Hi,
I got a spam mail (recognized as such by SA 2.20) but the matching tests
lack one which recognizes the body of the mail containing almost only
characters > 128.
CHARSET_FARAWAY_HEADERS and SUBJ_FULL_OF_8BITS are triggered by this mail
but shouldn't there be a matching test for the body of this mail?
From former looks at SA code I think some test which uses
are_more_high_bits_set() should have triggered.
'spamassassin -tD' says this:
debug: using "/usr/pkg/share/spamassassin" for default rules dir
debug: using "/usr/pkg/etc/spamassassin" for site rules dir
debug: using "/home/heinz/.spamassassin" for user state dir
debug: using "/home/heinz/.spamassassin/user_prefs" for user prefs file
debug: running header regexp tests; score so far=0
debug: decoded MIME header: "*****SPAM*****牛股网诚招各地业务联络处"
[ repeated 13 times ]
debug: decoded MIME header: "*****SPAM*****牛股网诚招各地业务联络处"
debug: running body-text per-line regexp tests; score so far=0.6
debug: running uri tests; score so far=0.6
debug: running raw-body-text per-line regexp tests; score so far=0.6
debug: running full-text regexp tests; score so far=0.2
debug: Razor is not available
debug: trying Received header date for real time: Sun, 21 Apr 2002 13:33:42
+0200
debug: trying Received header date for real time: Sun, 21 Apr 2002 11:03:02
+0200
debug: trying Received header date for real time: Sun, 21 Apr 2002 11:03:02
+0200
debug: trying Received header date for real time: Sun, 21 Apr 2002 00:13:25
+0200
debug: trying Received header date for real time: Sun, 21 Apr 2002 00:13:25
+0200
debug: time_t from date=1019398306, rcvd=1019403222, diff=4916
debug: within time range, not raising flag
debug: is Net::DNS::Resolver unavailable? 0
debug: looking up MX for 'microsoft.com.'
debug: MX for 'microsoft.com.' exists? 0
debug: is DNS available? 0
debug: checking RBL orbs.dorkslayers.com., set relay
debug: checking RBL relays.osirusoft.com., set relay
debug: checking RBL relays.ordb.org., set relay
debug: checking RBL ipwhois.rfc-ignorant.org., set rfci
debug: checking RBL relays.visi.com., set relay
debug: decoded MIME header: "*****SPAM*****牛股网诚招各地业务联络处"
[ repeated 4 times ]
debug: checking RBL results in set relay for 127.0.0.6
debug: checking RBL results in set relay for 127.0.0.4
debug: AWL active, pre-score: 7, mean: undef
debug: Post AWL score: 7
debug: is spam? score=7 required=5
debug: auto-report? score=7 threshold=200
---------8<-------- cut here -----------------------
[ Received: lines cut ]
From: [EMAIL PROTECTED]
Subject: *****SPAM***** =?GB2312?B?xaO5yc34s8/V0Lj3tdjStc7xwarC57Sm?=
To: [EMAIL PROTECTED]
Content-Type: text/plain;
Sender: [EMAIL PROTECTED]
Date: Sun, 21 Apr 2002 06:11:46 +0800
X-Priority: 3
X-Library: Caretop Library
X-Mailer: Caretop 2604
Message-ID: <[EMAIL PROTECTED]>
X-Spam-Status: Yes, hits=12.5 required=5.0 tests=NO_REAL_NAME,SUPERLONG_LINE,
CHARSET_FARAWAY_HEADERS,RCVD_IN_OSIRUSOFT_COM,RCVD_IN_RFCI,SUBJ_ALL_CAPS,
SUBJ_FULL_OF_8BITS,X_OSIRU_SPAM_SRC version=2.20
X-Spam-Flag: YES
X-Spam-Level: ************
X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id: SpamAssassin.pm,v 1.77
2002/04/06 19:28:30 hughescr Exp $)
X-Spam-Report: 12.5 hits, 5 required;
* 0.6 -- From: does not include a real name
* -0.4 -- BODY: Contains a line >=199 characters long
* 1.8 -- A foreign language charset used in headers
* 2.0 -- Received via a relay in relays.osirusoft.com
[RBL check: found 208.127.106.202.relays.osirusoft.com.,
type: 127.0.0.4]
* 0.5 -- Received via a relay in ipwhois.rfc-ignorant.org
[RBL check: found 208.127.106.202.ipwhois.rfc-ignorant.org.,
type: 127.0.0.6]
* 1.9 -- Subject is all capitals
* 3.1 -- Subject is full of 8-bit characters
* 3.0 -- DNSBL: sender is Confirmed Spam Source
Content-Length: 1936
牛股网诚招各地业务联络处
四、 业务联络处诚招程序
2、个人应聘者请寄来学历、身份证复印件、个人简历产、明确的联系方式。
[ this goes on for some lines ]
3、正式录用通过后将专函通知。
---------8<-------- cut here -----------------------
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
