More spam after spamassain upgrade

[John Rudd]

I'm seeing a similar problem.  My production machines are running v 2.43
with MailScanner 4.11-1, and got these scores:

X-UCSC-CATS-MailScanner-SpamCheck: spam, SpamAssassin (score=9.3,
required 8,
        BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML,
        FORGED_RCVD_FOUND, HEADER_8BITS, HTML_70_90,
HTML_FONT_COLOR_GRAY,
        HTML_FONT_COLOR_UNSAFE, HTML_FONT_COLOR_YELLOW,
LINES_OF_YELLING,
        MISSING_MIMEOLE, MSG_ID_ADDED_BY_MTA_2, PRIORITY_NO_NAME,
        SPAM_PHRASE_05_08, TO_LOCALPART_EQ_REAL, X_AUTH_WARNING)


The same message, running through SpamAssassin 2.55 and
MailScanner-4.22-5 gives these scores (I'm in the process of upgrading
right now, so my test machines are running these newer versions):

X-UCSC-KZIN-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.6,
        required 5, CLICK_BELOW 0.10, HEADER_8BITS 1.18, HTML_70_80
0.51,
        HTML_FONT_BIG 0.27, HTML_FONT_COLOR_GRAY 0.10,
        HTML_FONT_COLOR_UNSAFE 0.10, HTML_LINK_CLICK_HERE 0.10,
        HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.10, MISSING_MIMEOLE 0.50,
        MSG_ID_ADDED_BY_MTA_2 0.40, PRIORITY_NO_NAME 0.46,
        X_AUTH_WARNING -0.40)


The current Spam Assassin looks like it has assigned 0's to the
LINES_OF_YELLING scores, for example.

(the spam in question, for those scores, was a gold and silver
investment blurb)

I wonder if it has something to do with which SA options mailscanner is
assuming (bayes, etc.), which might not be selecting the best possible
score sets.


> Stephen Swaney wrote:
>
> Sanjay,
>
> I believe that you should be at version 2.55 of SpamAssassin. This
> should make a difference.
>
> Steve
> Steve Swaney
> Steve at Swaney.com
>
> On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:
>
> > Thanks for the response,
> > Here are the headers. I am using version 2.52
> >
> > SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
> >         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
> >         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
> >         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
> >         ORIGINAL_MESSAGE -0.50)
> >
> > This was the normal buy Norton junk. It should have scored higher.
> >
> > SKP
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
> > Of Martin Sapsed
> > Sent: Thursday, July 24, 2003 7:23 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: More spam after spamassain upgrade
> >
> >
> > Sanjay K. Patel wrote:
> > > We are seeing more spam getting through after upgrading spam assassin to
> > the
> > > latest version. Even the buy Norton cheap spam is getting through. All the
> > > spam scores below our threshold of 5.
> > >
> > > Have the spammers got smarter or do we need to fine tune something?
> >
> > Can you post the headers for e.g. a "buy Norton cheap" message which got
> > through - the categories SA lists might help us to advise you. Which
> > version do you mean by "the latest version"? What platform? What version
> > of MailScanner etc etc
> >
> > I'm using a copy of 2.60 from a little while ago along with DCC (with
> > it's score raised) and virtually nothing gets passed that.
> >
> > Cheers
> >
> > Martin
> >
> > --
> > Martin Sapsed
> > Information Services               "Who do you say I am?"
> > University of Wales, Bangor             Jesus of Nazareth
> >