-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I'm probably doing something dumb, but I've tried variations on this, and
I'm not getting anywhere. SA version 2.55
Attached is spam. The HTML text is ignored because of known SA problems
that I believe are fixed in 2.60. Also because of those problems, my body
rules attempt to read the raw BASE64_ENC_TEXT, causing matches to the new
test Consonants tests. I run spamassassin directly from the command
line,
> spamassassin --local --exit-code <$SAEU_FIRSTMSG >$SAEU_SAOUT
with this one email as standard input. The resulting SA headers:
> X-Spam-Status: No, hits=6.0 required=9.0
> tests=BASE64_ENC_TEXT,BAYES_70,L_bl_Consonants4,L_bl_Consonants5,
> L_bl_Consonants6,L_bl_Consonants7,L_bl_Consonants8,
> L_bl_Consonants9,MIME_HTML_NO_CHARSET
> version=2.55
> X-Spam-Level: ******
> X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
The TO header is:
> To: [EMAIL PROTECTED]
This is a bogus email address -- some spammer somewhere somewhen
misspelled an email address harvested from the web, and that misspelling
has circulated through a multitude of spam lists. So I know that ANYTHING
sent to this email address must necessarily be spam.
I tried to implement a rule to detect this:
header L_t_bogusbal ToCC =~ /[EMAIL PROTECTED]/i
describe L_t_bogusbal Addressed to invalid address at balanone.info
score L_t_bogusbal 1.00
and it did not match.
I know that the correct ruleset is being accessed, because of those
L_bl_Consonants rule matches; those rules exist only in this one file.
I've run spamassassin --lint, and it does not report any errors. I've
scanned the ruleset, and there are no other rules with this name.
I then tried the following variations:
1) Maybe ToCC isn't working here -- simplify to To
header L_t_bogusbalt To =~ /[EMAIL PROTECTED]/i
describe L_t_bogusbalt Addressed to invalid address at balanone.info
score L_t_bogusbalt 1.00
2) Simplify the test for the bogus "lanong" userid
header L_t_bogusbal1 ToCC =~ /lanong/i
describe L_t_bogusbal1 Addressed to invalid address at balanone.info
score L_t_bogusbal1 1.00
3) Replace the special characters with the "match anything" char
header L_t_bogusbal2 ToCC =~ /lanong.balanone.info/i
describe L_t_bogusbal2 Addressed to invalid address at balanone.info
score L_t_bogusbal2 1.00
None of these are reported in the header.
Scanning my entire corpus, none of my L_t_xxx "to" or "tocc" tests have
ever matched any email; none have ever been reported in the SA headers.
