MailScanner & SURBL / URIBL and SPF checks]

Stijn Jonker SJCJonker at SJC.NL
Tue Oct 26 16:55:01 IST 2004


    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Oeps,

Just found out i didn't copy the list.

-------- Original Message --------
Subject: Re: MailScanner & SURBL / URIBL and SPF checks
Date: Tue, 26 Oct 2004 10:55:20 +0200
From: Stijn Jonker <SJCJonker at SJC.nl>
To: Raymond Dijkxhoorn <raymond at prolocation.net>
References: <417E080A.3060805 at SJC.nl>
<Pine.LNX.4.61.0410261022510.29843 at mailbox.prolocation.net>

Raymond,

Thanks for the response, well I ran SA --lint and SA --test on a
message, and indeed it lists the following:

debug: uri found: http://www.valuate.biz/red/s4.gif
debug: uri found: http://www.valuate.biz/red/s3.gif
debug: uri found: http://www.valuate.biz/red/s2.jpg
debug: uri found: http://www.valuate.biz/o/
debug: uri found: http://www.valuate.biz/red/sc.htm
debug: uri found: http://www.valuate.biz/red/s1.gif
debug: URIDNSBL: domains to query: valuate.biz
debug: is Net::DNS::Resolver available? yes
<<SNIP>>

And that's it. Full output is attached.

And I just checked again, valuate.biz is listed in ws.surbl.org, my
score for that is: 50_scores.cf:score URIBL_WS_SURBL 0 0.539 0 1.462

So it should run (fyi, this is the default file/value for the score.)

Stijn

Raymond Dijkxhoorn said the following on 26/10/2004 10:23:
> Hi Stijn,
>
>> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL and
>> loadplugin Mail::SpamAssassin::Plugin::SPF
>> first in /etc/mail/spamassassin/local.cf then moved it to:
>> /etc/MailScanner/spam.assassin.prefs.conf
>>
>> But whatever I do i don't see any hits on the rules with URIBL/SURBL and
>> or SPF. Although I couldn't find it back in the list I believe i need
>> the latest beta for SPF support, but URIBL should work.
>>
>> I check some of the spam only minutes after they where received on
>> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
>> listed in one or more lists.
>>
>> The only rule scoring I modified in local.cf is:
>> score ALL_TRUSTED 0
>
>
> What does a SA --lint tell you ?
>
>> Is there somebody who can offer some adivce on how to troubleshoot
>> and/or find the culprit for this?
>
>
> Bye,
> Raymond.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker at sjc.nl>


--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker at sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

