Steve Ingraham wrote:
I was trying to see if there was anything I could change in the rules in
spamassassin to raise the spam score up enough to reach the spam_hits=10
limit set up in my qmail controls so that qmail will not deliver the
message. Once the spam score reaches 10 delivery is stopped. I was
posting to the spamassassin list because I wanted to know if there was a
way I could "bump up" the score for these types of spam messages so it
would reach the setting I have of "spam_hits=10" in the controls for
qmail and therefore not get delivered to the user's mailbox.
Ah, I understand now, Steve. Your motivation wasn't so obvious from your
original posting.
You can modify the scoring of any rule by adding a file to
/etc/mail/spamassassin that changes the score for specific rules. I
named mine ZZscores.cf so it will be read after the other files in this
directory. For instance,
score HTML_MESSAGE_BODY 1.0
That said, I'm not sure you'd want to fiddle with the scores on the rules
this message hits. From your original posting, we have
1.7 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
3.9 JV_Pharm1r_Drug BODY: partial word hidden in HTML in pill ad
1.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80%
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 HTML_10_20 BODY: Message is 10% to 20% HTML
0.4 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
Some other alternatives might be training your Bayes filter with messages
like these so you get a higher score than BAYES_60 or giving a positive
score to HTML_MESSAGE_BODY, though that can lead to false positives in
today's "look at my pretty email" world.
I also noticed that this was a GIF spam, but it's not scored as such.
You might want to look back over this list's archives and read about the
FuzzyOCR and ImageInfo plugins. Also the newest SARE stock rules might help.
Of course, you could also lower your thresholds. I tag at 4 and
quarantine at 8. I review the decisions on messages in between these
values to make sure we're not generating false positives; seems to work
okay here.
I don't use Bayes at all.
Peter
