You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by LuKreme <kr...@kreme.com> on 2009/05/21 19:40:30 UTC
Hrm, this spam is annoying
Scores 1.0 for me
<http://home.kreme.com/spam20090521.txt>
X-Spam-Report:
* 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
* [93.86.56.82 listed in dnsbl.sorbs.net]
* -0.0 SPF_PASS SPF: sender matches SPF record
* -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM white-
list
* -1.3 DKIM_VERIFIED Domain Keys Identified Mail: signature passes
* verification
* -1.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4986]
* 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
* 2.2 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
* 2.0 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
* 1.7 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe
* naught else
* 0.0 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
* -0.7 ENV_AND_HDR_DKIM_MATCH Env and Hdr From used in default DKIM WL
* Match
total of -6.3 if ham scores, sigh.
Gotten multiples of this spam on multiple accounts, include one that
ONLY gets spam.
--
I loved you when our love was blessed I love you now there's
nothing left But sorrow and a sense of overtime
Re: Hrm, this spam is annoying
Posted by Henrik K <he...@hege.li>.
On Thu, May 21, 2009 at 08:26:07PM +0200, Mark Martinec wrote:
>
> > Gotten multiples of this spam on multiple accounts, include one that
> > ONLY gets spam.
>
> If the RCVD_IN_SORBS_WEB, TVD_SPACE_RATIO, HTML_IMAGE_ONLY,
> SARE_HTML_IMG_ONLY etc does not suffice, you may have to
> add dedicated rules.
> For starters I'd bump up the RCVD_IN_SORBS_WEB to 1.5.
Also hits EmailBL test zone, for what it matters. ;)
Seems to be a real person spamming for his company. For a moment I was
confused if it was FP. Or is there something that I'm missing? I can even
google for his CV..
Re: Hrm, this spam is annoying
Posted by Mark Martinec <Ma...@ijs.si>.
LuKreme,
> * -1.3 DKIM_VERIFIED Domain Keys Identified Mail: signature passes
> * verification
> * -1.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature
> * -0.7 ENV_AND_HDR_DKIM_MATCH Env and Hdr From used in default DKIM WL
>
> total of -6.3 if ham scores, sigh.
These rules are better set to score near zero, e.g.:
score DKIM_SIGNED 0.01
score DKIM_VERIFIED 0.1
score ENV_AND_HDR_DKIM_MATCH -0.1
score ENV_AND_HDR_SPF_MATCH -0.5
> Gotten multiples of this spam on multiple accounts, include one that
> ONLY gets spam.
If the RCVD_IN_SORBS_WEB, TVD_SPACE_RATIO, HTML_IMAGE_ONLY,
SARE_HTML_IMG_ONLY etc does not suffice, you may have to
add dedicated rules.
For starters I'd bump up the RCVD_IN_SORBS_WEB to 1.5.
Mark
Re: Hrm, this spam is annoying
Posted by Benny Pedersen <me...@junc.org>.
On Thu, May 21, 2009 19:40, LuKreme wrote:
> <http://home.kreme.com/spam20090521.txt>
0.0 URICOUNTRY_SE Contains a URI hosted in SE
0.0 URICOUNTRY_US Contains a URI hosted in US
0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
[93.86.56.82 listed in dnsbl.sorbs.net]
1.5 HELO_WIERD_FORMAT Helo with ? around nummeric ip
0.5 FREEMAIL_FROM Sender email is freemail
(dejan.devic[at]gmail.com)
-0.5 SPF_PASS SPF: sender matches SPF record
0.5 EMAILBL_TEST_LEM EmailBL hit at listed.emailbl.me.
(dejan.devic[at]gmail.com)
0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a
signature
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
2.2 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
2.0 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
3.7 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.0 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
--
http://localhost/ 100% uptime and 100% mirrored :)
Re: Hrm, this spam is annoying
Posted by mouss <mo...@ml.netoyen.net>.
LuKreme a écrit :
> On 24-May-2009, at 04:45, mouss wrote:
>> LuKreme a écrit :
>>> * -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
>>> white-list
>>>
>>> Pls note the word *DEFAULT*
>>>
>> that means nothing.
>> check your system and find where def_whitelist_from_dkim is found.
>
> Ah, well, that was confiusing. There was an old dkim.cf file with all
> sorts of silly things
watch you language ;-p these are from amavisd-new site.
> whitelisted in an attempt to actually punish
> forged eamils. Here's an excerpt:
>
> header __L_FROM_GMAIL From:addr =~ m{\@gmail\.com$}mi
> meta L_NOTVALID_GMAIL !DKIM_VERIFIED && __L_FROM_GMAIL && !__L_VIA_ML
> priority L_NOTVALID_GMAIL 500
> score L_NOTVALID_GMAIL 2.8
>
> otoh, looking at a lot of mail, this is the only spam that hit that, and
> it looks like it was a valid email of sorts, sent via gmail and all,
> just with a spam message. I might leave it to google to deal with :)
>
Re: Hrm, this spam is annoying
Posted by LuKreme <kr...@kreme.com>.
On 24-May-2009, at 04:45, mouss wrote:
> LuKreme a écrit :
>> * -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM
>> white-list
>>
>> Pls note the word *DEFAULT*
>>
> that means nothing.
