The mail analyzer was very upset with the false negatives I fed it. It had nothing but mean things to say about them.
I upgraded to 1.3.4(10) and another spam came right through. The symptoms are the same: Lots of failed high-scoring tests (BombRe and RBL should be enough to kill it), tons of missing headers (no assp version, total score), and the analyzer hates it. Included are the headers from the newest false negative. Most of the body is cut off, but I just really love the professional copy in the first lines. Return-path: <[EMAIL PROTECTED]> Envelope-to: [EMAIL PROTECTED] Delivery-date: Sat, 21 Jul 2007 05:03:02 -0500 Received: from [127.0.0.1] (port=44062 helo=static.ryazan.ru) by yams.urigubu.com with smtp (Exim 4.66) (envelope-from <[EMAIL PROTECTED]>) id 1ICBnh-00011Y-JQ for [EMAIL PROTECTED]; Sat, 21 Jul 2007 05:03:02 -0500 Received: from static.ryazan.ru ([212.26.251.15] helo=static.ryazan.ru) by yams.urigubu.com; 21 Jul 2007 05:02:55 -0500 Message-ID: <[EMAIL PROTECTED]> From: "natural treatment" <[EMAIL PROTECTED]> TO: <[EMAIL PROTECTED]> Subject: Last Long - really long Date: Sat, 21 Jul 2007 09:48:52 +0300 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express Macintosh Edition - 5.01 (1630) X-MimeOLE: Produced By Microsoft MimeOLE V X-Assp-Received-RWL: not listed (yams.urigubu.com: local policy) rwl=none; client-ip=212.26.251.15 X-Assp-Re-BombHeader: X-Assp-Score: 18 (BombHeaderRe) X-Assp-Received-SPF: neutral (yams.urigubu.com: local policy) client-ip=212.26.251.15; [EMAIL PROTECTED]; helo=static.ryazan.ru; X-Assp-Received-DNSBL: fail (bl.spamcop.net->127.0.0.2; zen.spamhaus.org->127.0.0.4; ) X-Assp-Re-BombRaw: herbal X-Assp-Received-URIBL: pass Hallo Mr. , natural treatment Does this sound familar - please dont come yet... please..oh god..no...no..no..yes..yes.. SHIT I came... Not again... Kevin wrote: > David wrote: > >> I got a deluge of spam in my inboxes today. Something isn't right with >> ASSP's scoring for some reason: >> >> What happened here? It failed RBL, URIBL, BombHeaderRe, and got high >> Bayes score, but it still passed. That score should have obliterated the >> message. I don't see anything about npip, whitelist, or testmode. Using >> 1.3.2(53). Is 1.3.4 the preferred build now? I see both are still >> updated daily. >> >> > > What does the Analyzer tell you? > > Kevin > > ------------------------------------------------------------------------- > This SF.net email is sponsored by: Microsoft > Defy all challenges. Microsoft(R) Visual Studio 2005. > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ > _______________________________________________ > Assp-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/assp-user > ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
