Re: low score on very spammy email

On 10 Apr 2018, at 18:28, Motty Cruz wrote: reject_rbl_client zen.spamhaus.org, reject_rbl_client cbl.abuseat.org, That is redundant. The Zen list includes the CBL and Spamhaus has taken over operation of the CBL so there's no lag time between them any more.

Re: low score on very spammy email

On 04/11/2018 11:14 AM, Matus UHLAR - fantomas wrote: On 04/10/2018 03:49 PM, Motty Cruz wrote: I apologize here is the email headers and body https://pastebin.com/bgXrfKaQ On 10.04.18 16:28, David Jones wrote: Content analysis details:   (16.0 points, 5.0 required) pts rule name   

Re: low score on very spammy email

Thank you all for your help, suggestions. per your suggestions MTA and SA tweaked and already seen a huge difference. Thanks again! On 04/11/2018 09:14 AM, Matus UHLAR - fantomas wrote: On 04/10/2018 03:49 PM, Motty Cruz wrote: I apologize here is the email headers and body https://pastebin.

Re: low score on very spammy email

On 04/10/2018 03:49 PM, Motty Cruz wrote: I apologize here is the email headers and body https://pastebin.com/bgXrfKaQ On 10.04.18 16:28, David Jones wrote: Content analysis details: (16.0 points, 5.0 required) pts rule name description -- ---

Re: low score on very spammy email

> Motty Cruz kirjoitti 10.4.2018 kello 23.49: > > I apologize here is the email headers and body > > https://pastebin.com/bgXrfKaQ > > Thanks, > > Oh my. X-Spam-Report: * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.] I’ll be damned :( s

Re: low score on very spammy email

On 04/10/2018 05:28 PM, Motty Cruz wrote: Thank you very much for your suggestions David. MTA is configured to use RBLs, reject_rbl_client b.barracudacentral.org worked really well for me at one point. Also, reject_rbl_client zen.spamhaus.org, reject_rbl_client cbl.abuseat.org,  

Re: low score on very spammy email

Thank you very much for your suggestions David. MTA is configured to use RBLs, reject_rbl_client b.barracudacentral.org worked really well for me at one point. Also, reject_rbl_client zen.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, rej

Re: low score on very spammy email

On 04/10/2018 05:04 PM, Leandro wrote: 2018-04-10 18:52 GMT-03:00 David Jones >: On 04/10/2018 04:47 PM, Leandro wrote: 2018-04-10 17:49 GMT-03:00 Motty Cruz mailto:motty.c...@gmail.com> >>:

Re: low score on very spammy email

2018-04-10 18:52 GMT-03:00 David Jones : > On 04/10/2018 04:47 PM, Leandro wrote: > >> 2018-04-10 17:49 GMT-03:00 Motty Cruz > motty.c...@gmail.com>>: >> >> I apologize here is the email headers and body >> >> https://pastebin.com/bgXrfKaQ >> >> >> >> You should not take this domain mrface

Re: low score on very spammy email

On 04/10/2018 04:47 PM, Leandro wrote: 2018-04-10 17:49 GMT-03:00 Motty Cruz >: I apologize here is the email headers and body https://pastebin.com/bgXrfKaQ You should not take this domain mrface.com seriously because it is a TLD used

Re: low score on very spammy email

2018-04-10 17:49 GMT-03:00 Motty Cruz : > I apologize here is the email headers and body > > https://pastebin.com/bgXrfKaQ You should not take this domain mrface.com seriously because it is a TLD used for free dynamic IP service (changeip.com). There is even a fake Windows Update domain in thi

Re: low score on very spammy email

On 04/10/2018 03:49 PM, Motty Cruz wrote: I apologize here is the email headers and body https://pastebin.com/bgXrfKaQ Thanks, Content analysis details: (16.0 points, 5.0 required) pts rule name description -- ---

Re: low score on very spammy email

I apologize here is the email headers and body https://pastebin.com/bgXrfKaQ Thanks, On 04/10/2018 01:40 PM, David Jones wrote: On 04/10/2018 03:34 PM, Motty Cruz wrote: Thanks for your help David, https://pastebin.com/wsYRfM8K That email is missing a lot of headers that are critical.  Pl

