 0.0 MISSING_MID Missing Message-Id: header
* 0.0 MISSING_DATE Missing Date: header
* 2.5 MISSING_HB_SEP Missing blank line between message header and body
* 0.0 UNPARSEABLE_RELAY Informational: message has
unparseable relay lines
* 1.3 MISSING_HEADERS Missing To: header
* 0.1 TW_XC BODY: Odd Letter Triples with XC
* 0.1 TW_KK BODY: Odd Letter Triples with KK
* 0.1 TW_GN BODY: Odd Letter Triples with GN
* 0.1 TW_BF BODY: Odd Letter Triples with BF
* 0.1 TW_GQ BODY: Odd Letter Triples with GQ
* 0.1 TW_TN BODY: Odd Letter Triples with TN
* 0.1 TW_NB BODY: Odd Letter Triples with NB
* 0.1 TW_GJ BODY: Odd Letter Triples with GJ
* 0.1 TW_VX BODY: Odd Letter Triples with VX
* 0.1 TW_NR BODY: Odd Letter Triples with NR
* 0.1 TW_KG BODY: Odd Letter Triples with KG
* 0.1 TW_GM BODY: Odd Letter Triples with GM
* 0.1 SARE_RMML_Stock9 BODY: SARE_RMML_Stock9
* 0.1 TW_WG BODY: Odd Letter Triples with WG
* 0.1 TW_HX BODY: Odd Letter Triples with HX
* 0.1 TW_TX BODY: Odd Letter Triples with TX
* 0.1 TW_KD BODY: Odd Letter Triples with KD
* 0.1 TW_WX BODY: Odd Letter Triples with WX
* 0.1 TW_VP BODY: Odd Letter Triples with VP
* 0.1 TW_LR BODY: Odd Letter Triples with LR
* 0.1 TW_FZ BODY: Odd Letter Triples with FZ
* 0.1 TW_FW BODY: Odd Letter Triples with FW
* 0.1 TW_VF BODY: Odd Letter Triples with VF
* 0.1 TW_SG BODY: Odd Letter Triples with SG
* 0.1 TW_GK BODY: Odd Letter Triples with GK
* 0.1 TW_WB BODY: Odd Letter Triples with WB
* -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
* [score: 0.0000]
* 1.4 SARE_GIF_ATTACH FULL: Email has a inline gif
* 1.8 MISSING_SUBJECT Missing Subject: header
--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
Re: Reduce the spam score
Posted by Matt Kettler <mk...@verizon.net>.
Daryl C. W. O'Shea wrote:
> On 27/02/2008 6:18 PM, Asif Iqbal wrote:
>
>> What is short of putting the sender email to white list to reduce the
>> score of this email. It is a valid email. Here is the report
>>
>
> As presented to SpamAssassin, it was not a valid email. It had no headers.
>
> Daryl
>
Also, as presented to SpamAssassin, the body text has some really
strange letter combinations, as is evidenced by the heavy hits of the
TW_* rules from the tripwire add-on ruleset.
This could be one of two causes:
1) there was a mime attachment, but due to lack of headers, SA didn't
realize it was a mime message, and interpreted it as text.
2) the email isn't english. Tripwire is somewhat English-language
centric and I would not advise using this add-on in a non-English
environment.
However, I would say the problem Daryl pointed out is more important. SA
didn't see a Subject: Date: or Message-ID: header.
It also didn't find a blank line between what appears to be the start of
the body.
This leads me to suspect there's a mis-wrapped header or header with
invalid charachters in the name somewhere in your header block, and SA
is assuming that the body starts right there. One common mistake is to
have a header name with a space in it.. ie: My Header: something is
invalid and will confuse the parser.
Re: Reduce the spam score
Posted by Asif Iqbal <va...@gmail.com>.
