On Wednesday 14 January 2004 02:03 pm, Chris Santerre wrote:
> > Heh... sorry, it's not me having the problem with header length. I
> > was just asking. I notice that one could theoretically get 878
> > matches, which would make for a very woolly message header.
>
> LOL, sorry here as well, got my usernames messed up :) Here is a typical
> header I get w/ no errors:
>
> X-Spam-Status: Yes, hits=40.0 required=5.0
> tests=CLICK_BELOW,CTYPE_JUST_HTML,FVGT_TRIPWIRE_HV,
> FVGT_TRIPWIRE_KJ,FVGT_TRIPWIRE_MH,FVGT_TRIPWIRE_TB,
> FVGT_TRIPWIRE_VM,FVGT_b_RANDOMTEXT,FVGT_s_SPACES_6,
> HTML_50_70,HTML_COMMENT_UNIQUE_ID,HTML_FONT_COLOR_MAGENTA,
> HTML_FONT_COLOR_RED,J_BACKHAIR_12,J_BACKHAIR_13,
> J_BACKHAIR_14,J_BACKHAIR_21,J_BACKHAIR_22,J_BACKHAIR_23,
> J_BACKHAIR_24,J_BACKHAIR_26,J_BACKHAIR_32,J_BACKHAIR_33,
> J_BACKHAIR_34,J_BACKHAIR_35,J_BACKHAIR_42,J_BACKHAIR_43,
> J_BACKHAIR_44,J_BACKHAIR_45,J_BACKHAIR_52,J_BACKHAIR_56,
> L_s_MaskedWords4,MY_HTML_OBFU,MY_NO_QU,MY_OBFUJ,MY_OBFUT,
> MY_OBFUX,MY_OBFUY,MY_OBFUZ,MY_OBFU_MISC,MY_S_URBOSS,
> MY_TITLE,OBFUSCATING_COMMENT,REG_THANKS,RM_hc_HTML,
> RM_rb_ANCHOR,RM_rb_BREAK,RM_rb_FONT,RM_rb_HTML,RM_rb_PARA,
> RM_rb_TITLE,RND_WORD,SPAM_PHRASE_08_13,SUBJ_HAS_SPACES
>
> Some of these rules are going the way of the dodo soon. But for this it
> doesn't matter. I know I have larger then this as well.
>
> --Chris
I put the full report in the headers to make it easier to interpret. I realize
that can be a lot, but it hasn't been a problem previously. Usually it's well
within reasonable limit, but as you can see, the tripwire rules add quite a
bit. Add a couple more rule hits and the rest of the headers, and you've got
your 8k easy.
X-Spam-Report: Content analysis details: (40.0 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
3.2 FROM_HAS_MIXED_NUMS3 From: contains numbers mixed in with
letters
4.2 DATE_SPAMWARE_Y2K Date header uses unusual Y2K formatting
0.3 FROM_HAS_MIXED_NUMS From: contains numbers mixed in with
letters
1.0 GUARANTEED_100_PERCENT BODY: One hundred percent guaranteed
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 1.0000]
0.1 HTML_60_70 BODY: Message is 60% to 70% HTML
2.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.1 HTML_MESSAGE BODY: HTML included in message
0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe 6x6x6
palette
0.6 MIME_HTML_NO_CHARSET RAW: Message text in HTML without charset
3.8 USERPASS URI: URL contains username and (optional)
password
1.9 HTTP_ENTITIES_HOST URI: URI obscured with character entities
3.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received'
headers
0.4 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date
