Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. SpamAssassin>
  3. users
Spam labeled
jk at jkart
Mar 15, 2004, 10:47 AM
Post #1 of 13 (1198 views)
Permalink
Hallo und guten Tag spamassassin-users,

why is this marked as spam?

--snip
Subject: AW: ++SPAM++ Hast Du am 15. Mai Zeit?
Date: Mon, 15 Mar 2004 15:34:42 +0100
Message-ID: <006801c40a9a$a817f440$0c01a8c0@gibgas.de>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0069_01C40AA3.09DC5C40"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To: <001b01c40a9a$4de19fd0$fe78a8c0@sndg80000156>
X-Loop-Detect:1
X-Virus-scanned: by server1
X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5 tests=BAYES_00,
HTML_50_60, HTML_MESSAGE, MAILTO_LINK
X-Spam-Level:
--snap

--
Viele Grüße, Kind regards,
Jim Knuth
jk@jkart.de
----------
Zufalls-Zitat
----------
Im Alter hat nur das Bestand, was vor dem Kind, das man war, bestanden hätte.
----------
Dieser Text hat nichts mit dem Empfänger der Mail zu tun
----------

virengeprüft mit NOD32 Version 1.667 Update 15.03.2004
Re: Spam labeled [ In reply to ]
cmt-spamassassin at someone
Mar 15, 2004, 11:00 AM
Post #2 of 13 (1195 views)
Permalink
Jim Knuth said:
> Hallo und guten Tag spamassassin-users,
>
> why is this marked as spam?
>

Hello Jim,

In fact this email is NOT marked as spam:

X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
tests=BAYES_00, HTML_50_60, HTML_MESSAGE, MAILTO_LINK

Perhaps you have somehow run this message through SA two times, the first
time it marked it spam (and wrapped the email, changing the subject) and
the second time it did not mark it as spam (because of different headers)?

> --snip
> Subject: AW: ++SPAM++ Hast Du am 15. Mai Zeit?

> X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
> tests=BAYES_00,
> HTML_50_60, HTML_MESSAGE, MAILTO_LINK



--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam
phrases(0BFU$C/\TED SPA/\/\ P|-|RA$ES): http://www.sandgnat.com/cmos/
Keep up to date with the latest third party SpamAssassin Rulesets:
http://www.exit0.us/index.php/RulesDuJour
Re: Spam labeled [ In reply to ]
mailings02 at ttlexceeded
Mar 15, 2004, 11:11 AM
Post #3 of 13 (1195 views)
Permalink
Chris Thielen wrote:

> [...]
> In fact this email is NOT marked as spam:
>
> X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
> tests=BAYES_00, HTML_50_60, HTML_MESSAGE, MAILTO_LINK
>
> Perhaps you have somehow run this message through SA two times, the first
> time it marked it spam (and wrapped the email, changing the subject) and
> the second time it did not mark it as spam (because of different headers)?
>
>
>>--snip
>>Subject: AW: ++SPAM++ Hast Du am 15. Mai Zeit?

If SA had add marked this subject, the ++SPAM++ would've appeared BEFORE
the AW:, right?

>>X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
>>tests=BAYES_00,
>> HTML_50_60, HTML_MESSAGE, MAILTO_LINK


- Bob
Re: Spam labeled [ In reply to ]
cmt-spamassassin at someone
Mar 15, 2004, 11:20 AM
Post #4 of 13 (1194 views)
Permalink
Bob George said:
> Chris Thielen wrote:

>>>Subject: AW: ++SPAM++ Hast Du am 15. Mai Zeit?
>
> If SA had add marked this subject, the ++SPAM++ would've appeared BEFORE
> the AW:, right?
>
>>>X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
>>>tests=BAYES_00,
>>> HTML_50_60, HTML_MESSAGE, MAILTO_LINK

Yep, I believe so... unless there are some other programs in the chain
manipulating the email as well. Hard to say without knowing the server's
configuration.

--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam
phrases(0BFU$C/\TED SPA/\/\ P|-|RA$ES): http://www.sandgnat.com/cmos/
Keep up to date with the latest third party SpamAssassin Rulesets:
http://www.exit0.us/index.php/RulesDuJour
Re: Spam labeled [ In reply to ]
mkettler at evi-inc
Mar 15, 2004, 11:31 AM
Post #5 of 13 (1195 views)
Permalink
At 12:47 PM 3/15/2004, Jim Knuth wrote:
>Hallo und guten Tag spamassassin-users,
>
>why is this marked as spam?

