SA Scoring

[Dhawal Doshy]

uxbod at splatnix.net wrote:
> Running with these already. As there is only two mailbox users then perhaps
> it is down to the number of spam/ham learnt in Bayes.

Does the spam contain something like "domain [dot} tld, replace the dot 
with a '.'", if yes then spamassassin is currently unable to lookup 
munged domains on SURBL/URIBL.

Dallas (of SA) suggested a hack (which might be prone to FPs and is not 
an approved method).. here's a patch for PerMsgStatus.pm in SA 3.1.1

[root at sauron ~]# diff -u 
/usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm.original 
/usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm
--- 
/usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm.original 
   2006-03-11 00:59:55.000000000 +0530
+++ /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm 
2006-05-15 23:41:11.000000000 +0530
@@ -2071,6 +2071,11 @@

      for (@$textary) {
        # NOTE: do not modify $_ in this loop
+
+      # do not allow dot munging.. ie  domain(dot)tld  domain[dot]tld 
domain-dot-tld
+      # actively started 2006-03-20
+      s/([a-z0-9])[^a-z0-9]dot[^a-z0-9]([a-z]{2,7})/$1\.$2/gi;
+
        while (/($uriRe)/igo) {
          my $uri = $1;

- dhawal

> On 1:30 pm 05/16/06 "Randal, Phil" <prandal at herefordshire.gov.uk> wrote:
>> With Razor, Pyzor, DCC, and URIBLs (uribl.com blacklist) they get well
>> clobbered here.
>>
>> Cheers,
>>
>> Phil
>>
>> ----
>> Phil Randal
>> Network Engineer
>> Herefordshire Council
>> Hereford, UK
>>
>>>  -----Original Message-----
>>>  From: mailscanner-bounces at lists.mailscanner.info
>>>  [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf
>>>  Of uxbod at splatnix.net
>>>  Sent: 16 May 2006 15:00
>>>  To: mailscanner at lists.mailscanner.info
>>>  Subject: SA Scoring
>>>
>>>  Hi,
>>>
>>>  i am trying to understand why I cannot get a particular spam
>>>  email to be
>>>  recognised.  Here is what I see in MailWatch :-
>>>
>>>  From: newberniste at g9.com [Add to Whitelist | Add to Blacklist]
>>>
>>>  To: xxxxxx at xxxxxx.com
>>>  Subject: Re: your VALthUM
>>>  Size: 4.4Kb
>>>  Anti-Virus/Dangerous Content Protection
>>>  Virus:  N
>>>  Blocked File:  N
>>>  Other Infection:  N
>>>  SpamAssassin
>>>  Spam:  N   Action(s): deliver, header, "X-Spam-Status:, No"
>>>  High Scoring Spam:  N
>>>  SpamAssassin Spam:  N
>>>  Listed in RBL:  N
>>>  Spam Whitelisted:  N
>>>  Spam Blacklisted:  N
>>>  SpamAssassin Autolearn:  Y  (not spam)
>>>  SpamAssassin Score: 0.00
>>>  Spam Report: Score Matching Rule Description
>>>  cached not
>>>   score=0.001
>>>  6 required
>>>  spam autolearn=not
>>>  0.00 HTML_MESSAGE HTML included in message
>>>
>>>  I get a lot of these and the only thing that changes is the
>>>  Subject line,
>>>  but only by case modification.
>>>
>>>  When I get these I train using sa-learn, but after reading
>>>  this will only
>>>  happen if a minumum of three criteria are met.
>>>
>>>  How are you all handling messages like this ?
>>>
>>>  Thanks,