1.6 MISSING_MIMEOLE Message has X-MSMail-Priority, but no
X-MimeOLE
2.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME
parts
2.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
1.2 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.6 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS
Outlook
0.1 FVGT_TRIPWIRE_PF FVGT_TRIPWIRE_PF
0.1 FVGT_TRIPWIRE_AQ FVGT_TRIPWIRE_AQ
0.1 FVGT_TRIPWIRE_PX FVGT_TRIPWIRE_PX
0.1 FVGT_TRIPWIRE_QC FVGT_TRIPWIRE_QC
0.1 FVGT_TRIPWIRE_QJ FVGT_TRIPWIRE_QJ
0.1 FVGT_TRIPWIRE_QS FVGT_TRIPWIRE_QS
0.1 FVGT_TRIPWIRE_QT FVGT_TRIPWIRE_QT
0.1 FVGT_TRIPWIRE_QW FVGT_TRIPWIRE_QW
0.1 FVGT_TRIPWIRE_QZ FVGT_TRIPWIRE_QZ
0.1 FVGT_TRIPWIRE_RP FVGT_TRIPWIRE_RP
0.1 FVGT_TRIPWIRE_RV FVGT_TRIPWIRE_RV
0.1 FVGT_TRIPWIRE_RZ FVGT_TRIPWIRE_RZ
0.1 FVGT_TRIPWIRE_SJ FVGT_TRIPWIRE_SJ
0.1 FVGT_TRIPWIRE_DK FVGT_TRIPWIRE_DK
0.1 FVGT_TRIPWIRE_DL FVGT_TRIPWIRE_DL
0.1 FVGT_TRIPWIRE_SN FVGT_TRIPWIRE_SN
0.1 FVGT_TRIPWIRE_SV FVGT_TRIPWIRE_SV
0.1 FVGT_TRIPWIRE_TC FVGT_TRIPWIRE_TC
0.1 FVGT_TRIPWIRE_EK FVGT_TRIPWIRE_EK
0.1 FVGT_TRIPWIRE_TQ FVGT_TRIPWIRE_TQ
0.1 FVGT_TRIPWIRE_UW FVGT_TRIPWIRE_UW
0.1 FVGT_TRIPWIRE_UY FVGT_TRIPWIRE_UY
0.1 FVGT_TRIPWIRE_VC FVGT_TRIPWIRE_VC
0.1 FVGT_TRIPWIRE_GD FVGT_TRIPWIRE_GD
0.1 FVGT_TRIPWIRE_VQ FVGT_TRIPWIRE_VQ
0.1 FVGT_TRIPWIRE_VV FVGT_TRIPWIRE_VV
0.1 FVGT_TRIPWIRE_GV FVGT_TRIPWIRE_GV
0.1 FVGT_TRIPWIRE_WR FVGT_TRIPWIRE_WR
0.1 FVGT_TRIPWIRE_WT FVGT_TRIPWIRE_WT
0.1 FVGT_TRIPWIRE_WU FVGT_TRIPWIRE_WU
0.1 FVGT_TRIPWIRE_WY FVGT_TRIPWIRE_WY
0.1 FVGT_TRIPWIRE_HW FVGT_TRIPWIRE_HW
0.1 FVGT_TRIPWIRE_HX FVGT_TRIPWIRE_HX
0.1 FVGT_TRIPWIRE_IJ FVGT_TRIPWIRE_IJ
0.1 FVGT_TRIPWIRE_XQ FVGT_TRIPWIRE_XQ
0.1 FVGT_TRIPWIRE_JB FVGT_TRIPWIRE_JB
0.1 FVGT_TRIPWIRE_YD FVGT_TRIPWIRE_YD
0.1 FVGT_TRIPWIRE_JG FVGT_TRIPWIRE_JG
0.1 FVGT_TRIPWIRE_YJ FVGT_TRIPWIRE_YJ
0.1 FVGT_TRIPWIRE_YP FVGT_TRIPWIRE_YP
0.1 FVGT_TRIPWIRE_JN FVGT_TRIPWIRE_JN
0.1 FVGT_TRIPWIRE_YQ FVGT_TRIPWIRE_YQ
0.1 FVGT_TRIPWIRE_NP FVGT_TRIPWIRE_NP
0.1 FVGT_TRIPWIRE_JP FVGT_TRIPWIRE_JP
0.1 FVGT_TRIPWIRE_JR FVGT_TRIPWIRE_JR
0.1 FVGT_TRIPWIRE_YX FVGT_TRIPWIRE_YX
0.1 FVGT_TRIPWIRE_YY FVGT_TRIPWIRE_YY
0.1 FVGT_TRIPWIRE_ZC FVGT_TRIPWIRE_ZC
0.1 FVGT_TRIPWIRE_NQ FVGT_TRIPWIRE_NQ
0.1 FVGT_TRIPWIRE_ZF FVGT_TRIPWIRE_ZF
0.1 FVGT_TRIPWIRE_ZJ FVGT_TRIPWIRE_ZJ
0.1 FVGT_TRIPWIRE_ZM FVGT_TRIPWIRE_ZM
0.1 FVGT_TRIPWIRE_KN FVGT_TRIPWIRE_KN
0.1 FVGT_TRIPWIRE_ZQ FVGT_TRIPWIRE_ZQ
0.1 FVGT_TRIPWIRE_KR FVGT_TRIPWIRE_KR
0.1 FVGT_TRIPWIRE_ZW FVGT_TRIPWIRE_ZW
0.1 FVGT_TRIPWIRE_LG FVGT_TRIPWIRE_LG
0.1 FVGT_TRIPWIRE_OV FVGT_TRIPWIRE_OV
0.1 FVGT_TRIPWIRE_ML FVGT_TRIPWIRE_ML
--
Matt
Systems Administrator
Local Access Communications
360.330.5535
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