At casual glance, it looks like a double-scan problem, but you didn't
include enough of the email to see what really happened.

If you run spam through SA twice, and use encapsulation the following can
happen:

The first pass scores high enough to tag, the message gets taged and
encapsulated. An X-Spam-Status headers is added, declaring the message spam.

The second time through SA, the headers are now different, and the message
scores lower. The X-Spam-Status gets over-written with the new one, this
one declaring the message not-spam, although the message is already marked
and encapsulated by the first scan.

Compare the list of tests matched in the body report compared to the
X-Spam-Status.. if they differ, it's almost certainly a double-scanned message.
Re: Spam labeled [ In reply to ]
jk at jkart
Mar 15, 2004, 11:43 AM
Post #6 of 13 (1195 views)
Permalink
Hallo und guten Abend Chris,

danke für die Email vom 15.03.2004 um 19:20
Chris Thielen schrieb - wrote:


> Yep, I believe so... unless there are some other programs in the chain
> manipulating the email as well. Hard to say without knowing the server's
> configuration.

the mails going through postfix => amavisd-new, not spamc - spamd.


--
Viele Grüße, Kind regards,
Jim Knuth
jk@jkart.de
----------
Zufalls-Zitat
----------
Wenn sich unsere Generation erst mal an die Radioaktivität
gewöhnt hat...
ich habe' keine Angst, dann leuchte ich eben in der Nacht.
(Gloria v. Thurn u. Taxis)
----------
Dieser Text hat nichts mit dem Empfänger der Mail zu tun
----------

virengeprüft mit NOD32 Version 1.667 Update 15.03.2004
Re: Spam labeled [ In reply to ]
jdow at earthlink
Mar 15, 2004, 12:44 PM
Post #7 of 13 (1198 views)
Permalink
From: "Jim Knuth" <jk@jkart.de>

> Hallo und guten Tag spamassassin-users,
>
> why is this marked as spam?

It's not tagged as spam. The spam level is zero asterisks. Bayes declared
it was very likely not spam. A couple possibly spammish rules were
triggered. But it dodn't come up to any sort of a spam level.

Now, was it tagged at YOUR site or some other site? I note the order of
subject suggests it was tagged as spam THEN the "AW:" was added. (Or
else you have an overactive procmail script or eqivalent that sees
"X-Spam-Level:" tagged onto a message and tosses "++SPAM++" into the
subject. I'm used to seeing spam tagged in a slightly different format
without the "AW:" in front of the spam tag.)

{^_^}

> --snip
> Subject: AW: ++SPAM++ Hast Du am 15. Mai Zeit?
> Date: Mon, 15 Mar 2004 15:34:42 +0100
> Message-ID: <006801c40a9a$a817f440$0c01a8c0@gibgas.de>
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="----=_NextPart_000_0069_01C40AA3.09DC5C40"
> X-Priority: 3 (Normal)
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0)
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> Importance: Normal
> In-Reply-To: <001b01c40a9a$4de19fd0$fe78a8c0@sndg80000156>
> X-Loop-Detect:1
> X-Virus-scanned: by server1
> X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
tests=BAYES_00,
> HTML_50_60, HTML_MESSAGE, MAILTO_LINK
> X-Spam-Level:
> --snap
>
> --
> Viele Grüße, Kind regards,
> Jim Knuth
> jk@jkart.de
> ----------
> Zufalls-Zitat
> ----------
> Im Alter hat nur das Bestand, was vor dem Kind, das man war, bestanden
hätte.
> ----------
> Dieser Text hat nichts mit dem Empfänger der Mail zu tun
> ----------
>
> virengeprüft mit NOD32 Version 1.667 Update 15.03.2004
Re: Spam labeled [ In reply to ]
mailings02 at ttlexceeded
Mar 15, 2004, 1:01 PM
Post #8 of 13 (1194 views)
Permalink
Jim Knuth wrote:
> [...]
> the mails going through postfix => amavisd-new, not spamc - spamd.

