Different SA scan results

Jeremy McSpadden jeremy at fluxlabs.net
Fri Feb 27 02:12:57 GMT 2015


What would cause an cli scan (spamassassin -D < msg) to have different results than mailscanner scan ?

via cli

Content analysis details:   (26.1 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 3.3 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS
                            [46.105.49.218 listed in zen.spamhaus.org<http://zen.spamhaus.org>]
 5.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: karefon.eu<http://karefon.eu>]
 5.0 URIBL_DBL_SPAM         Contains a spam URL listed in the DBL blocklist
                            [URIs: karefon.eu<http://karefon.eu>]
-2.0 SPF_HELO_PASS          SPF: HELO matches SPF record
-0.0 SPF_PASS               SPF: sender matches SPF record
 0.0 HTML_MESSAGE           BODY: HTML included in message
 1.5 BAYES_50               BODY: Bayes spam probability is 40 to 60%
                            [score: 0.4995]
 0.5 KAM_EU                 RAW: Prevalent use of .eu in spam/malware
 5.0 KAM_GRABBAG2           Grabbag of Spams hitting EU domains and other indicators
 0.8 RDNS_NONE              Delivered to internal network by a host with no rDNS
 2.0 HTML_OFF_PAGE          HTML element rendered well off the displayed page
 0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay lines
 5.0 KAM_VERY_BLACK_DBL     Email that hits both URIBL Black and Spamhaus DBL
 0.0 T_REMOTE_IMAGE         Message contains an external image


via ms
1.50
BAYES_50
Bayes spam probability is 40 to 60%
0.00
HTML_MESSAGE
HTML included in message
2.00
HTML_OFF_PAGE
HTML element rendered well off the displayed page
0.50
KAM_EU
Prevalent use of .eu in spam/malware
0.79
RDNS_NONE
Delivered to internal network by a host with no rDNS
-2.00
SPF_HELO_PASS
SPF: HELO matches SPF record
-0.00
SPF_PASS
SPF: sender matches SPF record
0.01
T_REMOTE_IMAGE
0.00
UNPARSEABLE_RELAY
Informational: message has unparseable relay lines
--
Jeremy McSpadden
Flux Labs, Inc | http://www.fluxlabs.net | Endless Solutions
Office : 850-250-5590 x 501 | Cell : 850-890-2543 | Fax : 850-254-2955

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150227/b886bcb9/attachment.html 


More information about the MailScanner mailing list