Thanks for the very quick response. But how to I do that? Do I need another script? Or is it a setting somewhere (eg in local.cf)?
On 09.04.08 05:47, age85 wrote: > > we have a default slox 9 installation, please have a look at the > attached > > output. We can see two different spam scores in one message. We receive > the > > message with the lower spam value in the header. What's the reason for > this? > > What happens with the higher value? > > Received: from localhost by mail.DOMAIN.de > > with SpamAssassin (version 3.1.9); > > Wed, 09 Apr 2008 14:19:13 +0200 > > X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on > mail.DOMAIN.de > > X-Spam-Status: Yes, score=14.5 required=5.0 > tests=AWL,BAYES_99,HTML_40_50, > > > > HTML_MESSAGE,HTML_TITLE_EMPTY,IXHASH,UNPARSEABLE_RELAY,URIBL_JP_SURBL, > > URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.1.9 > > Received: from mail.DOMAIN.de ([unix socket]) > > by mail (Cyrus v2.2.3) with LMTP; Wed, 09 Apr 2008 13:22:45 > +0200 > > X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on > mail.DOMAIN.de > > X-Spam-Level: *** > > X-Spam-Status: No, score=3.5 required=5.0 tests=BAYES_95,HTML_40_50, > > HTML_MESSAGE autolearn=no version=3.1.9 most of differences come from URIBL_* and IXHASH, both of those are network checks which usually start hitting some time after spam starts spreading (is must be reported to get to blacklist and hash databases). -- Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. It's now safe to throw off your computer. . age85 wrote: > > Hello all, > > we have a default slox 9 installation, please have a look at the attached > output. We can see two different spam scores in one message. We receive > the message with the lower spam value in the header. What's the reason for > this? What happens with the higher value? > > Thanks and best regards, > > Alex > > > > mail:/var/spool/imap/webmaster # spamassassin < 2701. > Received: from localhost by mail.DOMAIN.de > with SpamAssassin (version 3.1.9); > Wed, 09 Apr 2008 14:19:13 +0200 > From: "Ladonna Stanford" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Subject: ****SPAM(14.5)**** Liebe Kunden, bleiben Sie gesund! > Date: Wed, 9 Apr 2008 12:22:44 +0100 > Message-Id: <[EMAIL PROTECTED]> > X-Spam-Flag: YES > X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on mail.DOMAIN.de > X-Spam-Level: ************** > X-Spam-Status: Yes, score=14.5 required=5.0 tests=AWL,BAYES_99,HTML_40_50, > > HTML_MESSAGE,HTML_TITLE_EMPTY,IXHASH,UNPARSEABLE_RELAY,URIBL_JP_SURBL, > URIBL_SBL,URIBL_SC_SURBL autolearn=no version=3.1.9 > MIME-Version: 1.0 > Content-Type: multipart/mixed; boundary="----------=_47FCB441.3CA0EFF8" > > This is a multi-part message in MIME format. > > ------------=_47FCB441.3CA0EFF8 > Content-Type: text/plain > Content-Disposition: inline > Content-Transfer-Encoding: 8bit > > Spam detection software, running on the system "mail.DOMAIN.de", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or label > similar future email. If you have any questions, see > postmaster for details. > > Content preview: Weltweit anerkannte Online Versandapotheke > "RXMedications" > verkauft alle populären pharmazeutischen Produkte, die für > Ihr > physisches und psychisches Wohl unbedingt erforderlichen sind, zu > niedrigen > Preisen. Wir liefern an Menschen aus der ganzen Welt: ob in Europa, > Asien > und den USA. Ab jetzt brauchen Sie nicht mehr zur Apotheke zu gehen. > Wir > liefern ausgezeichnete Markenprodukte zu Ihnen nach Hause überall > auf > der Welt. [...] > > Content analysis details: (14.5 points, 5.0 required) > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay > lines > 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML > 2.5 IXHASH BODY: iXhash says its spam > 0.0 HTML_MESSAGE BODY: HTML included in message > 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% > [score: 0.9978] > 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text > 1.6 URIBL_SBL Contains an URL listed in the SBL blocklist > [URIs: brotherlist.com] > 4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL > blocklist > [URIs: brotherlist.com] > 4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL > blocklist > [URIs: brotherlist.com] > -2.5 AWL AWL: From: address is in the auto white-list > > The original message was not completely plain text, and may be unsafe