Fran Fabrizio wrote:
> We've been running SpamAssassin on a Fedora server successfully for
> about a year now. About a month ago, we all noticed a spike in the
> number of spam getting through. I upgraded to 3.1.0 but that does not
> seem to help. I'm beginning to suspect that some local database or
> the learning has somehow gone awry. Here a sample score from an
> obvious spam...
>
> ----------
> Subject: Investment Ideas
> X-Spam-Status: No, hits=-1.098 tagged_above=-999 required=2
> tests=BAYES_00, RCVD_NUMERIC_HELO, UNPARSEABLE_RELAY
>
> Lots of similar spam is getting through. Is this an example of where
> they have just figured out a way through the tests, or do I have a
> local database or learning system that needs retraining? I've got
> SpamAssassin to check Razor and DCC, you'd have thought those tests
> would hit but I guess not. :-/
It looks like you have a Bayes problem. These spams score at least BAYES_90
here:
OUR OCTOBER HOT PICK IS: CWTD.
SYMBOL: CWTD
CURRENT PRICE: $2.07
5 Day Target: $5
WE GIVE IT TO YOU AS A GIFT AND THIS IS WHY !!!
*************PRESS RELEASE*****************PRESS RELEASE*************
China World Trade Corporation Attends The World Trade Centers Association's
36th General Assembly in Shanghai
...
Content analysis details: (6.6 points, 6.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 PT_CWORDS Subject contains command verb
2.0 FROM_M2 relayed from mail2 when mail1 is up
2.1 BAYES_90 BODY: Bayesian spam probability is 90 to 99%
[score: 0.9313]
2.0 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
If you don't use DCC, check it out. But the main thing will be getting Bayes
fixed.
It might require deleting the whole DB and re-training.
Good luck
Pierre