On Wed, Feb 27, 2008 at 6:21 PM, Daryl C. W. O'Shea
<sp...@dostech.ca> wrote:
> On 27/02/2008 6:18 PM, Asif Iqbal wrote:
> > What is short of putting the sender email to white list to reduce the
> > score of this email. It is a valid email. Here is the report
>
> As presented to SpamAssassin, it was not a valid email. It had no headers.
Here is the actual email
Return-Path: <Bo...@suns.com>
Received: (qmail 5199 invoked by uid 7801); 27 Feb 2008 20:59:37 -0000
Received: from NO?REVERSE?DNS (HELO corde.phxse.local) ([65.121.94.77])
(envelope-sender <BB...@suns.com>)
by qmail.home.net (qmail-ldap-1.03) with SMTP
for <dn...@home.net>; 27 Feb 2008 20:59:20 -0000
Received: from corde.phxse.local (127.0.0.1) by corde.phxse.local
(MlfMTA v3.2r9) id hon7la0171st for <dn...@home.net>; Wed, 27 Feb
2008 14:00:00 -0700 (envelope-from <Bo...@suns.com>)
Received: from tikkes.phxse.local ([10.1.1.106])
by corde.phxse.local (SonicWALL 6.0.1.9157)
with ESMTP; Wed, 27 Feb 2008 14:00:00 -0700
Received: from jira.phxse.local ([10.1.2.6]) by tikkes.phxse.local with
Microsoft SMTPSVC(6.0.3790.1830);
Wed, 27 Feb 2008 13:59:59 -0700
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----_=_NextPart_001_01C87983.B69E776F"
Subject: I need an A Record
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Date: Wed, 27 Feb 2008 13:59:59 -0700
Message-ID: <3C...@jira.phxse.local>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: I need an A Record
Thread-Index: Ach5g7BQY505vI3KRMel990kVHr6lA==
From: "Bolt, Bill" <Bo...@suns.com>
To: <dn...@home.net>
Return-Path: Bolt@suns.com
X-OriginalArrivalTime: 27 Feb 2008 20:59:59.0396 (UTC)
FILETIME=[B6C2DE40:01C87983]
X-Mlf-Version: 6.0.1.9157
X-Mlf-UniqueId: o200802272100000007333
This is a multi-part message in MIME format.
------_=_NextPart_001_01C87983.B69E776F
Content-Type: multipart/alternative;
boundary="----_=_NextPart_002_01C87983.B69E776F"
------_=_NextPart_002_01C87983.B69E776F
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
I deed an A record for domain and sub domain OWA.slpit.com. I control
the domain SLPIT.Com which is registered at Network Solutions. If I
need to add you as technical contact let me know. The address that we
want to point this at is 65.121.94.82. This is a link to our Web
Exchange on an ISA Server. I can be reached at the contact below.=20
=20
=20
=20
------_=_NextPart_002_01C87983.B69E776F
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 11
(filtered medium)"> <!--[if !mso]> <style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt; font-family:Arial'>I deed an A record for
domain and sub domain = </span></font><b><font face=3DArial><span
=
style=3D'font-family:Arial;font-weight:bold'>OWA.slpit.com</span></font>
<=
/b><font
size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;font-family:Arial'>. I control the domain
SLPIT.Com which is registered at Network Solutions. If = I need to
add you as technical contact let me know. The address that we =
