Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » Misclasified as spam
Misclasified as spam [message #570] Sat, 12 March 2005 14:32
geotek
Messages: 5
Registered: February 2005
Junior Member
One single email constantly gets mis-classified as spam, and Im wondering why. Here is the report:
Content analysis details: (6.4 points, 5.2 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 NO_REAL_NAME From: does not include a real name
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.6 J_CHICKENPOX_19 BODY: 1alpha-pock-9alpha
0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha
0.6 J_CHICKENPOX_34 BODY: 3alpha-pock-4alpha
0.6 J_CHICKENPOX_102 BODY: 10alpha-pock-2alpha
0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha
0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha
0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha
0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
0.6 J_CHICKENPOX_73 BODY: 7alpha-pock-3alpha
1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.2 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5000]
0.2 HTML_10_20 BODY: Message is 10% to 20% HTML
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
-0.5 AWL AWL: From: address is in the auto white-list

It appears to me that the J_CHICKENFOX / alpha-pock rule is responsible for classification. Could you please explain, what is going on here? What does CHICKENFOX mean, anyway?
Re: Misclasified as spam [message #571 is a reply to message #570] Sat, 12 March 2005 21:05 Go to previous message
Heidner
Messages: 121
Registered: February 2005
Senior Member
From: http://wiki.apache.org/spamassassin/CustomRulesets

chickenpox.cf
chickenpox is a set of rules designed to catch spam like "l.ooks f|or th.is kind of garb+age"
Created by: Jennifer Wheeler
Contact: TBD
License Type: TBD
Status: Locked
Auto-update: No
Available at: http://www.emtinc.net/includes/chickenpox.cf
Mirror: rulesemporium.com
NOTE: Early versions of Rules Du Jour included this set in it's default config. This set is now considered "stable" and is no longer actively updated. Please do not use auto-update scripts
More information on Jennifer's rules: http://www.emtinc.net/spamhammers.htm
Sample Results: MasscheckChickenpox (Version 1.15 2004-02-06)

If the mail doesn't have the chickenpox traits when you view it, then perhaps the mailer recorded the internal structure as the wrong type of character set, I.E ASCII instead of unicode, ... etc. You would really need to look at the raw message header and body.

Also some spammers will embed characters that don't print in the middle of words (like ascii nulls). They do this so that common spam words like Viagra are not detected by the bayesian engine in spamassassin. However the chickenpox filter will almost always catch them trying to break up the words.
Previous Topic: SpamAssassin
Next Topic: Netsky and Bagle
Goto Forum:
  


Current Time: Tue Dec 06 13:09:17 CET 2016