debug: SpamAssassin version 3.0.1
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to: /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/70_sare_adult.cf
debug: config: read file /etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf
debug: config: read file /etc/mail/spamassassin/70_sare_header.cf
debug: config: read file /etc/mail/spamassassin/70_sare_html.cf
debug: config: read file /etc/mail/spamassassin/70_sare_oem.cf
debug: config: read file /etc/mail/spamassassin/70_sare_random.cf
debug: config: read file /etc/mail/spamassassin/70_sare_ratware.cf
debug: config: read file /etc/mail/spamassassin/70_sare_specific.cf
debug: config: read file /etc/mail/spamassassin/70_sare_spoof.cf
debug: config: read file /etc/mail/spamassassin/72_sare_bml_post25x.cf
debug: config: read file /etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf
debug: config: read file /etc/mail/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /etc/mail/spamassassin/antidrug.cf
debug: config: read file /etc/mail/spamassassin/bogus-virus-warnings.cf
debug: config: read file /etc/mail/spamassassin/evilnumbers.cf
debug: config: read file /etc/mail/spamassassin/local.cf
debug: config: read file /etc/mail/spamassassin/random.cf
debug: config: read file /etc/mail/spamassassin/tripwire.cf
debug: using "/root/.spamassassin" for user state dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x99ec8a4)
debug: bayes: 26016 tie-ing to DB file R/O /var/spool/spamassassin/bayes_toks
debug: bayes: 26016 tie-ing to DB file R/O /var/spool/spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: Score set 3 chosen.
debug: received-header: parsed as [ ip=192.168.253.1 rdns=hn00dmz01.sjc.nl helo=hn00dmz01.sjc.nl by=hn00srv01.sjc.nl ident= envfrom= intl=0 id=8577618014 ]
debug: received-header: parsed as [ ip=192.168.253.254 rdns=hn00sia01.sjc.nl helo=hn00sia01.sjc.nl by=hn00dmz01.sjc.nl ident= envfrom= intl=0 id=i9Q8XXia024995 ]
debug: received-header: parsed as [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=hn00sia01.sjc.nl ident= envfrom= intl=0 id=A0E088023 ]
debug: dns_available set to yes in config file, skipping test
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: looking up PTR record for '69.6.24.71'
debug: PTR for '69.6.24.71': 'mx2.valuate.biz'
debug: received-header: parsed as [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=jk271w.mx2.valuate.biz ident= envfrom= intl=0 id= ]
debug: looking up A records for 'hn00srv01.sjc.nl'
debug: A records for 'hn00srv01.sjc.nl': 192.168.175.1
debug: received-header: 'from' 192.168.253.1 has reserved IP
debug: received-header: 'from' 192.168.253.1 is near to first 'by'
debug: received-header: relay 192.168.253.1 trusted? yes internal? no
debug: received-header: 'from' 192.168.253.254 has reserved IP
debug: received-header: 'from' 192.168.253.254 is near to first 'by'
debug: received-header: relay 192.168.253.254 trusted? yes internal? no
debug: looking up A records for 'hn00sia01.sjc.nl'
debug: A records for 'hn00sia01.sjc.nl': 192.168.253.254 192.168.175.254
debug: received-header: 'by' hn00sia01.sjc.nl has reserved IP 192.168.253.254
debug: received-header: 'by' hn00sia01.sjc.nl has reserved IP 192.168.175.254
debug: received-header: 'by' hn00sia01.sjc.nl has no public IPs
debug: received-header: relay 69.6.24.71 trusted? yes internal? no
debug: looking up A records for 'jk271w.mx2.valuate.biz'
debug: A records for 'jk271w.mx2.valuate.biz':
debug: received-header: relay 69.6.24.71 trusted? no internal? no
debug: metadata: X-Spam-Relays-Trusted: [ ip=192.168.253.1 rdns=hn00dmz01.sjc.nl helo=hn00dmz01.sjc.nl by=hn00srv01.sjc.nl ident= envfrom= intl=0 id=8577618014 ] [ ip=192.168.253.254 rdns=hn00sia01.sjc.nl helo=hn00sia01.sjc.nl by=hn00dmz01.sjc.nl ident= envfrom= intl=0 id=i9Q8XXia024995 ] [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=hn00sia01.sjc.nl ident= envfrom= intl=0 id=A0E088023 ]
debug: metadata: X-Spam-Relays-Untrusted: [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=jk271w.mx2.valuate.biz ident= envfrom= intl=0 id= ]
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c) implements 'parsed_metadata'
debug: ---- MIME PARSER START ----
debug: main message type: multipart/alternative
debug: parsing multipart, got boundary: ----=_NextPart_2548111434867620825622456472163
debug: found part of type text/plain, boundary: ----=_NextPart_2548111434867620825622456472163
