You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alicia Forsythe <Al...@mshs.com> on 2004/07/12 20:09:28 UTC
Hits over threshold, but mail still comes through
The following mail made it through spamassassin, even though it got a
score of 20 upon testing it just after receiving the mail. Why would
this be happening?
Required hits = 5 in local.cf
X-Spam-Level: ********************
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Spam-Report: This mail is probably spam. The original message has
been attached
along with this report, so you can recognize or block similar
unwanted
mail in future. See http://spamassassin.org/tag/ for more details.
Content preview: %MAKE_TXT[3-6]
URI:http://zoophilelinks.net/direct.php?l=1
URI:http://zoophilelinks.net/30.gif
URI:http://zoophilelinks.net/opt-out.php UN-SCRI-BE [...]
Content analysis details: (20.00 points, 5 required)
SARE_ADLTSUB2 (1.7 points) Contains possible adult words
CUSTOM_SUBJECTSPAM (0.7 points) Subject Spam words
SARE_RAND_HD1 (1.0 points) Received =~ /%REC(?:EIVED|_WITH)/
SARE_RAND_HD2 (1.0 points) ALL =~ /%FROM_USER/
SARE_RAND_HD3 (1.0 points) MESSAGEID =~ /%MESSAGEID/
SARE_ADULT1 (0.7 points) BODY: Contains adult material
OPT_OUT (0.0 points) BODY: Talks about opting out
(lowercase version)
HTML_IMAGE_ONLY_10 (0.5 points) BODY: HTML has images with 800-1000
bytes of words
HTML_20_30 (1.2 points) BODY: Message is 20% to 30% HTML
HTML_MESSAGE (0.1 points) BODY: HTML included in message
MY_SHRT_IMG (0.2 points) BODY: 1-3 letter gif or jpeg in
url.
CUSTOM_LOCAL_URI (2.5 points) URI: Has a link to a spam site
RCVD_IN_NJABL (0.9 points) RBL: Received via a relay in
dnsbl.njabl.org
[RBL check: found 162.233.0.218.dnsbl.njabl.org.,]
[type: 127.0.0.9]
FORGED_MUA_OUTLOOK (3.5 points) Forged mail pretending to be from MS
Outlook
SARE_RAND_7 (2.0 points) SARE_RAND_7
SARE_RAND_OTHER_U (3.0 points) SARE_RAND_OTHER_U
X-Spam-Flag: YES
Subject: *****SPAM***** Naked Teens Suck & Fuck Dog Cock
Re: Hits over threshold, but mail still comes through
Posted by Kevin Peuhkurinen <ke...@hepcoe.com>.
SA in and of itself does not delete email. In this case, it correctly
identified the email as spam and attached it as an email with a report
and preview. This is SA's default behaviour and thus it is operating
as it is supposed to.
If you want SA to delete emails that it considers spam, you have to do
that through your MTA or MDA.
Alicia Forsythe wrote:
> The following mail made it through spamassassin, even though it got a
> score of 20 upon testing it just after receiving the mail. Why would
> this be happening?
> Required hits = 5 in local.cf
> X-Spam-Level: ********************
> X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
> X-Spam-Report: This mail is probably spam. The original message has
> been attached
> along with this report, so you can recognize or block similar unwanted
> mail in future. See http://spamassassin.org/tag/ for more details.
> Content preview: %MAKE_TXT[3-6]
> URI:http://zoophilelinks.net/direct.php?l=1
> URI:http://zoophilelinks.net/30.gif
> URI:http://zoophilelinks.net/opt-out.php UN-SCRI-BE [...]
> Content analysis details: (20.00 points, 5 required)
> SARE_ADLTSUB2 (1.7 points) Contains possible adult words
> CUSTOM_SUBJECTSPAM (0.7 points) Subject Spam words
> SARE_RAND_HD1 (1.0 points) Received =~ /%REC(?:EIVED|_WITH)/
> SARE_RAND_HD2 (1.0 points) ALL =~ /%FROM_USER/
> SARE_RAND_HD3 (1.0 points) MESSAGEID =~ /%MESSAGEID/
> SARE_ADULT1 (0.7 points) BODY: Contains adult material
> OPT_OUT (0.0 points) BODY: Talks about opting out
> (lowercase version)
> HTML_IMAGE_ONLY_10 (0.5 points) BODY: HTML has images with 800-1000
> bytes of words
> HTML_20_30 (1.2 points) BODY: Message is 20% to 30% HTML
> HTML_MESSAGE (0.1 points) BODY: HTML included in message
> MY_SHRT_IMG (0.2 points) BODY: 1-3 letter gif or jpeg in url.
> CUSTOM_LOCAL_URI (2.5 points) URI: Has a link to a spam site
> RCVD_IN_NJABL (0.9 points) RBL: Received via a relay in
> dnsbl.njabl.org
> [RBL check: found 162.233.0.218.dnsbl.njabl.org.,]
> [type: 127.0.0.9]
> FORGED_MUA_OUTLOOK (3.5 points) Forged mail pretending to be from
> MS Outlook
> SARE_RAND_7 (2.0 points) SARE_RAND_7
> SARE_RAND_OTHER_U (3.0 points) SARE_RAND_OTHER_U
> X-Spam-Flag: YES
> Subject: *****SPAM***** Naked Teens Suck & Fuck Dog Cock