I have a couple of questions concerning the below header information.
This is a spam that one of my users received this morning. My questions
pertain to the rule scores. First question, this spam hit on the
SARE_ADULT2 BODY rule but it only received a score of 1.0. I assume
this rule is looking for any porn spam so I would expect if an email hit
on this rule it would score higher. Can I change the score for that
rule? If so, do I just add a line in the local.cf file like so?
SARE_ADULT2 BODY 8.0
If not how would I increase the score for that rule on incoming emails?
Second question, in local.cf I have a line that reads:
BAYES_99 10.0
I had assumed that line to mean that any email hitting on the BAYES_99
rule would receive a score of 10.0, but as you can see this email only
received a score of 3.5 on that rule. Why? What can I do to make sure
emails that hit on this rule will receive the 10.0 score that I had
indicated in the local.cf file?
Microsoft Mail Internet Headers Version 2.0
Received: from dellapp02.occa.state.ok.us ([204.87.111.225]) by
MXI.occa.state.ok.us with Microsoft SMTPSVC(5.0.2195.6713);
Mon, 26 Feb 2007 09:18:04 -0600
Received: (qmail 1580 invoked by uid 507); 26 Feb 2007 15:12:52 -0000
Received: by simscan 1.2.0 ppid: 1565, pid: 1574, t: 4.4124s
scanners: attach: 1.2.0 clamav: 0.88.4/m:40/d:2106 spam: 3.1.5
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.5 (2006-08-29) on
dellapp02.occa.state.ok.us
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.8 required=5.0 tests=BAYES_99,INFO_TLD,
JR_RCVD_TOO_FEW_HOPS,SARE_ADULT2 autolearn=no version=3.1.5
X-Spam-Report:
* 1.0 JR_RCVD_TOO_FEW_HOPS Just one hop means direct untrusted client
* 1.0 SARE_ADULT2 BODY: Contains adult material
* 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
Received: from unknown (HELO c951847d.virtua.com.br) (201.81.132.125)
by dellapp02.occa.state.ok.us with SMTP; 26 Feb 2007 15:12:48 -0000
Received-SPF: none (dellapp02.occa.state.ok.us: domain at
gibbsnorwalk.com does not designate permitted sender hosts)
Date: Mon, 26 Feb 2007 10:32:00 -0600
From: Silas Lacey <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> >
Reply-To: Silas Lacey <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> >
Message-ID: <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> >
To: <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> >
Subject: Lustful babe blows a dick %) to orgasm
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-Path: [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>
X-OriginalArrivalTime: 26 Feb 2007 15:18:04.0657 (UTC)
FILETIME=[4FD59E10:01C759B9]
Thanks for your help,
Steve
