Hello,
I've received a few spams where the AWL has assigned a large negative score.
I've attached the headers from a spam I received today "Kobe's Court"
(haha). The email address that this came from and went to are, to me,
pretty obvious indications of spam which is why I'm having trouble
understanding why the AWL would assign a negative score at all. By looking
at these headers, can anyone suggest a fix that would correct the AWL
database and stop this from happening in the first place?
I am running SA 2.55 with qmail-scanner 1.16. I have not changed the
default AWL settings.
Thank you,
James
Return-Path: <[EMAIL PROTECTED]>
Received: from spam.my.domain (xxx.xxx.xxx.xxx) by my.domain with SMTP
(My Mail server software 1.1) for <[EMAIL PROTECTED]>;
Wed, 15 Oct 2003 05:38:31 -0400
Received: (qmail 15013 invoked by uid 1000); 15 Oct 2003 05:38:30 -0400
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 15002 invoked by uid 104); 15 Oct 2003 05:38:29 -0400
Received: from [EMAIL PROTECTED] by spam.my.domain by uid 100 with
qmail-scanner-1.16
(clamscan: 0.60. spamassassin: 2.55. Clear:SA:0(-3.9/5.0):.
Processed in 11.642002 secs); 15 Oct 2003 09:38:29 -0000
Received: from mail.my.domain (HELO my.domain) (xxx.xxx.xxx.xxx)
by spam.my.domain with SMTP; 15 Oct 2003 05:38:17 -0400
Received: from em23.look4emails.com (65.110.13.247) by my.domain with SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Wed, 15 Oct 2003 05:38:06 -0400
To: [EMAIL PROTECTED]
Date: Wed, 15 Oct 2003 03:08:05 -0800
Message-ID: <[EMAIL PROTECTED]>
From: "Kobes Court" <[EMAIL PROTECTED]>
Mime-Version: 1.0
Subject: Is Kobe Innocent?
Content-Type: multipart/alternative;
boundary="Amazon.com_multipart_boundary____________"
X-Spam-Status: No, hits=-3.9 required=5.0
tests=AWL,BAYES_80,CLICK_BELOW,HTML_40_50,HTML_LINK_CLICK_HERE,
HTML_WEB_BUGS,LONG_DISTANCE,NORMAL_HTTP_TO_IP,OFFERS_ETC,
RCVD_IN_BL_SPAMCOP_NET,VACATION_SCAM
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Spam-Report: ---- Start SpamAssassin results
-3.90 points, 5 required;
* 0.3 -- BODY: Long Distance Phone Offer
* 0.4 -- BODY: Stop with the offers, coupons, discounts etc!
* 0.5 -- BODY: Vacation Offers
* 0.7 -- BODY: Message is 40% to 50% HTML
* 0.1 -- BODY: HTML link text says "click here"
* 0.1 -- BODY: Image tag with an ID code to identify you
* 2.9 -- BODY: Bayesian classifier says spam probability is 80 to 90%
[score: 0.8260]
* 0.7 -- URI: Uses a dotted-decimal IP address in URL
* 3.0 -- RBL: Received via a relay in bl.spamcop.net
[RBL check: found 247.13.110.65.bl.spamcop.net.]
* 0.0 -- Asks you to click below
* -12.6 -- AWL: Auto-whitelist adjustment
---- End of SpamAssassin results
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
