At 06:40 PM 10/22/2004 -0400, Asif Iqbal wrote:
@4000000041797c921b8ffdfc 2004-10-22 21:32:56 [13829] i: clean message (1.6/5.0) for [EMAIL PROTECTED]:7794 in 1.1 seconds, 1227 bytes.
@4000000041797c921b98ef0c 2004-10-22 21:32:56 [13829] i: result: . 1 - BAYES_00,MSGID_DOLLARS,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK scantime=1.1,size=1227,mid=<[EMAIL PROTECTED]>,bayes=0.00449588856409078,autolearn=no


The spamassassin -t -D < /tmp/spam running as qmailq shows

X-Spam-Status: Yes, score=15.0 required=5.0 tests=BAYES_00,MSGID_DOLLARS,
RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,URIBL_AB_SURBL,URIBL_JP_SURBL,
URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=no
version=3.0.0

I am running spamd like this

#!/bin/sh
exec 2>&1
exec /usr/local/bin/spamd -m 20 -s stderr --syslog-socket=inet -u qmailq


Any idea why I am getting this conflicted score?

From the looks of it... Time.

The only difference between the two runs is the second one matched a whole bunch of SURBL rules. This leads me to belive that sometime between 2004-10-22 21:32:56 and the time you ran spamassassin -t -D that one of the links in the mail got reported as spam to many of the SURBL lists.

SURBL lists are highly dynamic, as are most DNSBLs. You shouldn't be surprised when new spam gets added to them swiftly. However, if the spammer just bought a brand new domain name, there's no way for SURBL to have a listing before any spam gets sent. SURBL is good, but it's not psychic.

If the message really is spam, I'd be a bit concerned about your bayes training. You should never have a spam message hit BAYES_00 unless your bayes DB is not well trained.

My bayes DB is pretty stable, and I consider it a cause for alarm if a spam matches BAYES_10 or lower.

Check out the bayes tokens it's matching in spamassassin -t -D. Dump it into sa-learn --spam, then check the tokens again. From there, see if there's a particular kind of spam that would fit the low-scoring tokens that you might want to focus a little extra spam training on.




Reply via email to