Re: low score on very spammy email

On 04/10/2018 03:34 PM, Motty Cruz wrote: Thanks for your help David, https://pastebin.com/wsYRfM8K That email is missing a lot of headers that are critical. Please post the entire email including the Received: headers. -Motty On 04/10/2018 01:22 PM, David Jones wrote: On 04/10/2018 0

Re: low score on very spammy email

Thanks for your help David, https://pastebin.com/wsYRfM8K -Motty On 04/10/2018 01:22 PM, David Jones wrote: On 04/10/2018 03:05 PM, Motty Cruz wrote: Thanks for your prompt reply: https://pastebin.com/bLy3Jcqt The Bayes setup looks good.  Can you put a lightly redacted version of that e

Re: low score on very spammy email

Thanks for you help! I'm trying to figure out why this email "get very low" score. Yes, Amavisd didn't stop it. I understand that, it is not part of the question here. I fed a lot of similar emails "learn spam" and still get very low score. It too thought it was permissions issues. On 04/10

Re: low score on very spammy email

On 04/10/2018 03:05 PM, Motty Cruz wrote: Thanks for your prompt reply: https://pastebin.com/bLy3Jcqt The Bayes setup looks good. Can you put a lightly redacted version of that email on pastbin.com so we can run it through our SA instances? Amavis should have blocked that message based on

Re: low score on very spammy email

Thanks for your prompt reply: https://pastebin.com/bLy3Jcqt Apr 10 11:51:44 vm1 postfix/qmgr[791]: 723EC1A1706: from=, size=16883, nrcpt=1 (queue active) Apr 10 11:51:46 vm1 amavis[1395]: (01395-01) Passed CLEAN {RelayedInbound}, [127.0.0.1] [171.61.147.96] -> , Message-ID: <1747601d3d0fc

Re: low score on very spammy email

On 04/10/2018 02:13 PM, Motty Cruz wrote: tons of spam fed to my spam-filter and yet very spammy emails get low score. zcat /var/virusmails/spam-G71jMeOxz-Ha.gz | less Return-Path: <> Delivered-To: spam-quarantine X-Envelope-From: X-Envelope-To: X-Envelope-To-Blocked: X-Quarantine-ID: X-Spa

Re: Low Score for @localhost domain

On Fri, 25 Jul 2014 13:39:46 -0300 Andre Luiz Paiz wrote: From: val...@iqm.unicamp.br There is no whitelist setting for @localhost, unless this is a default setting. On 26.07.14 01:54, RW wrote: But it's not from an address @localhost, it's from val...@iqm.unicamp.br you said it was loc

Re: Low Score for @localhost domain

On Fri, 25 Jul 2014 13:39:46 -0300 Andre Luiz Paiz wrote: > > From: val...@iqm.unicamp.br >There is no whitelist setting for @localhost, unless this is a default >setting. But it's not from an address @localhost, it's from val...@iqm.unicamp.br

Re: Low Score for @localhost domain

On Fri, 2014-07-25 at 13:39 -0300, Andre Luiz Paiz wrote: > Quoting Adi : > > W dniu 2014-07-25 14:07, Andre Luiz Paiz pisze: > > > I received a SPAM that Spamassassing gave a high negative score > > > (-86.0) to a e-mail message. I believe that is because the spammer > > > > Maybe you get -100 f

Re: Low Score for @localhost domain

On 25.07.14 09:07, Andre Luiz Paiz wrote: I received a SPAM that Spamassassing gave a high negative score (-86.0) to a e-mail message. I believe that is because the spammer altered the "From:" header field to: querercrer@localhost why did you whitelist localhost? This is exactly what happens w

Re: Low Score for @localhost domain

Quoting "Kevin A. McGrail" : On 7/25/2014 8:07 AM, Andre Luiz Paiz wrote: I tried to use the following rule (from Spamassassing guide), but it did not worked: header LOCAL_HEADER from =~ /@localhost/ [if-unset: @localhost] score LOCAL_HEADER -3.0 - Sample of the email on pastebin.com - Wha

