It looks like a logic was inverted between lines 13161 and 13195 it let a spam pass because 78 is lower than 50
2009-10-24 11:30:47 id-91045-19286 [MessageScore] 74.52.6.58 <[email protected]> to: [email protected] [spam found] -- passing because messagescore(78) did not reach limit ( 50) -- [Prepare se para a Nota Fiscal Eletr nica] -> /usr/local/assp/discarded/Prepare_se_para_a_Nota_Fiscal_--4.eml Hope this helps Fochi P.S. Lines bellow are the complete headers and log lines. X-Assp-Delay: [email protected] was delayed for 4h 13m 59s; 24 Oct 2009 11:30:45 -0200 X-Assp-Score: 7 (Extreme Bad History for 74.52.6.58) X-Assp-Re-bombHeaderRe: emailmkt X-Assp-Score: 10 (BombHeaderRe 'emailmkt') X-Assp-Score: 13 (DNSBL: neutral, 74.52.6.58 listed in b.barracudacentral.org) X-Assp-DNSBL: neutral, 74.52.6.58 listed in (b.barracudacentral.org<-127.0.0.2; ) X-Assp-Received-SPF: none (cache) ip=74.52.6.58 [email protected] helo=server.nssoftwares.com.br X-Assp-Re-bombSuspiciousRe: sair desta lista X-Assp-Re-bombSuspiciousRe: clique aqui X-Assp-Score: 7 (BombSuspiciousMailFrom 'sair desta lista') X-Assp-Re-bombRe: emailmkt X-Assp-Score: 10 (BombRaw: 'emailmkt') X-Assp-Score: 31 (Bayesian Probability: 1.0000) X-Assp-Version: 1.6.0(0.3.07) X-Assp-ID: server.mydomain.com (id-91045-19286) X-Assp-Spam: Probably X-Assp-Original-Subject: Prepare se para a Nota Fiscal Eletr nica X-Assp-Block: NO (MessageScoring Lower Limit) X-Assp-Spam-Status: YES X-Assp-Spam-Reason: MessageScore over low limit X-Assp-Message-Totalscore: 78 2009-10-24 11:30:45 [email protected] matches [email protected] in LocalAddresses_Flat 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> accepting triplet: (74.52.6.0,[email protected],[email protected]) waited: 4h 13m 59s 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] recipient accepted: [email protected] 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 7 (Extreme Bad History for 74.52.6.58), total score for this message is now 7 2009-10-24 11:30:45 id-91045-19286 [bombHeaderRe] 74.52.6.58 <[email protected]> to: [email protected] score 10 for 'emailmkt', regex-total 10 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] score 10 Regex:bombHeaderRe 'emailmkt' 2009-10-24 11:30:45 id-91045-19286 [BombHeader] 74.52.6.58 <[email protected]> to: [email protected] [scoring] -- BombHeaderRe 'emailmkt' -- [Prepare se para a Nota Fiscal Eletr nica] 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 10 (BombHeaderRe 'emailmkt'), total score for this message is now 17 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] deleting spamming safelisted tuplet: (74.52.6.0,nssoftwares.com.br) age: 0s 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 10 (BombHeaderRe 'emailmkt'), total score for IP '74.52.6.58' is now 448 2009-10-24 11:30:45 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] SenderBase(Cache) -- country:US orgname:THEPLANET.COM INTERNET SERVICES 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 13 (DNSBL: neutral, 74.52.6.58 listed in b.barracudacentral.org), total score for this message is now 30 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 13 (DNSBL: neutral, 74.52.6.58 listed in b.barracudacentral.org), total score for IP '74.52.6.58' is now 461 2009-10-24 11:30:46 id-91045-19286 [DNSBL] 74.52.6.58 <[email protected]> to: [email protected] [scoring] -- DNSBL: neutral, 74.52.6.58 listed in (b.barracudacentral.org<-127.0.0.2; ) -- [Prepare se para a Nota Fiscal Eletr nica] 2009-10-24 11:30:46 id-91045-19286 [bombSuspiciousRe] 74.52.6.58 <[email protected]> to: [email protected] score 5 for 'sair desta lista', regex-total 5 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] score 5 Regex:bombSuspiciousRe 'sair desta lista' 2009-10-24 11:30:46 Info: weighted regex (bombSuspiciousRe) result found for clique aqui - weight is 0.4 2009-10-24 11:30:46 id-91045-19286 [bombSuspiciousRe] 74.52.6.58 <[email protected]> to: [email protected] score 2 for 'clique aqui', regex-total 7 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] score 2 Regex:bombSuspiciousRe 'clique aqui' 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 7 (BombSuspiciousMailFrom 'sair desta lista'), total score for this message is now 37 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 7 (BombSuspiciousMailFrom 'sair desta lista'), total score for IP '74.52.6.58' is now 468 2009-10-24 11:30:46 id-91045-19286 [bombRe] 74.52.6.58 <[email protected]> to: [email protected] score 10 for 'emailmkt', regex-total 10 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] score 10 Regex:bombRe 'emailmkt' 2009-10-24 11:30:46 id-91045-19286 [bombRe] 74.52.6.58 <[email protected]> to: [email protected] [scoring] -- BombRaw: 'emailmkt' -- [Prepare se para a Nota Fiscal Eletr nica] 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 10 (BombRaw: 'emailmkt'), total score for this message is now 47 2009-10-24 11:30:46 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 10 (BombRaw: 'emailmkt'), total score for IP '74.52.6.58' is now 478 2009-10-24 11:30:47 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] [scoring] Bayesian Check - Prob: 1.00000 => spam 2009-10-24 11:30:47 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 31 (Bayesian Probability: 1.0000), total score for this message is now 78 2009-10-24 11:30:47 id-91045-19286 74.52.6.58 <[email protected]> to: [email protected] added 31 (Bayesian Probability: 1.0000), total score for IP '74.52.6.58' is now 509 2009-10-24 11:30:47 id-91045-19286 [MessageScore] 74.52.6.58 <[email protected]> to: [email protected] [spam found] -- passing because messagescore(78) did not reach limit ( 50) -- [Prepare se para a Nota Fiscal Eletr nica] -> /usr/local/assp/discarded/Prepare_se_para_a_Nota_Fiscal_--4.eml ------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference _______________________________________________ Assp-test mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-test