want to point this at is </span></font><b><font face=3DArial><span =
style=3D'font-family:
Arial;font-weight:bold'>65.121.94.82</span></font></b><font size=3D2 =
face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'>. This
is a link to our Web = Exchange on an ISA Server. I can be reached
at the contact below. = <o:p></o:p></span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'><img width=3D530 height=3D90 id=3D"_x0000_i1025"
src=3D"cid:image001.gif@01C87948.A81C6AE0"> </span><o:p></o:p></fon
t=
></p>
<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>
------_=_NextPart_002_01C87983.B69E776F--
------_=_NextPart_001_01C87983.B69E776F
Content-Type: image/gif;
name="image001.gif"
Content-Transfer-Encoding: base64
Content-ID: <im...@01C87948.A81C6AE0>
Content-Description: image001.gif
Content-Location: image001.gif
R0lGODlhEgJaAPcAAAAAAP////X16/z2zfvurzQsDDw0FfXXbvzlj+3SgCQcBCwkDPHKWmtU
HOC/
cGRMFNWkOu+9SeC0UcukTopwOGhVKpmBSsOkYuvTnTQkBFQ8DBwUBDwsDMuVLMmYOGRMHFpF
Gnle
KNeoSCQcDN+0YM+ubUs0DGxMFFQ9FOerPYpnJpp0LNaqWFpIJnZeNKqNV4t0S9u7g9/b1OSd
KdWV
LHlVHNaZN1A8HMaYSntmQtbRyWxECiwcBFw8DGREFDQkDGxMHEo1FbuHNjsrFK6ikMrEuzwk
BM+D
GXRMFEQsDMmHK8WKOUwsBGQ8DFQ0DIhUFGxEFFw8FLl3KYdYHnRMHGREHHZTJtaYSWZKJmpa
R7+0
p3xMFNWHLDEkFTkvJJmLe2Q0BFQsBEQkBJxUDDQcBHtEDGw8DCQUBFw0DEwsDHREFMd5JmQ8
FDwk
DBQMBKloJlQ0FGxEHCwcDFw8HLh5OUw6J1pLPIByZKZWCsRsHbdmHJlVGLdqJn9MHUcsFM2D
QYE8
BGw0BFwsBHQ8DGQ0DIdJFHxEFGw8FHREHHQ0BEwkBDwcBJdIDIpEDHw8DLZbF5RMFKdXF1Qs
DEQk
DFw0FGQ8HKlrOr6BU9CTZXw0BFQkBKRMDCwUBGw0DJxMFFwsDHU8FGQ0FDQcDJpWJ2w8HFQ0
HWcr
zLzMy1BID8hpE8gMXVwB7hLBmgKB7myhcoxi/YTIMX5PHGJjYNbKYFhjNgLrDMhjMjKAZWCD
B1BD
M1Bm0c4gIAAAOw==
------_=_NextPart_001_01C87983.B69E776F--
So is there anything I can do to make sure this email is not considered as spam
>
> Daryl
>
>
>
>
> > X-Spam-Flag: YES
> > X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
> > qmail.home.net
> > X-Spam-Level: ******
> > X-Spam-Status: Yes, score=6.4 required=5.0 tests=BAYES_00,MISSING_DATE,
> > MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,SARE_GIF_ATTACH,
> > SARE_RMML_Stock9,TW_BF,TW_FW,TW_FZ,TW_GJ,TW_GK,TW_GM,TW_GN,TW_GQ,TW_HX,TW_KD,
> > TW_KG,TW_KK,TW_LR,TW_NB,TW_NR,TW_SG,TW_TN,TW_TX,TW_VF,TW_VP,TW_VX,TW_WB,TW_WG,
> > TW_WX,TW_XC,UNPARSEABLE_RELAY autolearn=no version=3.2.3
> > X-Spam-Report:
> > * 0.0 MISSING_MID Missing Message-Id: header
> > * 0.0 MISSING_DATE Missing Date: header
> > * 2.5 MISSING_HB_SEP Missing blank line between message header and body
> > * 0.0 UNPARSEABLE_RELAY Informational: message has
> > unparseable relay lines
> > * 1.3 MISSING_HEADERS Missing To: header
> > * 0.1 TW_XC BODY: Odd Letter Triples with XC
> > * 0.1 TW_KK BODY: Odd Letter Triples with KK
> > * 0.1 TW_GN BODY: Odd Letter Triples with GN
> > * 0.1 TW_BF BODY: Odd Letter Triples with BF
> > * 0.1 TW_GQ BODY: Odd Letter Triples with GQ
> > * 0.1 TW_TN BODY: Odd Letter Triples with TN
> > * 0.1 TW_NB BODY: Odd Letter Triples with NB