debug: parsing normal part
debug: added part, type: text/plain
debug: found part of type text/html, boundary: ----=_NextPart_2548111434867620825622456472163
debug: parsing normal part
debug: added part, type: text/html
debug: ---- MIME PARSER END ----
debug: decoding: other encoding type (7bit), ignoring
debug: decoding: quoted-printable
debug: uri found: http://www.valuate.biz/red/s4.gif
debug: uri found: http://www.valuate.biz/red/s3.gif
debug: uri found: http://www.valuate.biz/red/s2.jpg
debug: uri found: http://www.valuate.biz/o/
debug: uri found: http://www.valuate.biz/red/sc.htm
debug: uri found: http://www.valuate.biz/red/s1.gif
debug: URIDNSBL: domains to query: valuate.biz
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: all '*From' addrs: research at valuate.biz
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: all '*To' addrs: spam at sjc.nl bestuur at ospylac.com sjonker at hn00srv01.sjc.nl
debug: forged-HELO: from=valuate.biz helo=valuate.biz by=valuate.biz
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: bayes corpus size: nspam = 1331, nham = 3081
debug: tokenize: header tokens for *p = "U*research D*valuate.biz D*biz"
debug: tokenize: header tokens for *m = "  lyyk1 07h3rm4 mx2 valuate biz "
debug: tokenize: header tokens for To = "U*bestuur D*ospylac.com D*com"
debug: tokenize: header tokens for MIME-Version = " "
debug: tokenize: header tokens for X-Encoding = " MIME"
debug: tokenize: header tokens for *c = " multipart/alternative;   ----=_ NHxtPHrt _ HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH"
debug: tokenize: header tokens for *F = "U*research D*valuate.biz D*biz"
debug: tokenize: header tokens for *RT = " [ ip=192.168.253.1 rdns=hn00dmz01.sjc.nl helo=hn00dmz01.sjc.nl by=hn00srv01.sjc.nl ident= envfrom= intl=0 id=8577618014 ] [ ip=192.168.253.254 rdns=hn00sia01.sjc.nl helo=hn00sia01.sjc.nl by=hn00dmz01.sjc.nl ident= envfrom= intl=0 id=i9Q8XXia024995 ] [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=hn00sia01.sjc.nl ident= envfrom= intl=0 id=A0E088023 ]"
debug: tokenize: header tokens for *RU = " [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=jk271w.mx2.valuate.biz ident= envfrom= intl=0 id= ]"
debug: tokenize: header tokens for *r = "   mx2.valuate.biz [69.6.24 ip*69.6.24.71 ] by jk271w.mx2.valuate.biz    ; "
debug: tokenize: header tokens for *r = "   mx2.valuate.biz [69.6.24 ip*69.6.24.71 ] by jk271w.mx2.valuate.biz    ;     mx2.valuate.biz (mx2.valuate.biz [69.6.24 ip*69.6.24.71 ]) by hn00sia01.sjc.nl (SJCMailer)         <bestuur at ospylac.com>; "
debug: bayes token 'HTo:U*bestuur' => 0.999197089926881
debug: bayes token 'H*r:sk:bestuur' => 0.999158962802908
debug: bayes token 'bertrand' => 0.988731707317073
debug: bayes token 'russell' => 0.985096774193548
debug: bayes token 'H*m:biz' => 0.985096774193548
debug: bayes token 'H*c:sk:HHHHHHH' => 0.981126161868103
debug: bayes token 'H*m:mx2' => 0.978
debug: bayes token 'H*MI:mx2' => 0.978
debug: bayes token 'H*r:69.6.24' => 0.978
debug: bayes token 'UD:gif' => 0.941293855903048
debug: bayes token 'H*c:alternative' => 0.936477375940418
debug: bayes token 'H*RT:sk:hn00srv' => 0.0674039579417098
debug: bayes token 'H*MI:biz' => 0.917309925256388
debug: bayes token 'UD:biz' => 0.903253460268809
debug: bayes token 'H*F:D*biz' => 0.895378967698394
debug: bayes token 'H*c:multipart' => 0.885275398348535
debug: bayes token 'HTo:D*ospylac.com' => 0.884884362062149
debug: bayes token 'precise' => 0.865927036864467
debug: bayes token 'Keep' => 0.865927036864467
debug: bayes token 'UD:htm' => 0.135568949647952
debug: bayes token 'realize' => 0.153891590678825
debug: bayes: score = 0.999952096435384
debug: bayes: 26016 untie-ing
debug: bayes: 26016 untie-ing db_toks
debug: bayes: 26016 untie-ing db_seen
debug: madiff: left: 0, orig: 18, max-difference: 0.00%
debug: Razor2 is available
debug: entering helper-app run mode
 Razor-Log: Computed razorhome from env: /root/.razor
 Razor-Log: Found razorhome: /root/.razor
 Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
Oct 26 10:50:34.734031 check[26016]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout
Oct 26 10:50:34.734379 check[26016]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity-rumJH0SFB6
Oct 26 10:50:34.734508 check[26016]: [ 8] Client supported_engines: 4 8
Oct 26 10:50:34.735167 check[26016]: [ 8]  prep_mail done: mail 1 headers=1130, mime0=223, mime1=876
