This is driving me nutty! There has been nothing new in my spamfolders for the past 3 days, everything is passing through. Something is terribly messed up. I'd love to know if it's the new ASSP builds or me going crazy. There are missing headers, missing lines in the log, nothing adds up.
I wanted to attach a sample, but SourceForge blocked it for spam. At least someone thinks this message is spam! Instead, I uploaded the full text here: http://www.norelid.com/spamsample.txt Included here is also a complete log sample from that attached spam. The mail headers indicate that is was tested for BombHeaderRe (fail?), SPF (neutral), DNSBL (fail), BombRaw (pass), Bayes (0.98574) and is given a Spam Prob of 0. The log lines, however, tell a different story. It says it was tested for BombHeader (matched ''?), MissingMXA (pass?), BombRaw, URIBL (pass), ClamAv, and Bayes (0.98574) and is given confident.spam. But then the last line says message ok??? What is causing this odd discrepancy? Everything is passing ASSP currently, it has not blocked a message in days! Jul-21-07 14:45:47 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jul-21-07 14:45:48 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] scoring Regex:BombHeader '' Jul-21-07 14:45:48 [BombHeader] 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] Message-Score: 0+18 (BombHeaderRe) Jul-21-07 14:45:49 [MissingMXA][pass] 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] scoring PTR missing for 85.101.111.62 Jul-21-07 14:45:49 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] scoring Regex:BombRaw 'pharmac' Jul-21-07 14:45:49 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] URIBL scoring Received-URIBL: pass Jul-21-07 14:45:49 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] ClamAV: scanning 1856 bytes done OK Jul-21-07 14:45:49 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] Bayesian Check Prob: 1.00000 / Confidence: 0.98574 => confident.spam Jul-21-07 14:45:49 [MessageOK] 85.101.111.62 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] message ok ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
