spamassassin-users January 2011 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: Not spam but spamassassin adds 50 hitpoi

Re: Not spam but spamassassin adds 50 hitpoints

From: Karsten Bräckelmann <guenther_at_nospam>
Date: Mon Jan 24 2011 - 13:22:34 GMT
To: users@spamassassin.apache.org

On Mon, 2011-01-24 at 13:59 +0100, Han Boetes wrote:
> On 01/24/2011 11:59 AM, Karsten Bräckelmann wrote:
> > Anyway, there's nothing we can do, unless you provide the full SA
> > headers at least. Maybe even a life sample, with those headers of
> > course.
>
> I just sent myself a short test message with the afformentioned
> attachement and I get this SA report from MailScanner. Is that what
> you'd like to see? If not how do I get it?

Not the full report, but the rule names and scores. Yep, that's
sufficient.

> 0.80 BAYES_50

The above is the *only* stock SA rule. The overall score of that ham
should be 0.8, way below the default threshold. All remaining rules
shown below are your local rules, responsible for the false positive.

Hint: A rule that matches "mangled short English word" tends to be not
suitable for any other language.

> 2.30 MANGLED_BEST mangled best
> 2.30 MANGLED_CNFDTL mangled confidential
> 2.30 MANGLED_DELIVY mangled delivery
> 2.30 MANGLED_FORM mangled form
> 2.30 MANGLED_FREE mangled free
> 2.30 MANGLED_FROM mangled from
> 2.30 MANGLED_GOOD mangled good
> 2.30 MANGLED_MEDS mangled med(s)
> 2.30 MANGLED_MEN mangled men
> 2.30 MANGLED_NAIL mangled nail
> 2.30 MANGLED_OFF mangled off
> 2.30 MANGLED_PLEASE mangled please
> 2.30 MANGLED_WORKS mangled work(s)
> 2.30 MANGLED_YOUR mangled your
> 1.50 MIME_ASCII0 Message body contains ASCII-0 character
> 0.50 MIME_BAD_LINEBREAK Message body with fishy line breaks
> 0.20 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in headers
> 0.50 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
> 0.50 ONE_WORD_SUBJECT Subject with only one lower-case word

-- char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}