> > * 0.1 TW_GJ BODY: Odd Letter Triples with GJ
> > * 0.1 TW_VX BODY: Odd Letter Triples with VX
> > * 0.1 TW_NR BODY: Odd Letter Triples with NR
> > * 0.1 TW_KG BODY: Odd Letter Triples with KG
> > * 0.1 TW_GM BODY: Odd Letter Triples with GM
> > * 0.1 SARE_RMML_Stock9 BODY: SARE_RMML_Stock9
> > * 0.1 TW_WG BODY: Odd Letter Triples with WG
> > * 0.1 TW_HX BODY: Odd Letter Triples with HX
> > * 0.1 TW_TX BODY: Odd Letter Triples with TX
> > * 0.1 TW_KD BODY: Odd Letter Triples with KD
> > * 0.1 TW_WX BODY: Odd Letter Triples with WX
> > * 0.1 TW_VP BODY: Odd Letter Triples with VP
> > * 0.1 TW_LR BODY: Odd Letter Triples with LR
> > * 0.1 TW_FZ BODY: Odd Letter Triples with FZ
> > * 0.1 TW_FW BODY: Odd Letter Triples with FW
> > * 0.1 TW_VF BODY: Odd Letter Triples with VF
> > * 0.1 TW_SG BODY: Odd Letter Triples with SG
> > * 0.1 TW_GK BODY: Odd Letter Triples with GK
> > * 0.1 TW_WB BODY: Odd Letter Triples with WB
> > * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> > * [score: 0.0000]
> > * 1.4 SARE_GIF_ATTACH FULL: Email has a inline gif
> > * 1.8 MISSING_SUBJECT Missing Subject: header
> >
> >
>
>
>
--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
Re: Reduce the spam score
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
On 27/02/2008 6:18 PM, Asif Iqbal wrote:
> What is short of putting the sender email to white list to reduce the
> score of this email. It is a valid email. Here is the report
As presented to SpamAssassin, it was not a valid email. It had no headers.
Daryl
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
> qmail.home.net
> X-Spam-Level: ******
> X-Spam-Status: Yes, score=6.4 required=5.0 tests=BAYES_00,MISSING_DATE,
> MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,SARE_GIF_ATTACH,
> SARE_RMML_Stock9,TW_BF,TW_FW,TW_FZ,TW_GJ,TW_GK,TW_GM,TW_GN,TW_GQ,TW_HX,TW_KD,
> TW_KG,TW_KK,TW_LR,TW_NB,TW_NR,TW_SG,TW_TN,TW_TX,TW_VF,TW_VP,TW_VX,TW_WB,TW_WG,
> TW_WX,TW_XC,UNPARSEABLE_RELAY autolearn=no version=3.2.3
> X-Spam-Report:
> * 0.0 MISSING_MID Missing Message-Id: header
> * 0.0 MISSING_DATE Missing Date: header
> * 2.5 MISSING_HB_SEP Missing blank line between message header and body
> * 0.0 UNPARSEABLE_RELAY Informational: message has
> unparseable relay lines
> * 1.3 MISSING_HEADERS Missing To: header
> * 0.1 TW_XC BODY: Odd Letter Triples with XC
> * 0.1 TW_KK BODY: Odd Letter Triples with KK
> * 0.1 TW_GN BODY: Odd Letter Triples with GN
> * 0.1 TW_BF BODY: Odd Letter Triples with BF
> * 0.1 TW_GQ BODY: Odd Letter Triples with GQ
> * 0.1 TW_TN BODY: Odd Letter Triples with TN
> * 0.1 TW_NB BODY: Odd Letter Triples with NB
> * 0.1 TW_GJ BODY: Odd Letter Triples with GJ
> * 0.1 TW_VX BODY: Odd Letter Triples with VX
> * 0.1 TW_NR BODY: Odd Letter Triples with NR
> * 0.1 TW_KG BODY: Odd Letter Triples with KG
> * 0.1 TW_GM BODY: Odd Letter Triples with GM
> * 0.1 SARE_RMML_Stock9 BODY: SARE_RMML_Stock9
> * 0.1 TW_WG BODY: Odd Letter Triples with WG
