Or rather, it won't block anything that isn't specifically on a blacklist. Almost every bit of spam mail goes right through. I have the following in my dnsbls.txt file:
*zen.spamhaus.org=>1|bb.barracudacentral.org=>2|bl.spamcop.net=>1.1|safe.dnsbl.sorbs.net=>2|ix.dnsbl.manitu.net=>1.5|combined.njabl.org=>2|bogons.cymru.com=>3|db.wpbl.info=>2|dnsbl-1.uceprotect.net=>1.5|psbl.surriel.com=>2|dnsbl-2.uceprotect.net=>4* When I analyze a specific spam email, it often will acknowledge it's listed on one of the above blacklists and has a high spam probability, but it still passes and gets sent to the /notspam folder. Here is one such example: */Analyzed file is /usr/share/assp/notspam/Step_into_a_new_pair_of_stylis--1479848.eml analyze is restricted to a maximum length of 11236 bytes attachments will be fully scanned for viruses Connecting IP: '23.89.198.8' Connecting HELO: shijue200.com •no foreign received header line found sender and reply addresses: From: sand...@shijue200.com Reply-To: nore...@shijue200.com recipient addresses: To: user@(our server) NotSpamTag: a possible NotSpamTag for this mail is : aariH4Xt4Q Feature Matching: • Whitelisted Domains: '(our server)' • Whitelisted Domains: '(our server)' • DKIM-check returned OK verified-OK • SPF-check returned OK for 23.89.198.8 -> sand...@shijue200.com, shijue200.com • Received-SPF: pass (shijue200.com: 23.89.198.8 is authorized to use 'sand...@shijue200.com' in 'mfrom' identity (mechanism 'ip4:23.89.198.8' matched)) receiver=ASSP.(our server).com; identity=mailfrom; envelope-from="sand...@shijue200.com"; helo=shijue200.com; client-ip=23.89.198.8 • BombHeader RE: 'highest match: "0 Jul 2014 15:27:05 -0400" with valence: 25 - PB value = 52' • matching bombHeaderRe(): 'DKIM-Signature' • BombSuspiciousRe RE: 'highest match: "List-Unsubscribe:" with valence: -4 - PB value = -4' • matching bombSuspiciousRe(file:files/suspiciousre.txt[line 1]): 'List-Unsubscribe\: , List-Unsubscribe\:' • URIBL check: 'OK' • Valid Format of HELO: 'shijue200.com' • IP in Helo check: 'OK' • RBLCheck returned OK for 23.89.198.8: • 23.89.198.8 is in CountryCache: status=changed to black country, data=US, ENZU, , , , 15 Bayesian Analysis: - word stemming engine is used - language french detected Bad Words Bad Prob href href 0.9998 linkedimag href 0.9902 for this 0.9737 this email 0.9737 Good Words Good Prob for your 0.2373 ssub of 0.3750 of ssub 0.3750 ssub ssub 0.3791 Bayesian Spam Probability: combined probability: 1.00000000 - got 9 - used 40 most significant results/* I really need to figure this out quick! Thanks in advance. -- View this message in context: http://anti-spam-smtp-proxy-server.996265.n3.nabble.com/ASSP-not-blocking-ANY-spam-tp38829.html Sent from the assp-user mailing list archive at Nabble.com. ------------------------------------------------------------------------------ Infragistics Professional Build stunning WinForms apps today! Reboot your WinForms applications with our WinForms controls. Build a bridge from your legacy apps to the future. http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk _______________________________________________ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