Oct 26 10:50:34.735408 check[26016]: [ 5] read_file: 1 items read from /root/.razor/servers.discovery.lst
Oct 26 10:50:34.735621 check[26016]: [ 5] read_file: 2 items read from /root/.razor/servers.nomination.lst
Oct 26 10:50:34.735851 check[26016]: [ 5] read_file: 3 items read from /root/.razor/servers.catalogue.lst
Oct 26 10:50:34.736081 check[26016]: [ 9] Assigning defaults to folly.cloudmark.com
Oct 26 10:50:34.736196 check[26016]: [ 9] Assigning defaults to joy.cloudmark.com
Oct 26 10:50:34.736311 check[26016]: [ 9] Assigning defaults to pride.cloudmark.com
Oct 26 10:50:34.736422 check[26016]: [ 9] Assigning defaults to thrill.cloudmark.com
Oct 26 10:50:34.736535 check[26016]: [ 9] Assigning defaults to wonder.cloudmark.com
Oct 26 10:50:34.737237 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:50:34.737685 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:50:34.738095 check[26016]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:50:34.738481 check[26016]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:50:34.738894 check[26016]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:50:34.739306 check[26016]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:50:34.739760 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:50:34.740211 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:50:34.740664 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:50:34.741117 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:50:34.741262 check[26016]: [ 5] 107614 seconds before closest server discovery
Oct 26 10:50:34.741386 check[26016]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:50:34.741506 check[26016]: [ 8] Computed supported_engines: 4 8
Oct 26 10:50:34.741596 check[26016]: [ 8] Using next closest server pride.cloudmark.com:2703, cached info srl 5047
Oct 26 10:50:34.741687 check[26016]: [ 8] mail 1 Subject: Test & Keep a Standing Scooter - Product Evaluators Wanted
Oct 26 10:50:34.741894 check[26016]: [ 6] preproc: mail 1.0 went from 223 bytes to 109
Oct 26 10:50:34.742194 check[26016]: [ 6] preproc: mail 1.1 went from 876 bytes to 142
Oct 26 10:50:34.742280 check[26016]: [ 6] computing sigs for mail 1.0, len 109
Oct 26 10:50:34.743322 check[26016]: [ 6] Engine (8) didn't produce a signature for mail 1.0
Oct 26 10:50:34.743407 check[26016]: [ 6] computing sigs for mail 1.1, len 142
Oct 26 10:50:34.744921 check[26016]: [ 6] skipping whitelist file (empty?): /root/.razor/razor-whitelist
Oct 26 10:50:34.745018 check[26016]: [ 5] Connecting to pride.cloudmark.com ...
Oct 26 10:50:35.074238 check[26016]: [ 8] Connection established
Oct 26 10:50:35.074368 check[26016]: [ 4] pride.cloudmark.com >> 36 server greeting: sn=C&srl=5047&a=l&a=cg&ep4=7542-10
Oct 26 10:50:35.074650 check[26016]: [ 4] pride.cloudmark.com << 25
Oct 26 10:50:35.074707 check[26016]: [ 6] cn=razor-agents&cv=2.61
Oct 26 10:50:35.074865 check[26016]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:50:35.075debug: Using results from Razor v2.61
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=100
debug: Found Razor2 part: part=1 engine=4 ct=0 cf=0
debug: Found Razor2 part: part=1 engine=8 ct=0 cf=100
debug: leaving helper-app run mode
009 check[26016]: [ 8] Computed supported_engines: 4 8
Oct 26 10:50:35.075164 check[26016]: [ 8] mail 1.0 e4 sig: nvT1d_x3zw73ehk2QSuexAFcuCwA
Oct 26 10:50:35.075263 check[26016]: [ 5] mail 1.0 e8 got no sig
Oct 26 10:50:35.075332 check[26016]: [ 8] mail 1.1 e4 sig: bsPQfWaR_2tr03XqGdTmgkVLRq4A
Oct 26 10:50:35.075418 check[26016]: [ 8] mail 1.1 e8 sig: f2oCGwgpsXIA
Oct 26 10:50:35.075530 check[26016]: [ 8] preparing 3 queries
Oct 26 10:50:35.075766 check[26016]: [ 8] sending 1 batches
Oct 26 10:50:35.075876 check[26016]: [ 4] pride.cloudmark.com << 132
Oct 26 10:50:35.075928 check[26016]: [ 6] -a=c&e=4&ep4=7542-10&s=nvT1d_x3zw73ehk2QSuexAFcuCwA
a=c&e=4&ep4=7542-10&s=bsPQfWaR_2tr03XqGdTmgkVLRq4A
a=c&e=8&s=f2oCGwgpsXIA
.
Oct 26 10:50:35.572800 check[26016]: [ 4] pride.cloudmark.com >> 33
Oct 26 10:50:35.572890 check[26016]: [ 6] response to sent.2
-p=1&cf=100
p=0
p=1&cf=100
.
Oct 26 10:50:35.573242 check[26016]: [ 6] mail 1.0 e=4 sig=nvT1d_x3zw73ehk2QSuexAFcuCwA: Is spam: cf 100 >= min_cf 6
Oct 26 10:50:35.573320 check[26016]: [ 6] mail 1.1 e=4 sig=bsPQfWaR_2tr03XqGdTmgkVLRq4A: sig not found.
Oct 26 10:50:35.573387 check[26016]: [ 6] mail 1.1 e=8 sig=f2oCGwgpsXIA: Is spam: cf 100 >= min_cf 6
