On Wed, Jul 27, 2005 at 03:48:22PM -0400, Jim Maul wrote:
> The Doctor wrote:
>
> <SNIP irate customer message>
> >
> >
> >All right, the short and simple is that Spam-Assassin may not be doing
> >the correct job. This user has a whitelist in place and
> >some e-mail are getting the label of spam.
> >
> >Even some of my cron jobs are getting a [SPAM] label when they should nt.
> >
> >Why?
> >
>
>
> Perhaps if you posted the headers of the messages that were marked as
> spam we can look to see what rules hit which would answer your "why?"
> question. Until then, no one knows that the problem is, and as such,
> wont be able to fix it.
>
> -Jim
Sample 1 from a cron job:
-------------------------------------------------------------------
From [EMAIL PROTECTED] Wed Jul 27 13:19:15 2005
Return-Path: <[EMAIL PROTECTED]>
Received: from doctor.nl2k.ab.ca ([EMAIL PROTECTED] [127.0.0.1])
by doctor.nl2k.ab.ca (8.13.4/8.13.4) with ESMTP id j6RJJ6BM011313
for <[EMAIL PROTECTED]>; Wed, 27 Jul 2005 13:19:06 -0600 (MDT)
Authentication-Results: doctor.nl2k.ab.ca [EMAIL PROTECTED]; sender-id=neutral;
spf=neutral
X-SenderID: Sendmail Sender-ID Filter v0.2.8 doctor.nl2k.ab.ca j6RJJ6BM011313
X-Spam-Filter: [EMAIL PROTECTED] by digitalanswers.org
Received: (from [EMAIL PROTECTED])
by doctor.nl2k.ab.ca (8.13.4/8.13.4/Submit) id j6RJJ31O011310;
Wed, 27 Jul 2005 13:19:03 -0600 (MDT)
Date: Wed, 27 Jul 2005 13:19:03 -0600 (MDT)
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED] (Cron Daemon)
To: [EMAIL PROTECTED]
Subject: [SPAM] Cron <[EMAIL PROTECTED]> /usr/bin/nice -20
/usr/home/cariwest/html/analog/analog
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/contrib/bin:/usr/X11/bin>
X-Virus-Scanned: ClamAV version 0.86.2, clamav-milter version 0.86 on
doctor.nl2k.ab.ca
X-Virus-Status: Clean
X-Spam-Flag: NO
X-Scanned-By: milter-7bit/0.7.101 (localhost.nl2k.ab.ca [0.0.0.0]); Wed, 27 Jul
2005 13:19:12 -0600
X-Scanned-By: milter-date/0.12.160 (localhost.nl2k.ab.ca [0.0.0.0]); Wed, 27
Jul 2005 13:19:12 -0600
X-Scanned-By: milter-spamc/0.25.321 (localhost.nl2k.ab.ca [0.0.0.0]); Wed, 27
Jul 2005 13:19:12 -0600
X-Spam-Status: NO, hits=-105.70 required=5.00
X-Spam-Level:
X-milter-date-PASS: YES
X-milter-7bit-Report: error=7bit octet=0x80 offset=74 line=2 position=11
X-milter-7bit-Pass: NO
Status: RO
Content-Length: 718
Lines: 13
/usr/home/cariwest/html/analog/analog: analog version 6.0/Unix
: Warning : Turning off empty Virtual Host Report
(For help on all errors and warnings, see docs/errors.html)
: Warning : Turning off empty Virtual Host Redirection Report
: Warning : Turning off empty Virtual Host Failure Report
: Warning : Turning off empty User Report
: Warning : Turning off empty User Redirection Report
: Warning : Turning off empty User Failure Report
&meta=: Warning : Turning off empty Internal Search Query Report
&meta=: Warning : Turning off empty Internal Search Word Report
: Warning : Turning off empty Processing Time Report
: Warning : In Redirected Referrer Report, turning off pie chart of only one
wedge
----------------------------------------------------------
Sample 2
Headers:
-----------------------------------------------------------------------------------
Subject: [SPAM: score=5.4/5.0] spam control and assorted issues
Date: Wed, 27 Jul 2005 11:28:31 -0600
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.6604 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
X-Virus-Scanned: ClamAV version 0.86.2, clamav-milter version 0.86 on
doctor.nl2k.ab.ca
X-Virus-Status: Clean
X-Spam-Flag: NO
X-Scanned-By: milter-7bit/0.7.101 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 11:24:55 -0600
X-Scanned-By: milter-date/0.12.160 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 11:24:55 -0600
X-Scanned-By: milter-spamc/0.25.321 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 11:24:33 -0600
X-Spam-Status: NO, hits=2.20 required=5.00
X-Spam-Level: xx
X-Mark-SPAM: YES, score=5.40/5.00, processed for 2.536s on doctor.nl2k.ab.ca
X-milter-date-PASS: YES
X-milter-7bit-Pass: YES
X-UIDL: efU!!CF,"!([EMAIL PROTECTED]"!
