The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Spam Assassin Question

Discussion in 'General Discussion' started by Tom Pyles, Jan 18, 2005.

  1. Tom Pyles

    Tom Pyles Well-Known Member

    Joined:
    Apr 26, 2002
    Messages:
    254
    Likes Received:
    0
    Trophy Points:
    16
    This seems to be a sporadic problem but I cannot determine where the change change is coming from or what is causing it.

    Recently I've seen an increase in the number of spams coming into our servers. Clients have also said they are seeing more spam. After investigation, it appears the problem stems from the score given to each spam. The score is showing as a negative number. For example:

    X-Spam-Level:
    X-Spam-Status: No, score=-81.0 required=5.0 tests=BAYES_95,DOMAIN_RATIO,
    HTML_80_90,HTML_IMAGE_ONLY_04,HTML_MESSAGE,MIME_BOUND_DD_DIGITS,
    MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MPART_ALT_DIFF,RCVD_BY_IP,
    RCVD_HELO_IP_MISMATCH,RCVD_NUMERIC_HELO,USER_IN_WHITELIST
    autolearn=spam version=3.0.2

    I'm seeing this on more and more spam. What happens is because the number is below what we've configured, they are not getting flagged as spam. I set my own person e-mail to filter anything that scores higher than a 5, so all spam with a negative score is allowed to pass. It seems that ALL spam is being marked with negative numbers.

    Could somebody enlighten me as to what the cause of this is?
     
  2. dezignguy

    dezignguy Well-Known Member

    Joined:
    Sep 26, 2004
    Messages:
    534
    Likes Received:
    0
    Trophy Points:
    16
    Does one of your spam tests have its scores marked very very low? Ie -100 or something like that?

    Otherwise, maye your bayes db is screwed up.
     
  3. richy

    richy Well-Known Member

    Joined:
    Jun 30, 2003
    Messages:
    276
    Likes Received:
    1
    Trophy Points:
    16
    I would suspect it's the USER_IN_WHITELIST rule - that'll probably have a score of -100 .Check your whitelist.
     
  4. Tom Pyles

    Tom Pyles Well-Known Member

    Joined:
    Apr 26, 2002
    Messages:
    254
    Likes Received:
    0
    Trophy Points:
    16
    All spam that is coming in is reaching these large negative numbers. The only thing whitelisted is mail coming from our Kayako support desk (will get flagged as spam).

    As an example, I have my filter set to a score of 5

    Spam comes in and gets a score of 20, it gets filtered (as it should)

    Spam comes in and gets a score of 2, it doesn't (as it should not get filtered)

    Spam comes in and gets a score of -80. It won't get filtered because its below 5.

    Its the spam in the third scenario that is the problem, but its happening to ALL spam now.
     
  5. dezignguy

    dezignguy Well-Known Member

    Joined:
    Sep 26, 2004
    Messages:
    534
    Likes Received:
    0
    Trophy Points:
    16
    perhaps you've messed up a config setting that essentially results in everything being whitelisted... I used SA a long time ago and don't remember exactly how the config was done, but check your syntax.

    I know in my filter, that if I leave a '|' at the end of a part of a regex, it'll match everything and the result is the same as what you're experiencing.
     
  6. jean louis

    jean louis Member

    Joined:
    Dec 18, 2003
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    1
    Spamassassin give strange score?

    WHM cPanel 9.9.9-R157 RELEASE

    Spamassassin give strange score?

    Received mail from same mailshot generated by my newsletter script :

    Why i got one email with a score of -1.5 normal it suppose to score 1.5 i know because it about a year i sent this newsletter and it alway score 1.5
    More strange second email received in other box score -5.6

    Their are identical except form the recipient :confused: Why is different?

    i think my Spamassassin is out of control can we trust it anymore ?

    Mail headers

    Mail 1
    Date: Wed, 19 Jan 2005 22:00:01 +0100
    X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on ls677.burtondns.org
    X-Spam-Level:
    X-Spam-Status: No, score=-1.5 required=5.0 tests=ALL_TRUSTED,HTML_90_100,
    HTML_MESSAGE,HTML_WEB_BUGS,MIME_HTML_ONLY autolearn=ham version

    Mail 2
    Date: Wed, 19 Jan 2005 22:00:03 +0100
    X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on ls677.burtondns.org
    X-Spam-Level:
    X-Spam-Status: No, score=-5.6 required=5.0 tests=ALL_TRUSTED,BAYES_00,
    HTML_90_100,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_WEB_BUGS,
    MIME_HTML_ONLY autolearn=ham version=3.0.1
     
Loading...

Share This Page