Re: Low Score for @localhost domain

Quoting Adi : W dniu 2014-07-25 14:07, Andre Luiz Paiz pisze: Hi everybody, I received a SPAM that Spamassassing gave a high negative score (-86.0) to a e-mail message. I believe that is because the spammer Maybe you get -100 for whitelist ? Please check (or pastebin) mail headers (X-Spam*

Re: Low Score for @localhost domain

W dniu 2014-07-25 14:07, Andre Luiz Paiz pisze: > Hi everybody, > > I received a SPAM that Spamassassing gave a high negative score > (-86.0) to a e-mail message. I believe that is because the spammer Maybe you get -100 for whitelist ? Please check (or pastebin) mail headers (X-Spam*) or look in

Re: Low Score for @localhost domain

On 7/25/2014 8:07 AM, Andre Luiz Paiz wrote: I tried to use the following rule (from Spamassassing guide), but it did not worked: header LOCAL_HEADER from =~ /@localhost/ [if-unset: @localhost] score LOCAL_HEADER -3.0 - Sample of the email on pastebin.com - What rules hit already? Seriously,

Re: Low score on mail with typical spam content

On Tue, 26 Jul 2011 01:49:50 -0700 (PDT) Daniel Lemke wrote: > Ummh, thanks for the hint, copied the wrong sample :) (removed some > header information by myself to test something…) > This is the right one: http://pastebin.com/Cmu15YY2 BTW your local rule JAM_REPLACED_I_BD doesn't seem to be w

Re: Low score on mail with typical spam content

On Tue, 2011-07-26 at 01:49 -0700, Daniel Lemke wrote: > Ummh, thanks for the hint, copied the wrong sample :) (removed some header > information by myself to test something…) > This is the right one: http://pastebin.com/Cmu15YY2 > Exactly the same remarks (and identical score!) apply to this one

Re: Low score on mail with typical spam content

On Tue, 2011-07-26 at 00:21 -0700, Daniel Lemke wrote: > Hi there, > > A few days ago a mail passed our SpamAssassin and I was a bit surprised when > I looked at the mail content. > It does contain typical spam words like ‘drug’ etc. > Actually, it contains very little that might not appear in an

Re: Low score on mail with typical spam content

On Tue, 26 Jul 2011 00:21:16 -0700 (PDT) Daniel Lemke wrote: > > Hi there, > > A few days ago a mail passed our SpamAssassin and I was a bit > surprised when I looked at the mail content. > It does contain typical spam words like ‘drug’ etc. > Mail content can be found on pastebin: http://pasteb

Re: Low score on mail with typical spam content

Axb wrote: > > What's wrong in the word "drug"? > It's regularly used in medicine, science, press, etc. > If that's a "spam word" for you, nothing prevents you from writing a > rule to score that word.. (not really wise) > I accept that the word drug itself does not tag the mail as spam as the

Re: Low score on mail with typical spam content

On 2011-07-26 9:21, Daniel Lemke wrote: Hi there, A few days ago a mail passed our SpamAssassin and I was a bit surprised when I looked at the mail content. It does contain typical spam words like ‘drug’ etc. Mail content can be found on pastebin: http://pastebin.com/k8xptZbd If blacklist and B

Re: low score for ($1.5Million)

On 03/04/2011 04:11 PM, jdow wrote: > We, it IS a small number by Nigerian scam standards. So why not > a small score? > > - She ran that way FAST{O,o} Likewise, I also enjoy weekends: http://i.imgur.com/cxX6t.jpg (mildly NSFW, though it's on my cube)

Re: low score for ($1.5Million)

We, it IS a small number by Nigerian scam standards. So why not a small score? - She ran that way FAST {O,o} On 2011/03/03 16:40, Dennis German wrote: Can someone comment on the low score assigned to the email located at http://www.cccu.us/hundre

Re: low score for ($1.5Million)

On Fri, 2011-03-04 at 11:19 -0500, Dennis German wrote: > "while the OP uses" OP means ? Original Poster, he who started the thread. Depending on context, it also can mean Original Post. > Please direct me to info on FreeMail plugin. > Is it expected that I will be able to implement it given I

Re: low score for ($1.5Million)

"while the OP uses" OP means ? Original Poster.