-------------------------------------------
Sample 3
Return-Path: <[EMAIL PROTECTED]>
Received: from web31112.mail.mud.yahoo.com (web31112.mail.mud.yahoo.com
[68.142.201.74])
by doctor.nl2k.ab.ca (8.13.4/8.13.4) with SMTP id j6RITs3q002842
for <[EMAIL PROTECTED]>; Wed, 27 Jul 2005 12:29:55 -0600 (MDT)
Authentication-Results: doctor.nl2k.ab.ca [EMAIL PROTECTED]; sender-id=neutral;
spf=neutral
X-SenderID: Sendmail Sender-ID Filter v0.2.8 doctor.nl2k.ab.ca j6RITs3q002842
X-Spam-Filter: [EMAIL PROTECTED] by digitalanswers.org
Received: (qmail 2762 invoked by uid 60001); 27 Jul 2005 18:29:48 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.ca;
h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=jNb6ZlAGsK61Cm70pIFaY97RHI9Dz0bNAd+7iBeofGT6ewl3ZPDs1/FENE0D0wlpK7OfXcMvE7B1hXsFA8kxj1TueHKlsRhpB6CvnBVd9ku9ZuyFCM7o2xAenD7mglq3QEdoqmEvIatKCnEATvvsvjWCAUt0k0+v7bejep5pICM=
;
Message-ID: <[EMAIL PROTECTED]>
Received: from [198.53.112.65] by web31112.mail.mud.yahoo.com via HTTP; Wed, 27
Jul 2005 14:29:48 EDT
Date: Wed, 27 Jul 2005 14:29:48 -0400 (EDT)
From: cat <[EMAIL PROTECTED]>
Subject: [SPAM: score=10.0/5.0] [SPAM] (5.00/5.00) Great Canadian website
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1852766230-1122488988=:2729"
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: ClamAV version 0.86.2, clamav-milter version 0.86 on
doctor.nl2k.ab.ca
X-Virus-Status: Clean
X-Spam-Flag: YES
X-Scanned-By: milter-7bit/0.7.101 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 12:30:10 -0600
X-Scanned-By: milter-date/0.12.160 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 12:30:10 -0600
X-Scanned-By: milter-spamc/0.25.321 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 12:30:07 -0600
X-Spam-Status: YES, hits=5.00 required=5.00
X-Spam-Level: xxxxx
X-Spam-Report: Spam detection software, running on the system
"doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
____
Content preview: Can you please fix the typo under the Corporate info?
My name is spelled Catriona Imray, not Imra. Thank you Catriona Do You
Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com [...]
____
Content analysis details: (5.0 points, 5.0 required)
____
pts rule name description
---- ---------------------- --------------------------------------------------
3.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.4039]
2.0 HTML_10_20 BODY: Message is 10% to 20% HTML
____
X-Mark-SPAM: YES, score=10.00/5.00, processed for 2.167s on doctor.nl2k.ab.ca
X-milter-date-PASS: YES
X-milter-7bit-Pass: YES
X-UIDL: bR!"!!60!!dk'!!gYH"!
