Hello All , My main ? is how was this (see below(*)) email being caught by
the FH_DATE_PAST_20XX . I've run the sa_update repeatedly (of course that
was useless as crontab had already ran) and with '-D' & I had a newer branch
than requested in the email . So far this is the only one I've been able to
find being caught by the FH_DATE_PAST_20XX check .
running
spamd -V
SpamAssassin Server version 3.2.5
running on Perl 5.8.8
with SSL support (IO::Socket::SSL 1.07)
with zlib support (Compress::Zlib 2.008)
No other installed libraries or anything just spamassassin served defines .
# dir /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
100 -rw-r--r-- 1 root root 96464 2010-01-02 11:30
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
# find /var/lib/spamassassin/3.002005/updates_spamassassin_org -type f
-print0 | xargs --null -n1 grep -C2 -Hi FH_DATE_PAST_20XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_BAD_OEV1441 0.974 2.393 2.440 2.401 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_DATE_IS_19XX 1.947 1.970 2.512 2.199 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf:score
FH_DATE_PAST_20XX 2.075 3.384 3.554 3.188 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_FAKE_RCVD_LINE 2.230 2.215 2.670 2.470 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf-score
FH_FROMEML_NOTLD 2.699 2.196 2.699 2.696 # n=2
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-##}
FH_DATE_IS_19XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:##{
FH_DATE_PAST_20XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:header
FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:describe
FH_DATE_PAST_20XX The date is grossly in the future.
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf:##}
FH_DATE_PAST_20XX
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf-##{
FH_FAKE_RCVD_LINE
(*)
>From nore...@congressnewsletter.net Sun Jan 3 15:50:27 2010
Received: from localhost by filesrv1.baby-dragons.com
with SpamAssassin (version 3.2.5);
Sun, 03 Jan 2010 15:50:28 -0900
From: nore...@congressnewsletter.net
To: j...@system-techniques.com
Subject: Thank you for your input from http://fleming.house.gov/.
Date: Sun, 3 Jan 2010 16:45:43 -0800 (GMT-08:00)
Message-Id: <21471470.2465431262565943531.javamail.sys...@dchouse01>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
filesrv1.baby-dragons.com
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.3 required=5.0 tests=BAYES_50,FH_DATE_PAST_20XX,
HELO_LOCALHOST,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,SPF_SOFTFAIL
autolearn=no version=3.2.5
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_4B413B54.F9E24CA9"
This is a multi-part message in MIME format.
------------=_4B413B54.F9E24CA9
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "filesrv1.baby-dragons.com",
has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
ab...@baby-dragons.com for details.
Content preview: Thank you for your input. [...]
Content analysis details: (9.3 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
3.9 HELO_LOCALHOST HELO_LOCALHOST
3.2 FH_DATE_PAST_20XX The date is grossly in the future.
0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5000]
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_4B413B54.F9E24CA9
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Return-Path: <j...@baby-dragons.com>
Received: from filesrv1.baby-dragons.com (localhost [127.0.0.1])
by filesrv1.baby-dragons.com (8.13.7/8.13.8) with ESMTP id
o040oQiv029147
for <bab...@localhost>; Sun, 3 Jan 2010 15:50:26 -0900
Received: from 64.62.236.141 [64.62.236.141]
by filesrv1.baby-dragons.com with IMAP (fetchmail-6.3.11)
for <bab...@localhost> (single-drop); Sun, 03 Jan 2010 15:50:26
-0900 (AKST)
Received: from localhost (ns3.baby-dragons.com [64.62.236.141])
by ns3.baby-dragons.com (8.13.8/8.13.8) with ESMTP id o040mwF4032405
for <bab...@baby-dragons.com>; Mon, 4 Jan 2010 00:48:59 GMT
X-Return-Path: <nore...@congressnewsletter.net>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
filesrv1.baby-dragons.com
X-Spam-Level:
X-Spam-Status: No, score=0.7 required=5.0 tests=BAYES_50,FH_DATE_PAST_20XX,
HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,RCVD_IN_DNSWL_MED,SPF_PASS
autolearn=no version=3.2.5
X-Received: from filesrv1.baby-dragons.com (localhost [127.0.0.1])
by filesrv1.baby-dragons.com (8.13.7/8.13.8) with ESMTP id
o040BjcC028611
for <j...@localhost>; Sun, 3 Jan 2010 15:11:45 -0900
X-Received: from 64.62.236.141 [64.62.236.141]
by filesrv1.baby-dragons.com with IMAP (fetchmail-6.3.11)
for <j...@localhost> (single-drop); Sun, 03 Jan 2010 15:11:45 -0900
(AKST)
X-Received: from pavo.house.gov (pavo.house.gov [143.228.150.140])
by ns3.baby-dragons.com (8.13.8/8.13.8) with ESMTP id o0409Emf032166
for <j...@system-techniques.com>; Mon, 4 Jan 2010 00:09:14 GMT
X-Received: from DCHOUSE01 (dchouse01.house.gov [143.228.239.187])
by pavo.house.gov with ESMTP id o03JIY2Z017760
for <j...@system-techniques.com>; Sun, 3 Jan 2010 18:49:18 -0500
Date: Sun, 3 Jan 2010 16:45:43 -0800 (GMT-08:00)
From: nore...@congressnewsletter.net
To: j...@system-techniques.com
Message-ID: <21471470.2465431262565943531.javamail.sys...@dchouse01>
Subject: Thank you for your input from http://fleming.house.gov/.
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: ColdFusion 8 Application Server
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3
(filesrv1.baby-dragons.com [0.0.0.0]); Sun, 03 Jan 2010 15:50:27 -0900
(AKST)
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3
(ns3.baby-dragons.com [64.62.236.141]); Mon, 04 Jan 2010 00:48:59 +0000
(UTC)
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3
(filesrv1.baby-dragons.com [0.0.0.0]); Sun, 03 Jan 2010 15:11:45 -0900
(AKST)
X-Greylist: Delayed for 00:19:39 by milter-greylist-4.2.3
(ns3.baby-dragons.com [64.62.236.141]); Mon, 04 Jan 2010 00:09:15 +0000
(UTC)
ReSent-Date: Sun, 3 Jan 2010 15:48:55 -0900 (AKST)
ReSent-From: "James W. Laferriere" <j...@baby-dragons.com>
ReSent-To: "James W. Laferriere" <bab...@baby-dragons.com>
ReSent-Subject: Thank you for your input from http://fleming.house.gov/.
ReSent-Message-ID:
<alpine.lnx.2.01.1001031548550.29...@filesrv1.baby-dragons.com>
ReSent-User-Agent: Alpine 2.01 (LNX 1184 2008-12-16)
Thank you for your input.
------------=_4B413B54.F9E24CA9--
--
View this message in context:
http://old.nabble.com/FH_DATE_PAST_20XX-tp26983175p27007851.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