Oct 26 10:50:35.573457 check[26016]: [ 7] method 4: mail 1.0: no-contention part, spam=1
Oct 26 10:50:35.573513 check[26016]: [ 7] method 4: mail 1.1: no-contention part, spam=1
Oct 26 10:50:35.573568 check[26016]: [ 7] method 4: mail 1: a non-contention part was spam, mail spam
Oct 26 10:50:35.573624 check[26016]: [ 3] mail 1 is known spam.
Oct 26 10:50:35.573694 check[26016]: [ 5] disconnecting from server pride.cloudmark.com
Oct 26 10:50:35.573807 check[26016]: [ 4] pride.cloudmark.com << 5
Oct 26 10:50:35.573865 check[26016]: [ 6] a=q
debug: Razor2 results: spam? 1  highest cf score: 100
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c) implements 'check_tick'
debug: URIDNSBL: queries completed: 1 started: 2
debug: URIDNSBL: queries active:  at Tue Oct 26 10:50:35 2004
debug: running raw-body-text per-line regexp tests; score so far=7.413
debug: running full-text regexp tests; score so far=7.413
debug: Razor2 is available
debug: Pyzor is available: /usr/bin/pyzor
debug: entering helper-app run mode
debug: setuid: helper proc 26022: ruid=0 euid=0
debug: Pyzor: got response: 217.160.253.84:24441        TimeoutError:
debug: leaving helper-app run mode
debug: Pyzor: couldn't grok response "217.160.253.84:24441      TimeoutError: "
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 26023: ruid=0 euid=0
debug: DCC: got response: X-DCC-sgs_public_dcc_server-Metrics: hn00dmz01.sjc.nl 1199; Body=7 Fuz1=many Fuz2=many
debug: leaving helper-app run mode
debug: DCC: Listed! BODY: 7 of 999999 FUZ1: 999999 of 999999 FUZ2: 999999 of 999999
debug: Running tests for priority: 500
debug: URIDNSBL: queries completed: 2 started: 0
debug: URIDNSBL: queries active:  at Tue Oct 26 10:50:40 2004
debug: RBL: success for 11 of 11 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c) implements 'check_post_dnsbl'
debug: running meta tests; score so far=14.257
debug: running header regexp tests; score so far=14.409
debug: running body-text per-line regexp tests; score so far=14.409
debug: running uri tests; score so far=14.409
debug: running raw-body-text per-line regexp tests; score so far=14.409
debug: running full-text regexp tests; score so far=14.409
debug: Running tests for priority: 1000
debug: running meta tests; score so far=14.409
debug: running header regexp tests; score so far=14.409
debug: running body-text per-line regexp tests; score so far=14.409
debug: running uri tests; score so far=14.409
debug: running raw-body-text per-line regexp tests; score so far=14.409
debug: running full-text regexp tests; score so far=14.409
debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1.
debug: auto-learn: message score: 14.409, computed score for autolearn: 9.776
debug: auto-learn? ham=0.1, spam=12, body-points=9.67, head-points=5.687, learned-points=1.886
debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
debug: is spam? score=14.409 required=5
debug: tests=BAYES_99,BIZ_TLD,DCC_CHECK,DIGEST_MULTIPLE,HTML_80_90,HTML_IMAGE_ONLY_08,HTML_MESSAGE,MIME_BOUND_NEXTPART,MSGID_FROM_MTA_HEADER,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_NJABL_SPAM,RCVD_IN_SBL
debug: subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__HAS_MSGID,__HAS_SUBJECT,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MSGID_BEFORE_RECEIVED,__NEXTPART_ALL,__RCVD_IN_NJABL,__RCVD_IN_SBL_XBL,__RCVD_IN_SORBS,__SANE_MSGID,__SARE_CC_NONE,__SARE_HAS_BG_COLOR,__SARE_HEAD_HDR_RCVD,__SARE_HTML_HAS_A,__SARE_HTML_HAS_FONT,__SARE_HTML_HAS_IMG,__SARE_HTML_HAS_MSG,__SARE_HTML_HAS_P,__SARE_HTML_HAS_TO,__SARE_WHITE_BG_COLOR,__TAG_EXISTS_BODY,__TAG_EXISTS_HTML
Received: from localhost by hn00dmz01.sjc.nl
        with SpamAssassin (version 3.0.1);
        Tue, 26 Oct 2004 10:50:41 +0200
From: Clever Scooter <research at valuate.biz>
To: bestuur at ospylac.com
Subject: Test & Keep a Standing Scooter - Product Evaluators Wanted
Date: Tue, 26 Oct 2004 02:32:29 -0700
Message-Id: <lyyk1.07h3rm4 at mx2.valuate.biz>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on hn00dmz01.sjc.nl
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.4 required=5.0 tests=BAYES_99,BIZ_TLD,DCC_CHECK,
        DIGEST_MULTIPLE,HTML_80_90,HTML_IMAGE_ONLY_08,HTML_MESSAGE,
        MIME_BOUND_NEXTPART,MSGID_FROM_MTA_HEADER,RAZOR2_CF_RANGE_51_100,
        RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_NJABL_SPAM,RCVD_IN_SBL
        autolearn=no version=3.0.1
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_417E0FE1.13A2306E"

