RE: [Suspected SPAM] Re: Hits over threshold, but mail still comes through

[Gary Smith <ga...@primeexalia.com>]

Alicia, 
 
Is the server where SA is residing a relay or a destination?  
 
Gary

________________________________

From: Alicia Forsythe [mailto:Alicia.Forsythe@mshs.com]
Sent: Mon 7/12/2004 11:56 AM
To: spamassassin-users@incubator.apache.org
Subject: [Suspected SPAM] Re: Hits over threshold, but mail still comes through


This mail made it through, unmarked, to the users mailbox.  I took the message and tested it to see what tests it hit on, as I knew that this message should have never reached the user at all.
Well as you can see, the message clearly scored above the threshold, yet still made it the users mailbox.


>>> Kevin Peuhkurinen <ke...@hepcoe.com> 7/12/2004 2:32:41 PM >>>

SA in and of itself does not delete email.   In this case, it correctly 
identified the email as spam and attached it as an email with a report 
and preview.   This is SA's default behaviour and thus it is operating 
as it is supposed to.

If you want SA to delete emails that it considers spam, you have to do 
that through your MTA or MDA.


Alicia Forsythe wrote:

> The following mail made it through spamassassin, even though it got a 
> score of 20 upon testing it just after receiving the mail.  Why would 
> this be happening?
> Required hits =  5 in local.cf
> X-Spam-Level: ********************
> X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
> X-Spam-Report:   This mail is probably spam.  The original message has 
> been attached
>   along with this report, so you can recognize or block similar unwanted
>   mail in future.  See http://spamassassin.org/tag/ for more details.
>   Content preview:  %MAKE_TXT[3-6]
>   URI:http://zoophilelinks.net/direct.php?l=1
>   URI:http://zoophilelinks.net/30.gif
>   URI:http://zoophilelinks.net/opt-out.php UN-SCRI-BE [...]
>   Content analysis details:   (20.00 points, 5 required)
>   SARE_ADLTSUB2      (1.7 points)  Contains possible adult words
>   CUSTOM_SUBJECTSPAM (0.7 points)  Subject Spam words
>   SARE_RAND_HD1      (1.0 points)  Received =~ /%REC(?:EIVED|_WITH)/
>   SARE_RAND_HD2      (1.0 points)  ALL =~ /%FROM_USER/
>   SARE_RAND_HD3      (1.0 points)  MESSAGEID =~ /%MESSAGEID/
>   SARE_ADULT1        (0.7 points)  BODY: Contains adult material
>   OPT_OUT            (0.0 points)  BODY: Talks about opting out 
> (lowercase version)
>   HTML_IMAGE_ONLY_10 (0.5 points)  BODY: HTML has images with 800-1000 
> bytes of words
>   HTML_20_30         (1.2 points)  BODY: Message is 20% to 30% HTML
>   HTML_MESSAGE       (0.1 points)  BODY: HTML included in message
>   MY_SHRT_IMG        (0.2 points)  BODY: 1-3 letter gif or jpeg in url.
>   CUSTOM_LOCAL_URI   (2.5 points)  URI: Has a link to a spam site
>   RCVD_IN_NJABL      (0.9 points)  RBL: Received via a relay in 
> dnsbl.njabl.org
>   [RBL check: found 162.233.0.218.dnsbl.njabl.org.,]
>   [type: 127.0.0.9]
>   FORGED_MUA_OUTLOOK (3.5 points)  Forged mail pretending to be from 
> MS Outlook
>   SARE_RAND_7        (2.0 points)  SARE_RAND_7
>   SARE_RAND_OTHER_U  (3.0 points)  SARE_RAND_OTHER_U
> X-Spam-Flag: YES
> Subject: *****SPAM***** Naked Teens Suck & Fuck Dog Cock