Mailing List Archive: USER_IN_BLACKLIST / AWL

USER_IN_BLACKLIST / AWL - what controls these scores?

Feb 11, 2004, 4:45 PM

Post #1 of 3 (1965 views)

Where can I find what has been automatically added to SA's
whitelist/blacklist?

I know I'm not manually putting anything in there, so I'm guessing that
it's bayes or something else building them?

I ask because my really high-scoring spam is getting so many points because
of USER_IN_BLACKLIST=100points, but when I went to investigate (out of
curiosity) I find they also have an AWL negative score, which confuses
me. Why would a message have both?

X-Spam-Report:
* 0.7 SUBJ_FOR_ONLY Subject contains "For Only"
* 0.4 FVGT_b_NOLONGERRECV BODY: FVGT - talks about no longer receiving
* 2.0 EvilNumber_A_7XX_1 BODY: Message contains phone number or
address pulled from spam
* 0.3 HTML_WEB_BUGS BODY: Image tag intended to identify you
* 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
* [score: 0.5152]
* 1.2 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.1 HTML_LINK_CLICK_HERE BODY: HTML link text says "click here"
* 1.1 HTML_IMAGE_ONLY_04 BODY: HTML: images with 200-400 bytes of words
* 2.0 WLS_URI_3521 URI: URI contains imgehost.com
* 3.0 BigEvilList_95 URI: Generated BigEvilList_95
* 2.0 WLS_URI_6798 URI: URI contains youdidto.com
* 100 USER_IN_BLACKLIST From: address is in the user's black-list
* 0.0 CLICK_BELOW Asks you to click below
* -18 AWL AWL: Auto-whitelist adjustment

I'm training bayes, but don't have any manual white or blacklists I
maintain myself. So SA's got to be making them itself. But how? :)

TIA

-JR

Re: USER_IN_BLACKLIST / AWL - what controls these scores? [ In reply to ]

mkettler_sa at comcast

Feb 12, 2004, 7:56 AM

Post #2 of 3 (1917 views)

Permalink

At 03:45 PM 2/11/04 -0800, JR wrote:

>Where can I find what has been automatically added to SA's
>whitelist/blacklist?
>
>I know I'm not manually putting anything in there, so I'm guessing that
>it's bayes or something else building them?
>
>I ask because my really high-scoring spam is getting so many points
>because of USER_IN_BLACKLIST=100points, but when I went to investigate
>(out of curiosity) I find they also have an AWL negative score, which
>confuses me. Why would a message have both?

USER_IN_BLACKLIST is part of a completely separate system than the AWL.

USER_IN_BLACKLIST results from a match of a blacklist_from stamtent in your
local.cf or user_prefs. These MUST be placed there manualy.. SA does NOT
add them automatically, or via any command-line.

The AWL doesn't work by automatcaly adding senders to a whitelist or a
blacklist. It's VERY different than that. At the most basic level, the AWL
is a score averaging system.

I'd recomend some reading of the wiki for info on how the AWL works.

http://wiki.spamassassin.org/w/AutoWhitelist

It's also important to understand that a negative score given by the awl
does not mean the AWL thinks the email isn't spam. It just thinks the
current score is more spammy than past spam from the same sender.

http://wiki.spamassassin.org/w/AwlWrongWay

Re: USER_IN_BLACKLIST / AWL - what controls these scores? [ In reply to ]

alerts at nu-designs

Feb 12, 2004, 10:57 AM

Post #3 of 3 (1920 views)

Permalink

At 09:56 AM (-0500) 2/12/2004 (Thursday), Matt Kettler wrote:

>USER_IN_BLACKLIST results from a match of a blacklist_from stamtent in
>your local.cf or user_prefs. These MUST be placed there manualy.. SA does
>NOT add them automatically, or via any command-line.

So how is it getting triggered if I know for absolutely certainty that I
have not manually defined any blacklist hosts? :-)

This is the extent of what is in my /etc/mail/spamassassin/local.cf:

rewrite_subject 1
subject_tag LIKELY SPAM:
report_safe 0
use_razor2 0
use_bayes 1
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam -3.5
bayes_auto_learn_threshold_spam 12.0
skip_rbl_checks 1
use_dcc 0
use_pyzor 0
score X_OSIRU_OPEN_RELAY 0.001
score RCVD_IN_ORBS 0.001

The contents of
/var/CommuniGate/Settings/SpamAssassin/.spamassassin/user_prefs is only the
default file (all lines commented out).

>The AWL doesn't work by automatcaly adding senders to a whitelist or a
>blacklist. It's VERY different than that. At the most basic level, the AWL
>is a score averaging system. I'd recomend some reading of the wiki for
>info on how the AWL works.

Cool thanks. Interesting stuff.
Now I can tease my boss that AWL has him tagged with 7.3. LOL!

--JR