This is a multi-part message in MIME format.

------------=_417E0FE1.13A2306E
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "hn00dmz01.sjc.nl", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Everything is vague to a degree you do not realize till
  you have tried to make it precise. Bertrand Russell Everything is vague
  to a degree you do not realize till you have tried to make it precise.
  Bertrand Russell [...]

Content analysis details:   (14.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level domain
 0.1 HTML_80_90             BODY: Message is 80% to 90% HTML
 0.0 HTML_MESSAGE           BODY: HTML included in message
 3.0 HTML_IMAGE_ONLY_08     BODY: HTML: images with 400-800 bytes of words
 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
                            [cf: 100]
 1.9 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 2.2 DCC_CHECK              Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                  [Blocked - see <http://www.spamcop.net/bl.shtml?69.6.24.71>]
 0.1 RCVD_IN_SBL            RBL: Received via a relay in Spamhaus SBL
                            [69.6.24.71 listed in sbl-xbl.spamhaus.org]
 1.8 RCVD_IN_NJABL_SPAM     RBL: NJABL: sender is confirmed spam source
                            [69.6.24.71 listed in combined.njabl.org]
 0.1 DIGEST_MULTIPLE        Message hits more than one network digest check
 0.0 MIME_BOUND_NEXTPART    Spam tool pattern in MIME boundary
 0.1 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.


