You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris <cp...@embarqmail.com> on 2009/08/06 02:12:07 UTC
Making this FN correctly scored as spam
http://pastebin.com/m5e126ea
This came to one of my address where what I usually get is 99% spam and
was scored as ham, no matter what I've done I can't get it to score the
minimum +5 points. After learning it as spam with sa-learn and using
spamassassin -r to report to razor/pyzor/dcc and removing the senders
address from the AWL with spamassassin --remove-addr-from-whitelist it
still scores below the required:
Content analysis details: (1.6 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-0.1 RCVD_IN_JMF_W RBL: JunkEmailFilter: relay in white list
(first pass)
[66.114.171.113 listed in
hostkarma.junkemailfilter.com]
-4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,
medium
trust
[66.114.171.113 listed in list.dnswl.org]
5.0 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 1.0000]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 DK_SIGNED Domain Keys: message has a signature
0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a
signature
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
2.2 DCC_CHECK listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
[localhost 1201; Body=many Fuz1=many]
[Fuz2=many]
-2.2 KHOP_RCVD_TRUST DNS-Whitelisted sender is verified
These are few and far between however there were two today that made it
past. Any suggestions would be appreciated
--
KeyID 0xE372A7DA98E6705C
Re: Making this FN correctly scored as spam
Posted by Chris <cp...@embarqmail.com>.
On Thu, 2009-08-06 at 10:55 -0400, Charles Gregory wrote:
> On Wed, 5 Aug 2009, Chris wrote:
> > http://pastebin.com/m5e126ea
> > This came to one of my address where what I usually get is 99% spam and
> > was scored as ham, no matter what I've done...
>
> I find it *extremely* rare for a spammer to use their own e-mail address
> and server to send their mail.
>
> So this, plus the whitelisting, leads me to suspect that you've run into a
> case where your address has been 'acquired' from some 'public' source,
> such as a business directory, and the offending sender has made the
> mistake of thinking that it is an open contact/solicitation address.
>
> Or there may be an illegitimate marketing firm selling lists that they've
> culled from 'public' sources, but which they have represented as
> 'verified' to buyers. Doubtless webex will pay for their mistake with
> reduced whitelisting.... :)
>
> - C
This was sent to a domain I own, toadnet[dot]com. Its never been used on
any lists nor at any sites for registration. Though I'd suspect it's the
same and my address getting harvested from freenet[dot]de or anywhere
else. There is no business involved with my domain. I usually let these
slide and just learn and spam, report, and continue on, since this one
was not being cooperative thought I'd seek the knowledge of the masses.
One thing I did do besides reporting to dnswl and the jmf errors address
was run spamassassin -add-address-to-blacklist which gave it a positive
score in the 40's range.
--
KeyID 0xE372A7DA98E6705C
Re: Making this FN correctly scored as spam
Posted by Charles Gregory <cg...@hwcn.org>.
On Wed, 5 Aug 2009, Chris wrote:
> http://pastebin.com/m5e126ea
> This came to one of my address where what I usually get is 99% spam and
> was scored as ham, no matter what I've done...
I find it *extremely* rare for a spammer to use their own e-mail address
and server to send their mail.
So this, plus the whitelisting, leads me to suspect that you've run into a
case where your address has been 'acquired' from some 'public' source,
such as a business directory, and the offending sender has made the
mistake of thinking that it is an open contact/solicitation address.
Or there may be an illegitimate marketing firm selling lists that they've
culled from 'public' sources, but which they have represented as
'verified' to buyers. Doubtless webex will pay for their mistake with
reduced whitelisting.... :)
- C
Re: Making this FN correctly scored as spam
Posted by RW <rw...@googlemail.com>.
On Wed, 05 Aug 2009 19:12:07 -0500
Chris <cp...@embarqmail.com> wrote:
> -2.2 KHOP_RCVD_TRUST DNS-Whitelisted sender is verified
Personally I don't see the point of this one. It's the |IP address
that's trusted, any additional domain-based authentication tells you
nothing.
If spam comes from a semi-legitimate direct-marketer, it's pretty
likely to pass authentication. Hacked mail accounts are likely to pass
too.
Re: Making this FN correctly scored as spam
Posted by Chris <cp...@embarqmail.com>.
On Thu, 2009-08-06 at 03:52 +0200, Karsten Bräckelmann wrote:
> On Wed, 2009-08-05 at 19:12 -0500, Chris wrote:
> > This came to one of my address where what I usually get is 99% spam and
> > was scored as ham, no matter what I've done I can't get it to score the
>
> Without looking at the sample provided...
>
> > -0.1 RCVD_IN_JMF_W RBL: JunkEmailFilter: relay in white list
> > -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium trust
>
> Tell the whitelists about it.
>
> > -2.2 KHOP_RCVD_TRUST DNS-Whitelisted sender is verified
>
> And re-verify your custom rules. Copied is custom, too.
>
>
Thanks for the suggestion Karsten, I did report it to both, I received a
reply from dnswl and they've lowered the score for the offending IP.
Chris
--
KeyID 0xE372A7DA98E6705C
Re: Making this FN correctly scored as spam
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Wed, 2009-08-05 at 19:12 -0500, Chris wrote:
> This came to one of my address where what I usually get is 99% spam and
> was scored as ham, no matter what I've done I can't get it to score the
Without looking at the sample provided...
> -0.1 RCVD_IN_JMF_W RBL: JunkEmailFilter: relay in white list
> -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium trust
Tell the whitelists about it.
> -2.2 KHOP_RCVD_TRUST DNS-Whitelisted sender is verified
And re-verify your custom rules. Copied is custom, too.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Making this FN correctly scored as spam
Posted by Ralph Bornefeld-Ettmann <ic...@bornefeld-ettmann.de>.
Chris schrieb:
> http://pastebin.com/m5e126ea
>
> This came to one of my address where what I usually get is 99% spam and
> was scored as ham, no matter what I've done I can't get it to score the
> minimum +5 points. After learning it as spam with sa-learn and using
> spamassassin -r to report to razor/pyzor/dcc and removing the senders
> address from the AWL with spamassassin --remove-addr-from-whitelist it
> still scores below the required:
>
> Content analysis details: (1.6 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> -0.1 RCVD_IN_JMF_W RBL: JunkEmailFilter: relay in white list
> (first pass)
> [66.114.171.113 listed in
> hostkarma.junkemailfilter.com]
> -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,
> medium
> trust
> [66.114.171.113 listed in list.dnswl.org]
> 5.0 BAYES_99 BODY: Bayesian spam probability is 99 to
> 100%
> [score: 1.0000]
> -0.0 SPF_PASS SPF: sender matches SPF record
> 0.0 DK_SIGNED Domain Keys: message has a signature
> 0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a
> signature
> 0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
> MIME
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
> 2.2 DCC_CHECK listed in DCC
> (http://rhyolite.com/anti-spam/dcc/)
> [localhost 1201; Body=many Fuz1=many]
> [Fuz2=many]
> -2.2 KHOP_RCVD_TRUST DNS-Whitelisted sender is verified
>
> These are few and far between however there were two today that made it
> past. Any suggestions would be appreciated
>
what about
header webex1 Received =~ /webexmailer.com/i
describe webex1 Mail from webexmailer
score webex1 10.0
header webex2 Received =~ /webex.com/i
describe webex2 Mail from webexmailer
score webex2 10.0
It seems webexmailer is a trusted mass-mailer so you have to overrule
the trusted whitelists (JMF, DNSWL, KHOP)
Ralph