dspam/sa erkennen diese spams nicht

**marcdevil** · 02.02.06, 13:38

was ist denn daran so problematisch, das dspam, selbst nach mehrfachen anlernens mit dspam_corpus --addspam das nicht als Spamerkennen will?
spamassassin genauso.
andere spammails erkennen die beiden übrigens recht gut.

Code:

Subject: Software
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-milter (http://amavis.org/)
X-DSPAM-Result: Innocent
X-DSPAM-Confidence: 0.9997
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 43e12f12280851238845460
X-DSPAM-Factors: 27,
X-Virus-Scanned: amavisd-new at esmt.org
X-Spam-Status: No, score=0.464 tagged_above=-2 required=3
 tests=[BAYES_00=-2.312, DATE_IN_FUTURE_12_24=2.775, UNPARSEABLE_RELAY=0.001]
X-Spam-Score: 0.464
X-Spam-Level: 

Just click to buy OEM! best worldwide soft at increadeable prices!!! 
cheap oem soft shipping worldwide 

New software on our site:

Premiere 6.5 - $89.95
Encarta Encyclopedia Delux 2004 (3CD) - $89.95
Project 2003 Professional - $69.95
Premiere 7 - $69.95
Office 2000 Premium Edition PE (2CD) - $59.95
Picture It Premium 9 - $59.95
Quark Xpress 6 Passport Multilanguage - $69.95
FileMaker 7.0 Professional - $69.95
PhotoRetouch Pro 3.0 - $59.95
Money 2004 - $69.95
Project 2003 Professional - $69.95
WordPerfect Office 10 - $69.95
Project 2003 Professional - $69.95
PhotoRetouch Pro 3.0 - $59.95

Our site:
http://andreanh.com

oder

Code:

...
Subject: Gloucester Mechlin
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0001_01C627B2.3947DA30"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-DSPAM-Result: Innocent
X-DSPAM-Confidence: 0.9964
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 43e1d2a5156551966938858
X-DSPAM-Factors: 27,
X-Virus-Scanned: amavisd-new at esmt.org

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C627B2.3947DA30
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,
Do you need to over pay for your meds?
Nothing like you need it - save over 50% on your meds with
http://www.gaviteral.com
=20
V=20
C=20
V=20

A=20
I=20
l=20

L=20
A=20
A=20

l=20
L=20
G=20

U=20
l=20
R=20

M=20
S=20
A=20

 =20
 =20
 =20

$=20
$=20
$=20

85=20
99=20
69=20




/=20
/=20
/=20

x=20
x=20
x=20

30=20
10=20
10=20


------=_NextPart_000_0001_01C627B2.3947DA30
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>

</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>Hi,</DIV>
<DIV>Do you need to over pay for your meds?</DIV>
<DIV>Nothing like you need it - save over 50% on your meds with <A =
href=3D"http://www.gaviteral.com">http://www.gaviteral.com</A></DIV>
<DIV>&nbsp;</DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">V <BR>C <BR>
V <BR></DIV>

<DIV style=3D"
font-family:
Arial;
float:
left;">A <BR>I <BR>l <BR></DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">L <BR>
A <BR>A <BR>
</DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">l <BR>
L <BR>
G <BR></DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">U <BR>l <BR>R <BR>

</DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">M <BR>
S <BR>A <BR></DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">&nbsp; <BR>&nbsp; <BR>&nbsp; <BR>
</DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">$ <BR>
$ <BR>
$ <BR>

</DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">85 <BR>99 <BR>69 <BR></DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">  <BR>  <BR>  <BR></DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">/ <BR>
/ <BR>/ <BR></DIV>
<DIV style=3D"
font-family:
Arial;
float:
left;">x <BR>
x <BR>
x <BR></DIV>

<DIV style=3D"
font-family:
Arial;
float:
left;">30 <BR>10 <BR>10 <BR></DIV></BODY></HTML>
------=_NextPart_000_0001_01C627B2.3947DA30--

**jacky0815** · 02.02.06, 22:17

ich glaube du solltest mehrere solcher Mails anlernen (am besten automatisch sa-learn übern spamordner laufen lassen) und dann erkennt spamassassin diese Mails sehr genau. Funktioniert hier jedenfalls bestens (ok, sind auch über 3000 Mails im spamordner).
Bei dem anderen spamfilter wirds sicher ähnlich sein.

**[WCM]Manx** · 03.02.06, 08:54

Hi!

@marcdevil

Schick mir doch die beiden Mails als Attachment (Emailadresse per PN) dann lass ich sie bei mir mal durchlaufen. Mein SA legt ein sehr großes Gewicht auf Razor2.

Grüße

Manx

**[WCM]Manx** · 03.02.06, 18:28

Hi!

Hab die erste Mail mal über telnet meinem Server gefüttert.

Code:

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on 
	gateway.xxx.ac.at
X-Spam-Level: ***************
X-Spam-Status: Yes, score=15.9 required=5.0 tests=FORGED_MUA_OUTLOOK,
	HTML_MESSAGE,RAZOR2_CF_RANGE_91_100,RAZOR2_CHECK,UPPERCASE_25_50,
	URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL autolearn=no 
	version=3.0.3
X-Spam-Report: 
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  4.0 RAZOR2_CF_RANGE_91_100 BODY: Razor2 gives confidence between 91 and 100
	*      [cf: 100]
	*  0.1 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
	*  0.6 URIBL_SBL Contains an URL listed in the SBL blocklist
	*      [URIs: causaine.com]
	*  2.0 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
	*      [URIs: causaine.com]
	*  2.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
	*      [URIs: causaine.com]
	*  3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
	*      [URIs: causaine.com]
	*  0.2 UPPERCASE_25_50 message body is 25-50% uppercase
	*  3.0 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

Razor und die Blacklists treiben den Score in die Höhe.
Du könntest Spamassassin mal im debug-modus laufen lassen um zu sehen, welche Tests durchgeführt werden.

Grüße

Manx