That implies that either I'm doing something wrong, or there's a problem
in my configuration. Can anyone see what I might be doing wrong?
Thanks for any insight.
Bob Menschel
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQA/AwUBPyIVJpebK8E4qh1HEQL9mQCfeXVUmyy7cjTWGDpLbnAJUv8u7cIAoKC0
GgQb7ZbdgCcpvIWMcwSFn8/9
=uYp7
-----END PGP SIGNATURE-----
From [EMAIL PROTECTED] Fri Jul 25 05:57:22 2003
Delivery-date: Fri, 25 Jul 2003 08:01:32 +0000
Received: from [211.21.44.211] (helo=hellohtml.com)
by server11.arteryserver11.net with smtp (Exim 4.20)
id 19fxW5-00073X-FV
for [EMAIL PROTECTED]; Fri, 25 Jul 2003 08:01:30 +0000
Message-ID: <[EMAIL PROTECTED]>
From: "Vito Booker" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Do you measure Up
Date: Fri, 25 Jul 2003 08:01:33 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.014 (X11; U; solaris; U; NT4.0; en-us) Gecko/25250101
X-Accept-Language: en
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0983_5D3789A9.6C570349"
X-Spam-Status: No, hits=1.6 required=9.0
tests=BASE64_ENC_TEXT,BAYES_56,HTML_60_70,HTML_MESSAGE,
MIME_HTML_NO_CHARSET,USER_AGENT_MOZILLA_UA
version=2.55
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-CWforward: passed anti-spam test
------=_NextPart_000_0983_5D3789A9.6C570349
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
------=_NextPart_000_0983_5D3789A9.6C570349
Content-Type: text/html
Content-Transfer-Encoding: base64
PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEg
VHJhbnNpdGlvbmFsLy9FTiI+DQo8aHRtbD4NCjxoZWFkPg0KICA8dGl0bGU+
YWQ8L3RpdGxlPg0KICA8bWV0YSBodHRwLWVxdWl2PSJjb250ZW50LXR5cGUi
DQogY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PUlTTy04ODU5LTEiPg0K
PC9oZWFkPg0KPGJvZHk+DQo8ZGl2IGFsaWduPSJjZW50ZXIiPjxiaWc+PGZv
bnQgZmFjZT0iSGVsdmV0aWNhLCBBcmlhbCwgc2Fucy1zZXJpZiI+QXMgU2Vl
biBPbiANCiAgVFY6PGJyPg0KICBDTk4sIEFCQyBOZXdzIEFuZCBNb3JlIC4u
Ljxicj4NCiAgPGJyPg0KICBEb2N0b3JzIENyZWF0ZSBWUFJYIFBlbmlzIEVu
bGFyZ2VtZW50IFBpbGxzPGJyPg0KICA8YnI+DQogIDwvZm9udD48Zm9udCBm
YWNlPSJIZWx2ZXRpY2EsIEFyaWFsLCBzYW5zLXNlcmlmIj48Zm9udCBzaXpl
PSItMSI+PGJpZz5HYWluIFVwIA0KICBUbyAzKyBGdWxsIEluY2hlcyBJbiBT
aXplPC9iaWc+PC9mb250Pjxicj4NCiAgPC9mb250Pjxmb250IGZhY2U9Ikhl
bHZldGljYSwgQXJpYWwsIHNhbnMtc2VyaWYiPjxmb250IHNpemU9Ii0xIj48
YmlnPkluY3JlYXNlIA0KICBZb3VyIFBlbmlzIFdpZHRoIChHaXJ0aCkgQnkg
MjAlPC9iaWc+PC9mb250Pjxicj4NCiAgPC9mb250Pjxmb250IGZhY2U9Ikhl
bHZldGljYSwgQXJpYWwsIHNhbnMtc2VyaWYiPjxmb250IHNpemU9Ii0xIj48
