simple question!!! Why?

Thu Apr 29 11:46:38 IST 2004

Idan Plotnik wrote:
> Hi All,
>
> I hope someone will by able to answer my simple question, the attachment
> is a spam mail that I have got and he get this score
> score=2.4 why ???? And how can its happened ?

MailScanner and Spamassassin aren't magic.  It cannot catch 100% of
spam.  This example is what we call a false negative.  It is considered
legitimate mail while it is spam.

Since you provided us with no information about your setup, that is
about how far I can go.  I can only suggest you read the MAQ page
http://www.mailscanner.biz/maq/ , especially the part about
optimization, but please read the whole thing...

Giving more info on your setup would help as well.

>
> I have a lot of examples like this, and a lot of opposite examples that
> a simple mail is recognize as spam and he isnt !

That is what we call false positive.  If you use bayes it should help as
soon as it kicks in (after 200 hams and 200 spams).  There is a section
about that in the MAQ.

BTW this header is weird: > X-MailScanner-Information:X-MailScanner: Not
scanned: please contact your Internet E-Mail Service Provider for details

hth
>
> This is the information from the Mailscanner and the spamassassin about
> this email:
>
>
> Microsoft Mail Internet Headers Version 2.0
> Received: from localhost.localdomain ([10.0.0.4]) by
> exc-srv.dm-rind.rcip.co.il with Microsoft SMTPSVC(5.0.2195.6713);
>          Wed, 28 Apr 2004 17:28:10 +0200
> Received: through eSafe SMTP Relay 1082769548; Wed Apr 28 16:29:50 2004
> Received: from audiogram.mail.pas.earthlink.net
> (audiogram.mail.pas.earthlink.net [207.217.120.253]) by
> localhost.localdomain
>          (8.12.5/8.12.5) with ESMTP id i3SJY5mw010057 for
> <jotopper at rcip.co.il>; Wed, 28 Apr 2004 17:34:19 -0200
> Received: from [61.174.248.65] (helo=61.174.248.65) by
> audiogram.mail.pas.earthlink.net with asmtp (Exim 3.36 #4) id
> 1BIq2z-00022P-00;
>          Wed, 28 Apr 2004 07:28:26 -0700
> Message-ID: <005801c42d90$ff05a04f$f850ae31 at nehh>
> Reply-To: "=?windows-1251?B?UmV5ZXM=?=" <iPLF at sbcglobal.net>"
> From: "=?windows-1251?B?UmV5ZXM=?=" <mfepOAu at vixensplace.com>"
> Subject: =?windows-1251?B?QnVzdHkgbW9tcyBhbmQgYmlnIGMoKWNrIHNvbnMuLg==?=
> Date: Wed, 28 Apr 2004 09:22:49 -0500
> MIME-Version: 1.0
> Content-Type: text/html;
>         charset="windows-1251"
> Content-Transfer-Encoding: 7bit
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2600.0000
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
> X-ELNK-Trace:
> db305808ed97cd2be20a33f9b80bf72f239a348a220c260950bf1b39f15aec713dba715d
> 84806b6d93caf27dac41a8fd350badd9bab72f9c350badd9bab72f9c
> X-MailScanner-Information: Please contact the ISP for more information
> X-MailScanner-Information:X-MailScanner: Not scanned: please contact
> your Internet E-Mail Service Provider for details
> X-MailScanner-SpamCheck: not spam, SpamAssassin (score=2.4, required
> 4,HTML_60_70 0.10, HTML_EVENT_UNSAFE 0.21, HTML_IMAGE_ONLY_02
>          1.44,HTML_IMAGE_RATIO_02 0.50, HTML_WITH_BGCOLOR
> 0.10,MIME_HTML_ONLY 0.10)
> X-MailScanner-SpamScore: ss
> Bcc:
> Return-Path: mfepOAu at vixensplace.com
> X-OriginalArrivalTime: 28 Apr 2004 15:28:10.0225 (UTC)
> FILETIME=[69A67610:01C42D35]
>
>
> BTW
> Where can I configure the RBL for the MailScanner and the SpamAssassin
> and how can I know which one to configure ?

You've got the answer in the MAQ http://www.mailscanner.biz/maq/#howtocustom
>
>
> Thanks a lot.
>
>
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> For further info about MailScanner, please see the Most Asked
> Questions at    http://www.mailscanner.biz/maq/     and the archives
> at    http://www.jiscmail.ac.uk/lists/mailscanner.html
>
>
> ------------------------------------------------------------------------
>
> Subject:
> Busty moms and big c()ck sons..
> From:
> "Reyes" <mfepOAu at vixensplace.com>
> Date:
> Wed, 28 Apr 2004 17:22:49 +0300
>
> X-MimeOLE:
> Produced By Microsoft Exchange V6.0.6375.0
> content-class:
> urn:content-classes:message
> MIME-Version:
> 1.0
> Content-Type:
> text/plain; charset="Windows-1251"
> Content-Transfer-Encoding:
> quoted-printable
> Message-ID:
> <005801c42d90$ff05a04f$f850ae31 at nehh>
> Thread-Topic:
> Busty moms and big c()ck sons..
> Thread-Index:
> AcQtNWmrqiMa0NwvR8eTqX61EsRqpQ==
> Reply-To:
> "Reyes" <iPLF at sbcglobal.net>
>
>
> Dear Major
>
>
>
> Hot horny babe fingers her pussy
>
>
> Guys get into an unbelievable orgy
>
>   <http://www.derbyallerty.com/bloody/bloo.jpg>
>
>
>  <http://www.derbyallerty.com/bloo.html?lnetfkw> First-time teen gets wet playing with a dildo
>
> Regards Shelton!
>
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> For further info about MailScanner, please see the Most Asked
> Questions at    http://www.mailscanner.biz/maq/     and the archives
> at    http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html