Re: low score for ($1.5Million)

On 3/3/11 8:06 PM, Karsten Bräckelmann wrote: On Fri, 2011-03-04 at 01:53 +0100, Mikael Syska wrote: I get the following hits: Content analysis details: (19.1 points, 5.0 required) Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. Yes, I can tell this from the scores. :)

Supporting 3.3 and 3.2? (was: Re: low score for ($1.5Million))

On Thu, 2011-03-03 at 15:52 -1000, Warren Togami Jr. wrote: > On 3/3/2011 3:06 PM, Karsten Bräckelmann wrote: > > Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. > > Yes, I can tell this from the scores. :) > > > > Major changes between these version are clearly reflected

Re: low score for ($1.5Million)

On 3/3/2011 3:06 PM, Karsten Bräckelmann wrote: On Fri, 2011-03-04 at 01:53 +0100, Mikael Syska wrote: I get the following hits: Content analysis details: (19.1 points, 5.0 required) Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. Yes, I can tell this from the scores

Re: low score for ($1.5Million)

On Fri, 2011-03-04 at 01:53 +0100, Mikael Syska wrote: > I get the following hits: > Content analysis details: (19.1 points, 5.0 required) Note though, that your score is on SA 3.3.x, while the OP uses SA 3.2.x. Yes, I can tell this from the scores. :) Major changes between these version are cl

Re: low score for ($1.5Million)

On Thu, 2011-03-03 at 19:40 -0500, Dennis German wrote: > Can someone comment on the low score assigned to the email located at > > http://www.cccu.us/hundredThousand.txt > > X-Spam-testscores: AWL=1.086,BAYES_00=-2.599,HTML_MESSAGE=0.001, > MILLION_USD=1.528 > > Is my bayes "broken"? I'd

Re: low score for ($1.5Million)

On 03/03/2011 04:40 PM, Dennis German wrote: > Can someone comment on the low score assigned to the email located at > > http://www.cccu.us/hundredThousand.txt > > X-Spam-testscores: AWL=1.086,BAYES_00=-2.599,HTML_MESSAGE=0.001, > MILLION_USD=1.528 > > Is my bayes "broken"? Not "broken" so

Re: low score for ($1.5Million)

Hi, I get the following hits: Content analysis details: (19.1 points, 5.0 required) pts rule name description -- -- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, low

Re: Low Score - {Brazillian Host} Lottery Spam

On tir 27 okt 2009 18:27:24 CET, John Hardin wrote Contact me offlist if you want to install the sandbox rules for them, I'll give you instructions. undisclosed recipient with a freemail body hit if i won why would i not be in the to: :) -- xpoint

Re: Low Score - {Brazillian Host} Lottery Spam

On Tue, 27 Oct 2009, Adam Katz wrote: rich...@buzzhost.co.uk wrote: You Won £750,000.00 GBP {surprised this did not bite} Interesting. I'm also surprised that doesn't hit one of the many large-sum money checks. The existing ones are weak w/r/t non-USD currencies. That's one reason I star

Re: Low Score - {Brazillian Host} Lottery Spam

On Tue, 27 Oct 2009, rich...@buzzhost.co.uk wrote: Anyone else seeing these today? Or seen them recently? http://pastebin.com/m4e25954f I get lots like them. I'm working on updating the Advance Fee rules, but they won't be released until 3.3.1 In my testbed with sandbox rules, that got:

Re: Low Score - {Brazillian Host} Lottery Spam

rich...@buzzhost.co.uk wrote: > Anyone else seeing these today? Or seen them recently? > > http://pastebin.com/m4e25954f > > score=0.1 > > Subject was real neat: > Subject: =?ISO-8859-1?B?WW91IFdvbiCjMQ==?=,750,000.00 GBP > > You Won £750,000.00 GBP {surprised this did not bite} > > > End of

Re: Low score? Recommendations?