YmlnPlN0b3AgUHJlbWF0dXJlIA0KICBFamFjdWxhdGlvbiE8L2JpZz48L2Zv
bnQ+PGJyPg0KICA8L2ZvbnQ+PGZvbnQgZmFjZT0iSGVsdmV0aWNhLCBBcmlh
bCwgc2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iLTEiPjxiaWc+UHJvZHVjZSAN
CiAgU3Ryb25nZXIsIFJvY2sgSGFyZCBFcmVjdGlvbnM8L2JpZz48L2ZvbnQ+
PGJyPg0KICA8L2ZvbnQ+PGZvbnQgZmFjZT0iSGVsdmV0aWNhLCBBcmlhbCwg
c2Fucy1zZXJpZiI+PGZvbnQgc2l6ZT0iLTEiPjxiaWc+MTAwJSBTYWZlIA0K
ICBUbyBUYWtlLCBXaXRoIG5vIFNpZGUgRWZmZWN0czwvYmlnPjwvZm9udD48
YnI+DQogIDwvZm9udD48Zm9udCBmYWNlPSJIZWx2ZXRpY2EsIEFyaWFsLCBz
YW5zLXNlcmlmIj48Zm9udCBzaXplPSItMSI+PGJpZz5GYXN0IFByaW9yaXR5
IA0KICBGZWQtRXggU2hpcHBpbmcgV29ybGRXaWRlPC9iaWc+PC9mb250Pjxi
cj4NCiAgPC9mb250Pjxmb250IGZhY2U9IkhlbHZldGljYSwgQXJpYWwsIHNh
bnMtc2VyaWYiPjxmb250IHNpemU9Ii0xIj48YmlnPkRvY3RvciA8Zm9udCBm
YWNlPSJIZWx2ZXRpY2EsIEFyaWFsLCBzYW5zLXNlcmlmIj48Zm9udCBzaXpl
PSItMSI+PGJpZz5SZWNvbW1lbmRlZCANCiAgPC9iaWc+PC9mb250PjwvZm9u
dD48Zm9udCBmYWNlPSJIZWx2ZXRpY2EsIEFyaWFsLCBzYW5zLXNlcmlmIj48
Zm9udCBzaXplPSItMSI+PGJpZz5BbmQ8L2JpZz48L2ZvbnQ+PC9mb250PiAN
CiAgQXBwcm92ZWQ8L2JpZz48L2ZvbnQ+PGJyPg0KICA8L2ZvbnQ+PGZvbnQg
ZmFjZT0iSGVsdmV0aWNhLCBBcmlhbCwgc2Fucy1zZXJpZiI+PGZvbnQgc2l6
ZT0iLTEiPjxiaWc+PGZvbnQgZmFjZT0iSGVsdmV0aWNhLCBBcmlhbCwgc2Fu
cy1zZXJpZiI+PGZvbnQgc2l6ZT0iLTEiPjxiaWc+Tm8gRXhlcmNpc2VzISBO
byBQdW1wcyEgDQogIE5vIFN1cmdlcnkhPC9iaWc+PC9mb250Pjxicj4NCiAg
PC9mb250Pjxmb250IGZhY2U9IkhlbHZldGljYSwgQXJpYWwsIHNhbnMtc2Vy
aWYiPjxmb250IHNpemU9Ii0xIj48YmlnPjEwMCUgTW9uZXkgDQogIEJhY2sg
R3VhcmFudGVlPGJyPg0KICA8L2JpZz48L2ZvbnQ+PC9mb250Pjxmb250IGZh
Y2U9IkhlbHZldGljYSwgQXJpYWwsIHNhbnMtc2VyaWYiPjxmb250DQogc2l6
ZT0iLTEiPjxiaWc+PGI+RlJFRTwvYj4gQm90dGxlIE9mIFZQLVJYIFdvcnRo
IE92ZXIgJDUwPC9iaWc+PC9mb250Pjxicj4NCiAgPC9mb250PjwvYmlnPiA8
Zm9udCBmYWNlPSJIZWx2ZXRpY2EsIEFyaWFsLCBzYW5zLXNlcmlmIj48Ymln
Pjxmb250DQogc2l6ZT0iLTEiPjxiaWc+PGI+RlJFRTwvYj4gIk1hbGUgSGVs
cCBFLUJvb2siIFdvcnRoIE92ZXIgJDUwPC9iaWc+PC9mb250PjwvYmlnPjxi
cj4NCjxicj4NCjxhDQogaHJlZj0iaHR0cDovL3d3dy5oZXJiYWxwaWxsc29u
bGluZS5iaXovY2dpLWJpbi9hZmZpbGlhdGVzL2NsaWNrLmNnaT9pZD1ocGls
bHMiPjxiaWc+PGI+Q0xJQ0sNCkhFUkUgVE8gUkVBRCBNT1JFPC9iPjwvYmln
PjwvYT48L2ZvbnQ+PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJy
Pg0KICA8ZGl2IGFsaWduPSJjZW50ZXIiPjxhIGhyZWY9Imh0dHA6Ly9ocHNh
bGVzLmdsb2JhbG9mZmVyei5iaXovb3B0b3V0Lmh0bWwiPjxzbWFsbD48Zm9u
dCANCiBmYWNlPSJIZWx2ZXRpY2EsIEFyaWFsLCBzYW5zLXNlcmlmIj5ObyBU
aGFuayB5b3UsIEkgd2FudCBPdXQ8L2ZvbnQ+PC9zbWFsbD48L2E+PGJyPiAN
CjwvZGl2Pg0KPGJyPg0KPGJyPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+
DQo=
------=_NextPart_000_0983_5D3789A9.6C570349--
