just saw this error:
Feb  5 14:19:46.438 [6998] warn: rules: failed to compile 
Mail::SpamAssassin::Plugin::Check::_head_tests_0_4, skipping:
Feb  5 14:19:46.438 [6998] warn:  (Global symbol "$Blat" requires explicit package name 
(did you forget to declare "my $Blat"?) at /etc/spamassassin/70_zmi_german.cf, rule 
__ZMIfish_ForgedBill01, line 1.)

After delete /etc/spamassassin/70_zmi_german.cf and restart amavis:
---- ---------------------- --------------------------------------------------
 3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                            [score: 1.0000]
 5.0 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%
                            [score: 1.0000]
 1.2 URIBL_ABUSE_SURBL      Contains an URL listed in the ABUSE SURBL
                            blocklist
                            [URIs: negosev.site]
 1.7 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: negosev.site]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.8 MPART_ALT_DIFF         BODY: HTML and text parts are different
 1.2 HTML_IMAGE_ONLY_04     BODY: HTML: images with 0-400 bytes of words
 2.5 PYZOR_CHECK            Listed in Pyzor
                            (https://pyzor.readthedocs.io/en/latest/)
 0.0 HTML_SHORT_LINK_IMG_1  HTML is very short with a linked image
 0.8 RDNS_NONE              Delivered to internal network by a host with no rDNS
-1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                            manager
 0.6 BODY_URI_ONLY          Message body is only a URI in one line of text or
                            for an image
 2.0 TO_NO_BRKTS_HTML_IMG   To: lacks brackets and HTML and one image



Am 05.02.20 um 14:22 schrieb Philipp Ewald:
Sure.

spamassassin -V
SpamAssassin version 3.4.2
   running on Perl version 5.24.1


pts rule name              description
---- ---------------------- --------------------------------------------------
  3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                             [score: 1.0000]
  5.0 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%
                             [score: 1.0000]
  1.7 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                             [URIs: negosev.site]
  1.2 HTML_IMAGE_ONLY_04     BODY: HTML: images with 0-400 bytes of words
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.8 MPART_ALT_DIFF         BODY: HTML and text parts are different
  2.5 PYZOR_CHECK            Listed in Pyzor
                             (https://pyzor.readthedocs.io/en/latest/)
  1.6 REPLYTO_WITHOUT_TO_CC  No description available.
  0.8 RDNS_NONE              Delivered to internal network by a host with no 
rDNS
  1.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
  1.0 MISSING_FROM           Missing From: header
  0.0 HTML_SHORT_LINK_IMG_1  HTML is very short with a linked image
  0.6 BODY_URI_ONLY          Message body is only a URI in one line of text or
                             for an image

Notice:
same mail on Debian 10 Server Rule dont hit....

spamassassin -V
SpamAssassin version 3.4.2
   running on Perl version 5.28.1


  pts rule name              description
---- ---------------------- --------------------------------------------------
  1.7 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                             [URIs: negosev.site]
  3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                             [score: 1.0000]
  1.2 HTML_IMAGE_ONLY_04     BODY: HTML: images with 0-400 bytes of words
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.8 MPART_ALT_DIFF         BODY: HTML and text parts are different
  5.0 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%
                             [score: 1.0000]
  2.5 PYZOR_CHECK            Listed in Pyzor
                             (https://pyzor.readthedocs.io/en/latest/)
  0.0 HTML_SHORT_LINK_IMG_1  HTML is very short with a linked image
-1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
  0.8 RDNS_NONE              Delivered to internal network by a host with no 
rDNS
  0.0 BODY_URI_ONLY          Message body is only a URI in one line of text or
                             for an image
  2.0 TO_NO_BRKTS_HTML_IMG   To: lacks brackets and HTML and one image




Am 05.02.20 um 13:55 schrieb Damian:
Can you provide an .eml that will reproduce the hit with a manual
spamassassin invocation?

i have a mail with REPLYTO_WITHOUT_TO_CC=1.552 but in Mail Header
there is a "To" why does this rule hit?

From: "Kreditkarte" <ybre...@spam.tld>
Reply-To: "Kreditkarte" <ybre...@spam.tld>
To: u...@another.tld


--
Philipp Ewald
Administrator

DigiOnline GmbH, Probsteigasse 15 - 19, 50670 Köln
Telefon: +49 221 6500-532, Fax: +49 221 6500-690, E-Mail: 
philipp.ew...@digionline.de

AG Köln HRB 27711, St.-Nr. 5215 5811 0640
Geschäftsführer: Werner Grafenhain

Informationen zum Datenschutz: www.digionline.de/ds

Reply via email to