On man 05 okt 2009 20:30:09 CEST, "McDonald, Dan" wrote How often should I be running sa-update to pick up SOUGHT. I currently run it automatically once a day, and ad-hoc whenever I tweak any other rules. Should I run 4 times/day? 6? Inquiring minds want to know. first one would need to kno

Re: Low score? Recommendations?

On Mon, 2009-10-05 at 20:17 +0200, Karsten Bräckelmann wrote: > On Mon, 2009-10-05 at 11:01 -0700, Jefferson Davis wrote: > > Thanks for the tips and low-grade knuck-wrap. Investigating - > > installed 20_sought, tweaked local.cf back to 5.0 per list > > recommendation. > Just a minor nit, in c

Re: Low score? Recommendations?

On Mon, 5 Oct 2009, Jefferson Davis wrote: installed 20_sought There are actually two sought rulesets, one generated from a general spamtrap and one generated from hand-classified fraud corpora. You likely want both. If you set up sought in sa-update (which is what you should do as they ar

Re: Low score? Recommendations?

On Mon, 2009-10-05 at 11:01 -0700, Jefferson Davis wrote: > Thanks for the tips and low-grade knuck-wrap. Investigating - > installed 20_sought, tweaked local.cf back to 5.0 per list > recommendation. > > Appears that perhaps bayes_db is jacked up. re-training. All good. :) Just a minor nit,

Re: Low score? Recommendations?

- Message from jda...@standard.k12.ca.us - Date: Mon, 05 Oct 2009 09:32:39 -0700 From: Jefferson Davis Subject: Low score? Recommendations? To: users > Keep getting similar obvious (to me) spam - tuning recommendations? My > threshold is torqued down to 3.5 *** i

Re: Low score? Recommendations?

On Mon, 5 Oct 2009, Jefferson Davis wrote: Keep getting similar obvious (to me) spam - tuning recommendations? My threshold is torqued down to 3.5 X-SPAM-LEVEL: * X-SPAM-STATUS: No, score=1.1 required=3.5 tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOL

Re: Low score? Recommendations?

> Keep getting similar obvious (to me) spam - tuning > recommendations? My threshold is torqued down to 3.5 > > X-Spam-Level: * > X-Spam-Status: No, score=1.1 required=3.5 > tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOLLARS_3 > autolearn=no version=3.2.4 > Please don't send spam to the

Re: Low score? Recommendations?

On Mon, 2009-10-05 at 09:32 -0700, Jefferson Davis wrote: > Keep getting similar obvious (to me) spam - tuning recommendations? Bayes training. Sought [1] Fraud third-party rule-set. > My threshold is torqued down to 3.5 Don't. Do expect FPs with a required_score that low. > X-Spam-Status: N

Re: Low score

On Wed, Aug 12, 2009 at 08:53:51AM -0700, John Hardin wrote: > On Tue, 11 Aug 2009, Casartello, Thomas wrote: > >> Been getting a lot of low scoring stuff like this lately. Any suggestions? >> >> -Original Message- >> >> Reasons: This is due to the fact that we are in possession >> Of your

Re: Low score

On Tue, 11 Aug 2009, Casartello, Thomas wrote: Been getting a lot of low scoring stuff like this lately. Any suggestions? -Original Message- Reasons: This is due to the fact that we are in possession Of your Package containing a master card worth of five Hundred Thousand United State D

RE: Low score

nformation Technology Wilson 105A Westfield State College Red Hat Certified Technician (RHCT) -Original Message- From: --[ UxBoD ]-- [mailto:ux...@splatnix.net] Sent: Wednesday, August 12, 2009 8:02 AM To: Casartello, Thomas Cc: users@spamassassin.apache.org Subject: Re: Low score - "Th

Re: Low score

- "Thomas Casartello" wrote: > > > > Been getting a lot of low scoring stuff like this lately. Any suggestions? Please post the complete email to pastbin so we can run it through our own installations. It would help if you let us know which rules it actually hit on in your installation

RE: Low Score?