to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to view > it, it may be safer to save it to a file and open it with an editor. > > > ------------=_47FCB441.3CA0EFF8 > Content-Type: message/rfc822; x-spam-type=original > Content-Description: original message before SpamAssassin > Content-Disposition: attachment > Content-Transfer-Encoding: 8bit > > Return-Path: <[EMAIL PROTECTED]> > Received: from mail.DOMAIN.de ([unix socket]) > by mail (Cyrus v2.2.3) with LMTP; Wed, 09 Apr 2008 13:22:45 +0200 > X-Sieve: CMU Sieve 2.2 > Received: by mail.DOMAIN.de (Postfix, from userid 65534) > id 480F91297C; Wed, 9 Apr 2008 13:22:45 +0200 (CEST) > X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on mail.DOMAIN.de > X-Spam-Level: *** > X-Spam-Status: No, score=3.5 required=5.0 tests=BAYES_95,HTML_40_50, > HTML_MESSAGE autolearn=no version=3.1.9 > Received: from Ammar2006 (i59F4DE84.versanet.de [89.244.222.132]) > by mail.DOMAIN.de (Postfix) with ESMTP id 0BED56FD8; > Wed, 9 Apr 2008 13:22:44 +0200 (CEST) > Received: from [89.244.222.132] by mail.nrai.com; Wed, 9 Apr 2008 12:22:44 > +0100 > From: "Ladonna Stanford" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Subject: Liebe Kunden, bleiben Sie gesund! > Date: Wed, 9 Apr 2008 12:22:44 +0100 > Message-ID: <[EMAIL PROTECTED]> > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="----=_NextPart_000_000E_01C89A3C.6992C200" > X-Priority: 3 (Normal) > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) > X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 > Importance: Normal > > This is a multi-part message in MIME format. > > ------=_NextPart_000_000E_01C89A3C.6992C200 > Content-Type: text/plain; > charset="UTF-8" > Content-Transfer-Encoding: 7bit > > Weltweit anerkannte Online Versandapotheke "RXMedications" verkauft alle > populären pharmazeutischen Produkte, die für Ihr physisches und > psychisches Wohl unbedingt erforderlich > en sind, zu niedrigen Preisen. > Wir liefern an Menschen aus der ganzen Welt: ob in Europa, Asien und den > USA. > Ab jetzt brauchen Sie nicht mehr zur Apotheke zu gehen. > Wir liefern ausgezeichnete Markenprodukte zu Ihnen nach Hause > überall auf der Welt. > > Besuchen Sie unsere Website und bestellen Heilmittel, die Ihnen fehlen, > einfach zu sich nach Hause. > http://brotherlist.com/ > Unser Service ist von VeriSign und VISA zertifiziert, auf diese Weise > garantieren wir einen zuverlässigen und vertrauenswürdigen > Einkauf ohne Risiko. > > > ------=_NextPart_000_000E_01C89A3C.6992C200 > Content-Type: text/html; > charset="UTF-8" > Content-Transfer-Encoding: quoted-printable > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> > <HTML><HEAD><TITLE></TITLE> > <META content=3D"text/html; charset=3DUTF-8" http-equiv=3DContent-Type> > <META content=3D"MSHTML 5.50.4807.1700" name=3DGENERATOR></HEAD> > <BODY> > Weltweit anerkannte Online Versandapotheke <em= >>"RXMedications"</em> verkauft alle populären pharmazeutische= > n Produkte, die für Ihr physisches und psychisches Wohl unbedingt er= > forderlichen sind, zu niedrigen Preisen.<br> > Wir liefern an Menschen aus der ganzen Welt: ob in Europa, Asien und den = > USA.<br> > Ab jetzt brauchen Sie nicht mehr zur Apotheke zu gehen.<br> > Wir liefern ausgezeichnete Markenprodukte zu Ihnen nach Hause überal= > l auf der Welt.<br><br> > > 3D"http://brotherlist.com/"; <em>Besuchen Sie un= > sere Website und bestellen Heilmittel, die Ihnen fehlen, einfach zu sich = > nach Hause.</em> <br> > http://brotherlist.com/<br> > > Unser Service ist von <em>VeriSign</em>= > und <em>VISA</em> zertifiziert, auf diese= > Weise garantieren wir einen zuverlässigen und vertrauenswürdig= > en Einkauf ohne Risiko. > </BODY></HTML> > > ------=_NextPart_000_000E_01C89A3C.6992C200-- > > ------------=_47FCB441.3CA0EFF8-- > > mail:/var/spool/imap/webmaster # > mail:/var/spool/imap/webmaster # more /etc/mail/spamassassin/local.cf > rewrite_header Subject ****SPAM(_SCORE_)**** > required_score 5.00 > ifplugin Mail::SpamAssassin::Plugin::URIDNSBL > uridnsbl_skip_domain suse.de opensuse.org suse.com suse.org > uridnsbl_skip_domain novell.com novell.org novell.ru novell.de novell.hu > novell.co.uk > endif # Mail::SpamAssassin::Plugin::URIDNSBL > > > -- View this message in context: http://www.nabble.com/Different-score-again-tp16585343p16585407.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