------------=_417E0FE1.13A2306E
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Return-Path: <research at valuate.biz>
X-Original-To: spam at sjc.nl
Delivered-To: sjonker at hn00srv01.sjc.nl
Received: from hn00dmz01.sjc.nl (hn00dmz01.sjc.nl [192.168.253.1])
        by hn00srv01.sjc.nl (SJCMailer) with ESMTP id 8577618014
        for <spam at sjc.nl>; Tue, 26 Oct 2004 10:33:41 +0200 (CEST)
Received: from hn00sia01.sjc.nl (hn00sia01.sjc.nl [192.168.253.254])
        by hn00dmz01.sjc.nl (8.12.11/8.12.11) with ESMTP id i9Q8XXia024995
        for <bestuur at ospylac.com>; Tue, 26 Oct 2004 10:33:33 +0200
Received: from mx2.valuate.biz (mx2.valuate.biz [69.6.24.71])
        by hn00sia01.sjc.nl (SJCMailer) with SMTP id A0E088023
        for <bestuur at ospylac.com>; Tue, 26 Oct 2004 10:33:30 +0200 (CEST)
Date: Tue, 26 Oct 2004 02:32:29 -0700
Message-Id: <lyyk1.07h3rm4 at mx2.valuate.biz>
Received: from mx2.valuate.biz [69.6.24.71] by jk271w.mx2.valuate.biz with SMTP; Tue, 26 Oct 2004 02:32:29 -0700
To: bestuur at ospylac.com
Subject: Test & Keep a Standing Scooter - Product Evaluators Wanted
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
        boundary="----=_NextPart_2548111434867620825622456472163"
From: Clever Scooter <research at valuate.biz>

This is a multi-part message in MIME format.

------=_NextPart_2548111434867620825622456472163
Content-Type: text/plain;
        charset="us-ascii"
Content-Transfer-Encoding: 7bit

Everything is vague to a degree you do not realize till you have tried to make it precise.
Bertrand Russell


------=_NextPart_2548111434867620825622456472163
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML>
<BODY bgColor=3D#ffffff>
<TABLE cellSpacing=3D0 cellPadding=3D0 width=3D500 align=3Dcenter border=3D=
0>
    <TR>
    <TD colSpan=3D2><A href=3D"http://www.valuate.biz/red/sc.htm"><IMG
      src=3D"http://www.valuate.biz/red/s1.gif" border=3D0></A></TD></TR>
  <TR>
    <TD><IMG src=3D"http://www.valuate.biz/red/s2.jpg"></TD>
    <TD><IMG src=3D"http://www.valuate.biz/red/s3.gif"></TD></TR>
  <TR>
    <TD colSpan=3D2><A href=3D"http://www.valuate.biz/o/"><IMG
      src=3D"http://www.valuate.biz/red/s4.gif"
border=3D0></A></TD></TR></TABLE></p>

<p align=3D"center"><FONT face=3DArial size=3D1><EM>Everything is vague to =
a degree you do not realize till you have tried to make it precise.
Bertrand Russell</EM></FONT></p>
</BODY>
</HTML>

------=_NextPart_2548111434867620825622456472163--



------------=_417E0FE1.13A2306E--

Spam detection software, running on the system "hn00dmz01.sjc.nl", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Everything is vague to a degree you do not realize till
  you have tried to make it precise. Bertrand Russell Everything is vague
  to a degree you do not realize till you have tried to make it precise.
  Bertrand Russell [...]

Content analysis details:   (14.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level domain
 0.1 HTML_80_90             BODY: Message is 80% to 90% HTML
 0.0 HTML_MESSAGE           BODY: HTML included in message
 3.0 HTML_IMAGE_ONLY_08     BODY: HTML: images with 400-800 bytes of words
 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
                            [cf: 100]
 1.9 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 2.2 DCC_CHECK              Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                  [Blocked - see <http://www.spamcop.net/bl.shtml?69.6.24.71>]
 0.1 RCVD_IN_SBL            RBL: Received via a relay in Spamhaus SBL
                            [69.6.24.71 listed in sbl-xbl.spamhaus.org]
 1.8 RCVD_IN_NJABL_SPAM     RBL: NJABL: sender is confirmed spam source
                            [69.6.24.71 listed in combined.njabl.org]
 0.1 DIGEST_MULTIPLE        Message hits more than one network digest check
 0.0 MIME_BOUND_NEXTPART    Spam tool pattern in MIME boundary
 0.1 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 3: "Attached Text" ]

debug: SpamAssassin version 3.0.1
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to: /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: diag: module installed: DBI, version 1.40
debug: diag: module installed: DB_File, version 1.808
debug: diag: module installed: Digest::SHA1, version 2.10
debug: diag: module installed: IO::Socket::UNIX, version 1.21
debug: diag: module installed: MIME::Base64, version 3.03
debug: diag: module installed: Net::DNS, version 0.48
debug: diag: module installed: Net::LDAP, version 0.32
debug: diag: module installed: Razor2::Client::Agent, version 2.61
debug: diag: module installed: Storable, version 2.09
debug: diag: module installed: URI, version 1.34
debug: ignore: using a test message to lint rules
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/70_sare_adult.cf
debug: config: read file /etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf
debug: config: read file /etc/mail/spamassassin/70_sare_header.cf
debug: config: read file /etc/mail/spamassassin/70_sare_html.cf
debug: config: read file /etc/mail/spamassassin/70_sare_oem.cf
debug: config: read file /etc/mail/spamassassin/70_sare_random.cf
debug: config: read file /etc/mail/spamassassin/70_sare_ratware.cf
debug: config: read file /etc/mail/spamassassin/70_sare_specific.cf
debug: config: read file /etc/mail/spamassassin/70_sare_spoof.cf
debug: config: read file /etc/mail/spamassassin/72_sare_bml_post25x.cf
debug: config: read file /etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf
debug: config: read file /etc/mail/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /etc/mail/spamassassin/antidrug.cf
debug: config: read file /etc/mail/spamassassin/bogus-virus-warnings.cf
debug: config: read file /etc/mail/spamassassin/evilnumbers.cf
debug: config: read file /etc/mail/spamassassin/local.cf
debug: config: read file /etc/mail/spamassassin/random.cf
debug: config: read file /etc/mail/spamassassin/tripwire.cf
debug: using "/root/.spamassassin" for user state dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0xac5ca24)
debug: bayes: 25675 tie-ing to DB file R/O /var/spool/spamassassin/bayes_toks
debug: bayes: 25675 tie-ing to DB file R/O /var/spool/spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: Score set 3 chosen.
debug: ---- MIME PARSER START ----
debug: main message type: text/plain
debug: parsing normal part
debug: added part, type: text/plain
debug: ---- MIME PARSER END ----
debug: metadata: X-Spam-Relays-Trusted:
debug: metadata: X-Spam-Relays-Untrusted:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c) implements 'parsed_metadata'
debug: dns_available set to yes in config file, skipping test
debug: decoding: no encoding detected
debug: URIDNSBL: domains to query:
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: all '*From' addrs: ignore at compiling.spamassassin.taint.org
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: all '*To' addrs:
debug: running body-text per-line regexp tests; score so far=0.126
debug: running uri tests; score so far=0.126
debug: bayes corpus size: nspam = 1331, nham = 3081
debug: tokenize: header tokens for *F = "U*ignore D*compiling.spamassassin.taint.org D*spamassassin.taint.org D*taint.org D*org"
debug: tokenize: header tokens for *m = "  1098780229 lint_rules "
debug: tokenize: header tokens for *RT = " "
debug: tokenize: header tokens for *RU = " "
debug: bayes token 'H*Ad:D*org' => 0.000542885973763875
debug: bayes: score = 0.349432821046719
debug: bayes: 25675 untie-ing
debug: bayes: 25675 untie-ing db_toks
debug: bayes: 25675 untie-ing db_seen
debug: Razor2 is available
debug: entering helper-app run mode
 Razor-Log: Computed razorhome from env: /root/.razor
 Razor-Log: Found razorhome: /root/.razor
 Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
Oct 26 10:43:51.022459 check[25675]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout
Oct 26 10:43:51.022868 check[25675]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity-rumJH0SFB6
Oct 26 10:43:51.023042 check[25675]: [ 8] Client supported_engines: 4 8
Oct 26 10:43:51.023341 check[25675]: [ 8]  prep_mail done: mail 1 headers=93, mime0=1376
Oct 26 10:43:51.023622 check[25675]: [ 5] read_file: 1 items read from /root/.razor/servers.discovery.lst
Oct 26 10:43:51.023881 check[25675]: [ 5] read_file: 2 items read from /root/.razor/servers.nomination.lst
Oct 26 10:43:51.024155 check[25675]: [ 5] read_file: 3 items read from /root/.razor/servers.catalogue.lst
Oct 26 10:43:51.024432 check[25675]: [ 9] Assigning defaults to folly.cloudmark.com
Oct 26 10:43:51.024597 check[25675]: [ 9] Assigning defaults to joy.cloudmark.com
Oct 26 10:43:51.024761 check[25675]: [ 9] Assigning defaults to pride.cloudmark.com
Oct 26 10:43:51.024924 check[25675]: [ 9] Assigning defaults to thrill.cloudmark.com
Oct 26 10:43:51.025086 check[25675]: [ 9] Assigning defaults to wonder.cloudmark.com
Oct 26 10:43:51.025851 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:43:51.026357 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:43:51.026801 check[25675]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:43:51.027230 check[25675]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:43:51.027697 check[25675]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:43:51.028151 check[25675]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:43:51.028657 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:43:51.029149 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:43:51.029656 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:43:51.030142 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:43:51.030335 check[25675]: [ 5] 106445 seconds before closest server discovery
Oct 26 10:43:51.030505 check[25675]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:43:51.030668 check[25675]: [ 8] Computed supported_engines: 4 8
Oct 26 10:43:51.030798 check[25675]: [ 8] Using next closest server pride.cloudmark.com:2703, cached info srl 5047
Oct 26 10:43:51.030913 check[25675]: [ 8] mail 1 has no subject
Oct 26 10:43:51.031172 check[25675]: [ 6] preproc: mail 1.0 went from 1376 bytes to 1339
Oct 26 10:43:51.031311 check[25675]: [ 6] computing sigs for mail 1.0, len 1339
Oct 26 10:43:51.032462 check[25675]: [ 6] Engine (8) didn't produce a signature for mail 1.0
Oct 26 10:43:51.032643 check[25675]: [ 6] skipping whitelist file (empty?): /root/.razor/razor-whitelist
Oct 26 10:43:51.032766 check[25675]: [ 5] Connecting to pride.cloudmark.com ...
Oct 26 10:43:51.362553 check[25675]: [ 8] Connection established
Oct 26 10:43:51.362717 check[25675]: [ 4] pride.cloudmark.com >> 36 server greeting: sn=C&srl=5047&a=l&a=cg&ep4=7542-10
Oct 26 10:43:51.363044 check[25675]: [ 4] pride.cloudmark.com << 25
Oct 26 10:43:51.363126 check[25675]: [ 6] cn=razor-agents&cv=2.61
Oct 26 10:43:51.363350 check[25675]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:43:51.363529 check[25675]: [ 8] Computed supported_engines: 4 8
Oct 26 10:43:51.363675 check[25675]: [ 8] mail 1.0 e4 sig: xFaZIZUVHk90OQfARnenjx5BZTMA
Oct 26 10:43:51.363810 check[25675]: [ 5] mail 1.0 e8 got no sig
Oct 26 10:43:51.363929 check[25675]: [ 8] preparing 1 queries
Oct 26 10:43:51.364105 check[25675]: [ 8] sending 1 batches
Oct 26 10:43:51.364255 check[25675]: [ 4] pride.cloudmark.com << 52
Oct 26 10:43:51.364332 check[25675]: [ 6] a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
Oct 26 10:43:51.803059 check[25675]: [ 4] pride.cloudmark.com >> 5
Oct 26 10:43:51.803156 check[25675]: [ 6] response to sent.2
p=0
Oct 26 10:43:51.803490 check[25675]: [ 6] mail 1.0 e=4 sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
Oct 26 10:43:51.803606 check[25675]: [ 7] method 4: mail 1.0: no-contention part, spam=0
Oct 26 10:43:51.803702 check[25675]: [ 7] method 4: mail 1: all non-contention parts not spam, mail not spam
Oct 26 10:43:51.803795 check[25675]: [ 3] mail 1 is not known spam.
Oct 26 10:43:51.803899 check[25675]: [ 5] disconnecting from server pride.cloudmark.com
Oct 26 10:43:51.804067 check[25675]: [ 4] pride.cloudmark.com << 5
Oct 26 10:43:51.804143 check[25675]: [ 6] a=q
debug: Using results from Razor v2.61
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: leaving helper-app run mode
debug: Razor2 results: spam? 0  highest cf score: 0
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c) implements 'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-0.97
debug: running full-text regexp tests; score so far=-0.97
debug: Razor2 is available
debug: Pyzor is available: /usr/bin/pyzor
debug: entering helper-app run mode
debug: setuid: helper proc 25676: ruid=0 euid=0
debug: Pyzor: got response: 217.160.253.84:24441        TimeoutError:
debug: leaving helper-app run mode
debug: Pyzor: couldn't grok response "217.160.253.84:24441      TimeoutError: "
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 25687: ruid=0 euid=0
debug: DCC: got response: X-DCC-sgs_public_dcc_server-Metrics: hn00dmz01.sjc.nl 1199; Body=22198 Fuz1=1519921 Fuz2=1518922
debug: leaving helper-app run mode
debug: DCC: Listed! BODY: 22198 of 999999 FUZ1: 1519921 of 999999 FUZ2: 1518922 of 999999
debug: Running tests for priority: 500
debug: RBL: success for 1 of 1 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c) implements 'check_post_dnsbl'
debug: running meta tests; score so far=1.199
debug: running header regexp tests; score so far=2.916
debug: running body-text per-line regexp tests; score so far=2.916
debug: running uri tests; score so far=2.916
debug: running raw-body-text per-line regexp tests; score so far=2.916
debug: running full-text regexp tests; score so far=2.916
debug: Running tests for priority: 1000
debug: running meta tests; score so far=2.916
debug: running header regexp tests; score so far=2.916
debug: running body-text per-line regexp tests; score so far=2.916
debug: running uri tests; score so far=2.916
debug: running raw-body-text per-line regexp tests; score so far=2.916
debug: running full-text regexp tests; score so far=2.916
debug: is spam? score=2.916 required=5
debug: tests=BAYES_40,DCC_CHECK,MISSING_HEADERS,MISSING_SUBJECT,NO_REAL_NAME,SARE_TOCC_NONE
debug: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__SARE_CC_NONE,__SARE_HTML_HAS_MSG,__SARE_TO_NONE,__UNUSABLE_MSGID

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



More information about the MailScanner mailing list