------------------------------------------------------------
Sample 4:
------------------------------------------------------------
Return-Path: <[EMAIL PROTECTED]>
Received: from web30003.mail.mud.yahoo.com (web30003.mail.mud.yahoo.com
[68.142.200.66])
by doctor.nl2k.ab.ca (8.13.4/8.13.4) with SMTP id j6RDAPsQ028539
for <[EMAIL PROTECTED]>; Wed, 27 Jul 2005 07:10:28 -0600 (MDT)
Authentication-Results: doctor.nl2k.ab.ca [EMAIL PROTECTED]; sender-id=neutral;
spf=neutral
X-SenderID: Sendmail Sender-ID Filter v0.2.8 doctor.nl2k.ab.ca j6RDAPsQ028539
X-Spam-Filter: [EMAIL PROTECTED] by digitalanswers.org
Received: (qmail 54488 invoked by uid 60001); 27 Jul 2005 13:10:19 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=e73GXjAkmLVplFNlNr3enJNPEX5zAZS2R3ILGUf3XMIQ2LKPn+BWf1QRViZ82PDXT1Gybzv/UWkM2Jjtej2KLTUn6TWPc9ajiCbVEG3xL19CUlPSP8vTYVj3Qm/hDA2fJ6t2MwmEfGr2/oy9wQwUFfjSH3Rn1m1DS5dY/TLZcOk=
;
Message-ID: <[EMAIL PROTECTED]>
Received: from [81.133.40.123] by web30003.mail.mud.yahoo.com via HTTP; Wed, 27
Jul 2005 14:10:19 BST
Date: Wed, 27 Jul 2005 14:10:19 +0100 (BST)
From: iftekar <[EMAIL PROTECTED]>
Subject: [SPAM: score=11.0/5.0] [SPAM] (13.80/5.00) Re: [SPAM] (16.50/5.00)
Fwd: Fw: 9 Things I Hate About Everyone
To: Aboo Yadallee <[EMAIL PROTECTED]>
In-Reply-To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-239378778-1122469819=:53571"
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: ClamAV version 0.86.2, clamav-milter version 0.86 on
doctor.nl2k.ab.ca
X-Virus-Status: Clean
X-Spam-Flag: YES
X-Scanned-By: milter-7bit/0.7.101 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 07:11:03 -0600
X-Scanned-By: milter-date/0.12.160 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 07:11:03 -0600
X-Scanned-By: milter-spamc/0.25.321 (doctor.nl2k.ab.ca [204.209.81.1]); Wed, 27
Jul 2005 07:10:38 -0600
X-Spam-Status: YES, hits=13.80 required=5.00
X-Spam-Level: xxxxxxxxxxxxx
X-Spam-Report: Spam detection software, running on the system
"doctor.nl2k.ab.ca", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
____
Content preview: will try sending it again Aboo Yadallee <[EMAIL PROTECTED]>
wrote:I did not get the attachment. Chacha. ----- Original Message
----- From: iftekar To: Richard {RX~Welwyn} Sawyer ; Vishy Veeranna ;
Aboo Yadallee ; Wazir Ansaluth ; Stefan Barta ; Jane Browne ; Vashist
Deelchand ; Saleem Khodabaccus ; Nosizwe Mabuza ; James Moore ; Nassib
; Eshan Osman ; Neil [MEDGB] Pemberton ; Paolo rodriquez ; Krish
Runglall ; Jacqueline Russell Sent: Tuesday, July 26, 2005 8:34 AM
Subject: [SPAM] (16.50/5.00) Fwd: Fw: 9 Things I Hate About Everyone
[...]
____
Content analysis details: (13.8 points, 5.0 required)
____
pts rule name description
---- ---------------------- --------------------------------------------------
4.0 MAILTO_TO_SPAM_ADDR URI: Includes a link to a likely spammer email
3.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5585]
4.0 HTML_70_80 BODY: Message is 70% to 80% HTML
2.7 AWL AWL: From: address is in the auto white-list
____
X-Mark-SPAM: YES, score=11.00/5.00, processed for 25.087s on doctor.nl2k.ab.ca
X-milter-date-PASS: YES
X-milter-7bit-Pass: YES
X-UIDL: R1?!!HWn!!5+n!!1m?"!
------------------------------------------------------
All for now.
--
Member - Liberal International
This is [EMAIL PROTECTED] Ici [EMAIL PROTECTED]
God Queen and country! Beware Anti-Christ rising!
Better to serve in Heaven that to Rule in Hell.