Jim, is it possible that's a RESPONSE to a message that was flagged as
spam? I notice the AW: (Re:) BEFORE the ++SPAM++ tag, and the message
headers contain:

<001b01c40a9a$4de19fd0$fe78a8c0 <at> sndg80000156>

Perhaps THAT message is the spam, and this was a reply (auto-generated_
to that? You're going to have to send us the full message headers to
figure out much more.

- Bob
Re: Spam labeled [ In reply to ]
cmt-spamassassin at someone
Mar 15, 2004, 1:04 PM
Post #9 of 13 (1192 views)
Permalink
Jim Knuth said:

>> Yep, I believe so... unless there are some other programs in the chain
>> manipulating the email as well. Hard to say without knowing the
>> server's
>> configuration.
>
> the mails going through postfix => amavisd-new, not spamc - spamd.

Jim,

As others have suggested, this may be occurring somewhere outside your own
server. Can you open the encapsulated message inside the email message
you posted and check that message's headers?

--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam
phrases(0BFU$C/\TED SPA/\/\ P|-|RA$ES): http://www.sandgnat.com/cmos/
Keep up to date with the latest third party SpamAssassin Rulesets:
http://www.exit0.us/index.php/RulesDuJour
Re: Spam labeled [ In reply to ]
jk at jkart
Mar 15, 2004, 1:47 PM
Post #10 of 13 (1197 views)
Permalink
Hallo und guten Abend jdow,

danke für die Email vom 15.03.2004 um 20:44
jdow schrieb - wrote:

> Now, was it tagged at YOUR site or some other site? I note the order of
> subject suggests it was tagged as spam THEN the "AW:" was added. (Or
> else you have an overactive procmail script or eqivalent that sees
> "X-Spam-Level:" tagged onto a message and tosses "++SPAM++" into the
> subject. I'm used to seeing spam tagged in a slightly different format
> without the "AW:" in front of the spam tag.)


thanx, but I`ll wait if this comes again. .. and than. ;-)

--
Viele Grüße, Kind regards,
Jim Knuth
jk@jkart.de
----------
Zufalls-Zitat
----------
"Ich habe die Länge und Breite dieses Landes bereist und mit den besten Leuten geredet,
und ich kann Ihnen versichern, daß Datenverarbeitung ein Tick ist, welcher dieses Jahr nicht überleben wird." Der Chef des US-Verlages Prentice Hall, 1957
----------
Dieser Text hat nichts mit dem Empfänger der Mail zu tun
----------

virengeprüft mit NOD32 Version 1.668 Update 15.03.2004
Re: Spam labeled [ In reply to ]
eccles at mira
Mar 15, 2004, 9:40 PM
Post #11 of 13 (1197 views)
Permalink
On Mon, 15 Mar 2004 14:04:11 -0600 (CST), Chris Thielen wrote:

>As others have suggested, this may be occurring somewhere outside your own
>server. Can you open the encapsulated message inside the email message
>you posted and check that message's headers?

This thread highlights the danger of setting up your MTA or MUA filters
to trigger on a spam flag in the Subject line instead of the
X-Spam-Status or X-Spam-Level headers. The Subject may have been
modified by someone else's spam engine before it arrived at your door
(or even by your own SA on a previous iteration, if this is a reply to
a reply), while the X-Spam-* headers are inserted locally and reflect
only what your own SA installation decided this time around.
Re: Spam labeled [ In reply to ]
kdeugau at webhart
Mar 16, 2004, 9:12 AM
Post #12 of 13 (1198 views)
Permalink
Jim Knuth wrote:
> why is this marked as spam?
>
> --snip
> Subject: AW: ++SPAM++ Hast Du am 15. Mai Zeit?
[snip]
> X-Spam-Status: No, hits=-4.7 tagged_above=-9999.9 required=2.5
^^^^^^^^^^^^^^^^^^^^
Nobody else seems to have noticed this- it looks like whatever you're
using to call SA has been set up to tag everything.

-4.7 > -9999

-kgd
--
"Sendmail administration is not black magic. There are legitimate
technical reasons why it requires the sacrificing of a live chicken."
- Unknown
Re: Spam labeled [ In reply to ]
mailings02 at ttlexceeded
Mar 16, 2004, 9:25 AM
Post #13 of 13 (1193 views)
Permalink
Kris Deugau wrote:
> [...]
> Nobody else seems to have noticed this- it looks like whatever you're
> using to call SA has been set up to tag everything.
>
> -4.7 > -9999

As non-spam though.

- Bob

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal