You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alex <my...@gmail.com> on 2012/11/27 20:31:27 UTC
Understanding KAM_MXURI
Hi,
I've had one of KAMs rules in place for quite some time, so I'm not
sure where specifically I got it, but it's tagging ham from mail.ru
and wondered if someone could help me with it:
#MX URI - Scored lowered from 2.5 to 1.5 due to FPs reported by
Christopher X. Candreva - see https://issues.apa
che.org/SpamAssassin/show_bug.cgi?id=6700 for bug on issue
uri KAM_MXURI /^(?:http:\/\/)?(mail|mx)\./i
score KAM_MXURI 1.5
describe KAM_MXURI URI begins with a mail exchange
prefix, i.e. mx.[...]
It appears this would hit on just "mail.ru" correct? Or even mail.com,
for that matter. Shouldn't the rule be a little more robust than to
hit on something as simplistic as that? Perhaps require the http, or
that there's no real hostname part? How would this rule be modified to
do that?
Maybe this rule has even been deprecated since I first started using
it and I should just remove it?
Thanks,
Alex
Re: Understanding KAM_MXURI
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 11/27/2012 3:33 PM, Alex wrote:
> I've created a pastebin with the message here:
>
> http://pastebin.com/raw.php?i=BZHahs1S
Does pastebin expire because this example is not working for me?
>> Perhaps we need to change the regex not to mark mail.* but mark mail.*.* for
>> example to handle some of the shorter URIs like mail.ru.
> Yes, I should have mentioned that's what I was thinking would fix it
> as well.
I've tweaked it to require mx/mail.x.y[...] instead of just mail.[...]
Let me know if that helps.
> Perhaps a higher score if it's combined with the http?
I have no data if that's effective or not.
>
> Perhaps I should post a separate message, but I was hoping that since
> I have your attention now, I could ask if there was a later release
> than v3.3, even from svn, that you might consider stable enough to use
> in production?
I use KAM.cf in production. I don't always submit the rules to the
project because I enjoy controlling them without the process for
publishing rules.
> I'm getting slammed with women's implant mesh and medicare spam. Bayes
> poisioning crap, short bodys with just a URL. I'd be happy to upload
> samples of that as well.
I don't have an efficient way to look at other people's spam samples but
Alex might. He's on vacation at the moment. If not, creating an mbox
and posting to users or dev might be useful for others to help. I think
a lot of us have access to streams of spam so that's what we typically use.
regards,
KAM
Re: Understanding KAM_MXURI
Posted by Alex <my...@gmail.com>.
Hi,
>> I've had one of KAMs rules in place for quite some time, so I'm not
>> sure where specifically I got it, but it's tagging ham from mail.ru
>> and wondered if someone could help me with it:
>>
>> #MX URI - Scored lowered from 2.5 to 1.5 due to FPs reported by
>> Christopher X. Candreva - see https://issues.apa
>> che.org/SpamAssassin/show_bug.cgi?id=6700 for bug on issue
>> uri KAM_MXURI /^(?:http:\/\/)?(mail|mx)\./i
>> score KAM_MXURI 1.5
>> describe KAM_MXURI URI begins with a mail exchange
>> prefix, i.e. mx.[...]
>>
>> It appears this would hit on just "mail.ru" correct? Or even mail.com,
>> for that matter. Shouldn't the rule be a little more robust than to
>> hit on something as simplistic as that? Perhaps require the http, or
>> that there's no real hostname part? How would this rule be modified to
>> do that?
>>
>> Maybe this rule has even been deprecated since I first started using
>> it and I should just remove it?
>>
> Hi Alex,
>
> I am KAM so I wrote that rule and I use it on production systems but it is
> not maintained by the project per se. I publish it via a KAM.cf file which
> I'm guessing you are using?
Yes, hi Kevin, thanks. I had forgotten I downloaded your KAM.cf some time ago.
I've created a pastebin with the message here:
http://pastebin.com/raw.php?i=BZHahs1S
> Third, with a score of 1.5 and a required 5.0 to hit, this shouldn't really
> impact things too badly.
>
> Can you talk more about what other rules triggered and was the email
> actually marked as spam in the end?
It is the first set of X-Spam-Status header at the top that is from
our server. Combined with RATWARE_MPOP_WEBMAIL made it score pretty
highly. I also don't understand the SPF_SOFTFAIL, considering it seems
to indicate it has passed. This was apparently sent to an alias which
was expanded into its recipients by MPOP, perhaps. I'm really not
sure.
> Perhaps we need to change the regex not to mark mail.* but mark mail.*.* for
> example to handle some of the shorter URIs like mail.ru.
Yes, I should have mentioned that's what I was thinking would fix it
as well. Perhaps a higher score if it's combined with the http?
Perhaps I should post a separate message, but I was hoping that since
I have your attention now, I could ask if there was a later release
than v3.3, even from svn, that you might consider stable enough to use
in production?
I'm getting slammed with women's implant mesh and medicare spam. Bayes
poisioning crap, short bodys with just a URL. I'd be happy to upload
samples of that as well.
Thanks,
Alex
Re: Understanding KAM_MXURI
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 11/27/2012 2:31 PM, Alex wrote:
> I've had one of KAMs rules in place for quite some time, so I'm not
> sure where specifically I got it, but it's tagging ham from mail.ru
> and wondered if someone could help me with it:
>
> #MX URI - Scored lowered from 2.5 to 1.5 due to FPs reported by
> Christopher X. Candreva - see https://issues.apa
> che.org/SpamAssassin/show_bug.cgi?id=6700 for bug on issue
> uri KAM_MXURI /^(?:http:\/\/)?(mail|mx)\./i
> score KAM_MXURI 1.5
> describe KAM_MXURI URI begins with a mail exchange
> prefix, i.e. mx.[...]
>
> It appears this would hit on just "mail.ru" correct? Or even mail.com,
> for that matter. Shouldn't the rule be a little more robust than to
> hit on something as simplistic as that? Perhaps require the http, or
> that there's no real hostname part? How would this rule be modified to
> do that?
>
> Maybe this rule has even been deprecated since I first started using
> it and I should just remove it?
>
Hi Alex,
I am KAM so I wrote that rule and I use it on production systems but it
is not maintained by the project per se. I publish it via a KAM.cf file
which I'm guessing you are using?
Anyway, I'm always willing to take criticism, modify those rules, etc.
So first of all, the rule should only hit situations where a uri is
referenced in an email. And yes, if an email contained the words
mail.ru, it's possible it could be hitting.
Second, not every rule can hit only spam and never hit ham (what we call
an S/O ratio).
Third, with a score of 1.5 and a required 5.0 to hit, this shouldn't
really impact things too badly.
Can you talk more about what other rules triggered and was the email
actually marked as spam in the end?
Perhaps we need to change the regex not to mark mail.* but mark mail.*.*
for example to handle some of the shorter URIs like mail.ru.
Regards,
KAM