> check your system and find where def_whitelist_from_dkim is found.
Ah, well, that was confiusing. There was an old dkim.cf file with all
sorts of silly things whitelisted in an attempt to actually punish
forged eamils. Here's an excerpt:
header __L_FROM_GMAIL From:addr =~ m{\@gmail\.com$}mi
meta L_NOTVALID_GMAIL !DKIM_VERIFIED && __L_FROM_GMAIL && !
__L_VIA_ML
priority L_NOTVALID_GMAIL 500
score L_NOTVALID_GMAIL 2.8
otoh, looking at a lot of mail, this is the only spam that hit that,
and it looks like it was a valid email of sorts, sent via gmail and
all, just with a spam message. I might leave it to google to deal
with :)
--
The fact that Bob and John are married does nothing to diminish
anyone else's marriage any more than a black woman marrying a
white man, a Jew marrying a Catholic, or an ugly Lyle marrying
a Pretty Woman
Re: Hrm, this spam is annoying
Posted by mouss <mo...@ml.netoyen.net>.
LuKreme a écrit :
> On 22-May-2009, at 11:10, Benny Pedersen wrote:
>> On Fri, May 22, 2009 08:41, LuKreme wrote:
>>>> dont whitelist *@gmail, if you need to whitelist, do it with full
>>>> email addy
>>> I don't whitelist gmail.
>>
>> there was user in def wl if i remember it
>
> There was:
>
> * -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM white-list
>
> Pls note the word *DEFAULT*
>
that means nothing.
check your system and find where def_whitelist_from_dkim is found.
> I do not have an local or user define DKIM whitlist settings.
Re: Hrm, this spam is annoying
Posted by LuKreme <kr...@kreme.com>.
On 22-May-2009, at 11:10, Benny Pedersen wrote:
> On Fri, May 22, 2009 08:41, LuKreme wrote:
>>> dont whitelist *@gmail, if you need to whitelist, do it with full
>>> email addy
>> I don't whitelist gmail.
>
> there was user in def wl if i remember it
There was:
* -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM white-
list
Pls note the word *DEFAULT*
I do not have an local or user define DKIM whitlist settings.
--
I think it would be fun to run a newspaper.
Re: Hrm, this spam is annoying
Posted by Benny Pedersen <me...@junc.org>.
On Fri, May 22, 2009 08:41, LuKreme wrote:
>> dont whitelist *@gmail, if you need to whitelist, do it with full
>> email addy
> I don't whitelist gmail.
there was user in def wl if i remember it
--
http://localhost/ 100% uptime and 100% mirrored :)
Re: Hrm, this spam is annoying
Posted by LuKreme <kr...@kreme.com>.
On 21-May-2009, at 13:29, Benny Pedersen wrote:
> On Thu, May 21, 2009 19:40, LuKreme wrote:
>> Gotten multiples of this spam on multiple accounts, include one that
>> ONLY gets spam.
>
> dont whitelist *@gmail, if you need to whitelist, do it with full
> email addy
I don't whitelist gmail.
--
Bishops move diagonally. That's why they often turn up where the
kings don't expect them to be.
Re: Hrm, this spam is annoying
Posted by Benny Pedersen <me...@junc.org>.
On Thu, May 21, 2009 19:40, LuKreme wrote:
> Gotten multiples of this spam on multiple accounts, include one that
> ONLY gets spam.
dont whitelist *@gmail, if you need to whitelist, do it with full email addy
--
http://localhost/ 100% uptime and 100% mirrored :)
Re: Hrm, this spam is annoying
Posted by d....@yournetplus.com.
Quoting LuKreme <kr...@kreme.com>:
> Scores 1.0 for me
>
> <http://home.kreme.com/spam20090521.txt>
>
> X-Spam-Report:
> * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server
> * [93.86.56.82 listed in dnsbl.sorbs.net]
> * -0.0 SPF_PASS SPF: sender matches SPF record
> * -3.3 USER_IN_DEF_DKIM_WL From: address is in the default DKIM white-list
> * -1.3 DKIM_VERIFIED Domain Keys Identified Mail: signature passes
> * verification
> * -1.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature
> * 0.0 HTML_MESSAGE BODY: HTML included in message
> * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
> * [score: 0.4986]
> * 0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
> * 2.2 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
> * 2.0 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
> * 1.7 SARE_HTML_IMG_ONLY FULL: Short HTML msg, IMG and A HREF, maybe
> * naught else
> * 0.0 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
> * -0.7 ENV_AND_HDR_DKIM_MATCH Env and Hdr From used in default DKIM WL
> * Match
>
> total of -6.3 if ham scores, sigh.
>
> Gotten multiples of this spam on multiple accounts, include one that
> ONLY gets spam.
Stock SA v3.2.5, no additional rules:
X-Spam-Status: Reqd:5.0 Hits:7.7 Learn:disabled
Tests:HTML_IMAGE_ONLY_04=1.462,
HTML_MESSAGE=0.001,HTML_SHORT_LINK_IMG_1=1.078,MPART_ALT_DIFF=1.143,
RCVD_IN_SORBS_WEB=1.117,SPF_PASS=-0.001,TVD_SPACE_RATIO=2.899