Hi Theo,
Can I just paste the source header info of a similar spam mail here - none
are getting caught by SA?
Hope that is ok...Or did you mean something else?
(My spamasssin --lint check seems to check out)
###################################################
Received: from mail.weirminerals.com ([66.170.10.4])
by external1.us.war.weirgroup.net (Lotus Domino Release 6.5.6FP2)
with ESMTP id 2008022011532554-286823 ;
Wed, 20 Feb 2008 11:53:25 -0600
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.weirminerals.com (Postfix) with ESMTP
id 27717642D2; Wed, 20 Feb 2008 11:53:23 -0600 (CST)
Received: from mail.weirminerals.com ([127.0.0.1])
by localhost (mail.weirminerals.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 09727-01-21; Wed, 20 Feb 2008 11:53:19 -0600 (CST)
Received: from mninter.net (cpe-075-191-175-010.carolina.res.rr.com
[75.191.175.10])
by mail.weirminerals.com (Postfix) with SMTP
id 9BF79645E9; Wed, 20 Feb 2008 11:52:50 -0600 (CST)
Reply-To: "Claude" <[EMAIL PROTECTED]>
From: "Roberto" <[EMAIL PROTECTED]>
User-Agent: Mozilla 4.76 (Macintosh; U; PPC)
MIME-Version: 1.0
To: "africa.pumps" <[EMAIL PROTECTED]>
Subject: howdy
Message-ID: <[EMAIL PROTECTED]>
Date: Thu, 21 Feb 2008 05:36:53 +1100
Bcc: [EMAIL PROTECTED]
X-MIMETrack: Itemize by SMTP Server on EXTERNAL1/WINET/Weir(Release
6.5.6FP2|October 17, 2007) at
02/20/2008 11:53:25 AM,
Serialize by Notes Client on Scott
Pichelman/US/WAR/Weir(Release 8.0|August
02, 2007) at 02/20/2008 11:56:36 AM,
Serialize complete at 02/20/2008 11:56:36 AM
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset="us-ascii"
Those crazy japaneses girls...
http://2j1f.com/2 japanese 1 finger !
####################################
[EMAIL PROTECTED] spam-email]$ /usr/bin/spamassassin -DtL < mosconj-022008-1
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on
mail.weirminerals.com
X-Spam-Report:
* 2.5 MISSING_HB_SEP Missing blank line between message header and
body
* 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4551]
* 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see
<http://www.spamcop.net/bl.shtml?125.115.21.32>]
* 1.8 MISSING_SUBJECT Missing Subject: header
X-Spam-Status: Yes, score=7.1 required=4.0 tests=BAYES_50,INFO_TLD,
MISSING_HB_SEP,MISSING_SUBJECT,RCVD_IN_BL_SPAMCOP_NET autolearn=no
version=3.1.1
X-Spam-Level: *******
Received: from mail.weirminerals.com ([66.170.10.4])
by external1.us.war.weirgroup.net (Lotus Domino Release 6.5.6FP2)
with ESMTP id 2008021919132074-278683 ;
Tue, 19 Feb 2008 19:13:20 -0600
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.weirminerals.com (Postfix) with ESMTP id 4859F6436B
for <[EMAIL PROTECTED]>; Tue, 19 Feb 2008
19:13:20 -0600 (CST)
Received: from mail.weirminerals.com ([127.0.0.1])
by localhost (mail.weirminerals.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 03608-02-49 for <[EMAIL PROTECTED]>;
Tue, 19 Feb 2008 19:13:16 -0600 (CST)
Received: from lenovo-d9bbc4ce (unknown [125.115.21.32])
by mail.weirminerals.com (Postfix) with SMTP id D41506439A
for <[EMAIL PROTECTED]>; Tue, 19 Feb 2008
19:12:53 -0600 (CST)
Received: from [125.115.21.32] by swmail.swagelok.com; Wed, 20 Feb 2008
09:50:11 +0800
From: "Ronda Gill" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>Subject: What are you up to?
MIME-Version: 1.0
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1830
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Message-ID: <[EMAIL PROTECTED]>
X-Priority: 3 (Normal)
Date: Wed, 20 Feb 2008 09:50:11 +0800
X-MIMETrack: Itemize by SMTP Server on EXTERNAL1/WINET/Weir(Release
6.5.6FP2|October 17, 2007) at
02/19/2008 07:13:20 PM,
Serialize by Notes Client on Scott
Pichelman/US/WAR/Weir(Release 8.0|August
02, 2007) at 02/20/2008 09:31:22 AM,
Serialize complete at 02/20/2008 09:31:22 AM
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
format=flowed;
charset="us-ascii"
Hello! I am bored this afternoon. I am nice girl that would like to chat
with you. Email me at [EMAIL PROTECTED] only, because I am using my
friend's email to write this. You will see some of my private pics.
Theo Van Dinter-2 wrote:
>
> On Wed, Feb 20, 2008 at 09:24:28AM -0800, pichels wrote:
>> /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Message/Node.pm line
>> 119.
>> Learned tokens from 0 message(s) (1 message(s) examined)
>>
>> So, I found a post that explained this was a bug and to pach the Node.pm
>> file and so I patched it:
>> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5823
>
> bug 5823 isn't related to Message::Node
>
>> [EMAIL PROTECTED] spam-email]$ sa-learn --spam < mosconj-022008-1
>> Learned tokens from 0 message(s) (1 message(s) examined)
>
> It could mean that the message was already learned.
>
>> However, why does SA with debug and lint score the email?
>> * 2.5 MISSING_HB_SEP Missing blank line between message header
>> and body
>
> It is exceedingly likely that your input message is malformed. If you can
> pastebot the message somewhere, we can look at it for you and let you
> know.
>
> --
> Randomly Selected Tagline:
> "That's why I don't like video's - no commercial to read through."
> - Robert Gombert
>
>
>
--
View this message in context:
http://www.nabble.com/sa-learn-%22not%22-learning--tp15594114p15596189.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
