new spam getting through

[Peter Ong]

Don't mean to be a stickler, but would anyone know the bug number in sa3.2.5 that's causing my problems? I need to pitch this in a change control before I update the main servers, so I'll need to add it in there. Thanks.

p

----- Original Message -----

> From: "Peter Ong" <peter.ong at hypermediasystems.com>
> To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
> Sent: Monday, December 6, 2010 12:45:46 PM
> Subject: Re: new spam getting through
> 
> Thanks for your patience, Steve. I figured out the problem.
> 
> p
> 
> ----- Original Message -----
> 
> > From: "Steve Freegard" <steve.freegard at fsl.com>
> > To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
> > Sent: Monday, December 6, 2010 11:54:53 AM
> > Subject: Re: new spam getting through
> >
> > On 06/12/10 18:56, Peter Ong wrote:
> > > Hey Guys,
> > >
> > > In my sandbox, I upgraded spamassassin... and tested one of the
> > messages I received for which I'm doing this:
> > >
> > > SpamAssassin version 3.3.1
> > >    running on Perl version 5.8.8
> > >
> > >
> > > Content analysis details:   (4.1 points, 5.0 required)
> > >
> > >   pts rule name              description
> > > ---- ----------------------
> > --------------------------------------------------
> > >   1.7 URIBL_BLACK            Contains an URL listed in the URIBL
> > blacklist
> > >                              [URIs: x.co]
> > >   0.0 FREEMAIL_FROM          Sender email is freemail
> > >                              (interceptor1980[at]hotmail.co.uk)
> > > -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at
> > http://www.dnswl.org/, low
> > >                              trust
> > >                              [65.55.90.38 listed in
> list.dnswl.org]
> > >   1.6 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username
> > ends in
> > >                              digit
> > (interceptor1980[at]hotmail.co.uk)
> > >   0.0 UNPARSEABLE_RELAY      Informational: message has
> unparseable
> > relay lines
> > >   0.0 HTML_MESSAGE           BODY: HTML included in message
> > >   0.8 BAYES_50               BODY: Bayes spam probability is 40 to
> > 60%
> > >                              [score: 0.5000]
> > >
> > > Should I be seeing the
> > > HAS_SHORT_URL rule triggered in the output above?
> > > p
> >
> > You'll need to add x(dot)co to the list of url_shorteners as it
> isn't
> >
> > present in the downloadable version.
> >
> > Also - if you're trying to debug it:
> >
> > spamassassin -D -t < msg 2>&1 | grep DecodeShortURLs
> >
> > Is the command to use here.
> >
> > Regards,
> > Steve.
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!