-Original Message- From: Karsten Bräckelmann [mailto:guent...@rudersport.de] Sent: Thursday, May 14, 2009 7:38 PM To: users@spamassassin.apache.org Subject: RE: Low Score? On Thu, 2009-05-14 at 18:54 -0400, Tony Bunce wrote: > Here are the scores and hits I am getting: > > x-spam-stat

RE: Low Score?

On Thu, 2009-05-14 at 18:54 -0400, Tony Bunce wrote: > Here are the scores and hits I am getting: > > x-spam-status: No, score=2.4 required=5.0 tests=DCC_CHECK,RCVD_IN_FIVETENSG, ^ Hits on 50% of your HAM, doesn't it? ht

RE: Low Score?

> So.. What score are you seeing? What version of spamassassin are you > running? What is your spam level set at? Here are the scores and hits I am getting: x-spam-status: No, score=2.4 required=5.0 tests=DCC_CHECK,RCVD_IN_FIVETENSG, RCVD_IN_FIVETENSG_SUSPECT,SPF_HELO_PASS,SPF_PASS autol

Re: Low Score?

At 02:05 PM 5/14/2009, you wrote: Maybe on your part. I see all those headers there at the URL. :-) http://rafb.net/p/fcy9wY66.html No Adam's saying when I grabbed the OP's pastebin's, I ... err pooched it. So I fed messages with no headers to SpamAssassin. :)

Re: Low Score?

At 01:53 PM 5/14/2009, you wrote: That looks a lot like a botched paste. You're missing *every* header. Ecch. You're right. I'm going back to sleep - err once I leave work. I did a wget of the pastebin URL, then parsed that to SA. Didn't even look at the wget results :-D

Re: Low Score?

Adam Katz wrote: Evan Platt wrote: 0.0 MISSING_MIDMissing Message-Id: header 0.0 MISSING_DATE Missing Date: header 0.2 URIBL_GREY Contains an URL listed in the URIBL greylist [URIs: magnetmail1.net] -0.0 NO_RELAYS

Re: Low Score?

Evan Platt wrote: > 0.0 MISSING_MIDMissing Message-Id: header > 0.0 MISSING_DATE Missing Date: header > 0.2 URIBL_GREY Contains an URL listed in the URIBL greylist > [URIs: magnetmail1.net] > -0.0 NO_RELAYS Informational:

Re: Low Score?

At 12:27 PM 5/14/2009, you wrote: Evan: I'd be interested to see what bumped that last one up for you. Are you using the botnet plugin perhaps? I'm pretty sure I disabled botnet... I don't actively run SA on this server, but keep it installed and (try to) up to date ..My server that relays

Re: Low Score?

Tony Bunce wrote and Evan Platt scored: >> Anyone have any tips on what would make these score higher? >> http://pastebin.com/m41d3437a > > Scored a 5.4 Content analysis details: (7.7 points, 5.0 required) pts rule name description --- ---

Re: Low Score?

At 11:06 AM 5/14/2009, you wrote: I am starting to see more messages than usual get through our spam filters. Anyone have any tips on what would make these score higher? http://pastebin.com/m41d3437a Scored a 5.4 http://pastebin.com/d626a4352 7.3 http://pastebin.com/m14c73cab 6.9 So.

Re: low score spam

On Wednesday 23 August 2006 00:48, yossim wrote: > Hello John, > > Thanks for your quick response. > > I am not sure that i understand your answer. Sorry i am not so experinece > with SA. > > The score that i got for that specific example was: > > score=0.395,required 6.2, > BAYES_20 -0.74, FORGED

Re: low score spam

Hello John, Thanks for your quick response. I am not sure that i understand your answer. Sorry i am not so experinece with SA. The score that i got for that specific example was: score=0.395,required 6.2, BAYES_20 -0.74, FORGED_RCVD_HELO 0.14,HTML_MESSAGE 1.00) There are many calculation pa

Re: low score spam

Well even your message scored pretty high here. Were this mailing list not whitelisted, it would have gone to /dev/null Maybe you should turn on Network tests and configure Razor? On Tuesday 22 August 2006 23:24, yossim wrote: > Spam detection software, running on the system "pen.homeip.net",