> * 0.1 TW_HX BODY: Odd Letter Triples with HX
> * 0.1 TW_TX BODY: Odd Letter Triples with TX
> * 0.1 TW_KD BODY: Odd Letter Triples with KD
> * 0.1 TW_WX BODY: Odd Letter Triples with WX
> * 0.1 TW_VP BODY: Odd Letter Triples with VP
> * 0.1 TW_LR BODY: Odd Letter Triples with LR
> * 0.1 TW_FZ BODY: Odd Letter Triples with FZ
> * 0.1 TW_FW BODY: Odd Letter Triples with FW
> * 0.1 TW_VF BODY: Odd Letter Triples with VF
> * 0.1 TW_SG BODY: Odd Letter Triples with SG
> * 0.1 TW_GK BODY: Odd Letter Triples with GK
> * 0.1 TW_WB BODY: Odd Letter Triples with WB
> * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> * [score: 0.0000]
> * 1.4 SARE_GIF_ATTACH FULL: Email has a inline gif
> * 1.8 MISSING_SUBJECT Missing Subject: header
>
>
Re: Reduce the spam score
Posted by John Hardin <jh...@impsec.org>.
On Wed, 27 Feb 2008, Asif Iqbal wrote:
> What is short of putting the sender email to white list to reduce the
> score of this email. It is a valid email. Here is the report
>
> * 0.1 TW_XC BODY: Odd Letter Triples with XC
> * 0.1 TW_KK BODY: Odd Letter Triples with KK
> * 0.1 TW_GN BODY: Odd Letter Triples with GN
> * 0.1 TW_BF BODY: Odd Letter Triples with BF
> * 0.1 TW_GQ BODY: Odd Letter Triples with GQ
> * 0.1 TW_TN BODY: Odd Letter Triples with TN
> * 0.1 TW_NB BODY: Odd Letter Triples with NB
> * 0.1 TW_GJ BODY: Odd Letter Triples with GJ
> * 0.1 TW_VX BODY: Odd Letter Triples with VX
> * 0.1 TW_NR BODY: Odd Letter Triples with NR
> * 0.1 TW_KG BODY: Odd Letter Triples with KG
> * 0.1 TW_GM BODY: Odd Letter Triples with GM
> * 0.1 TW_WG BODY: Odd Letter Triples with WG
> * 0.1 TW_HX BODY: Odd Letter Triples with HX
> * 0.1 TW_TX BODY: Odd Letter Triples with TX
> * 0.1 TW_KD BODY: Odd Letter Triples with KD
> * 0.1 TW_WX BODY: Odd Letter Triples with WX
> * 0.1 TW_VP BODY: Odd Letter Triples with VP
> * 0.1 TW_LR BODY: Odd Letter Triples with LR
> * 0.1 TW_FZ BODY: Odd Letter Triples with FZ
> * 0.1 TW_FW BODY: Odd Letter Triples with FW
> * 0.1 TW_VF BODY: Odd Letter Triples with VF
> * 0.1 TW_SG BODY: Odd Letter Triples with SG
> * 0.1 TW_GK BODY: Odd Letter Triples with GK
> * 0.1 TW_WB BODY: Odd Letter Triples with WB
Those rules may not work well with non-english languages. If they don't
detect real spam well for you, you may want to stop using them.
> * -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> * [score: 0.0000]
You might want to make BAYES_00 score a little stronger (-3.0 or -4.0
maybe).
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Your mouse has moved. Your Windows Operating System must be
relicensed due to this hardware change. Please contact Microsoft
to obtain a new activation key. If this hardware change results in
added functionality you may be subject to additional license fees.
Your system will now shut down. Thank you for choosing Microsoft.
-----------------------------------------------------------------------
15 days until Albert Einstein's 129th Birthday