Mailing List Archive: SpamAssassin: users

SpamAssassin Hanging on RTF Attachments

Index | Next | Previous | View Threaded

admin at kilnar

Aug 14, 2012, 8:47 PM

Post #1 of 17 (791 views)
Permalink

SpamAssassin Hanging on RTF Attachments

Greetings,

I've spent many hours spread out over weeks scouring the Internet and
message archives and FAQs and such, and am unable to find a solution to
the problem I'm having.

I have a Postifx+AmavisNew+SpamAssassin+ClamAV setup for my mail
server. It's all running on Ubuntu Server 10.04 LTS. I've had this
configuration for many years, and have always had a problem receiving
some RTF attachments. Here are the pertinent details:

Postfix: 2.8.5-2
Amavisd-new: 2.6.4
ClamAV: 0.97.5
SpamAssassin: 3.3.1
Perl: 5.10.1

Sometimes (but not always) when I receive an RTF attachment, the mail
can't be delivered. A single amavis child pegs a CPU. Through much
debugging, I've turned off ClamAV, turned ClamAV back on, and then
turned off SpamAssassin. When I disabled Amavis's call to SpamAssassin,
the mail cruised right through my system fine. This lead me to believe
it was a problem with SpamAssassin.

I managed to capture (though a deferred email that I captured with
'postcat') a single email that contained a problematic RTF attachment.

Running 'spamassassin -t < emailfile' resulted in the process locking
up to the point that I had to 'kill -9' the process in another window. I
waited 15 minutes for the process to finish, and it never did.

My questions are these:

Is there a way to disable SpamAssassin from scanning certain attachment
types (e.g.: RTFs)?

If not, is there a way to tell SpamAssassin to only scan the first X
bytes of an email? I've tried the amavis config of
'$sa_mail_body_size_limit' and set it to a ridiculously low number
(e.g.: 10 bytes) but this did not resolve the problem.

Is there a bug/flaw in SpamAssassin or one of its add-ons that I should
be looking to upgrade to get away from this issue?

What other details/information do you need from me to assist me in
troubleshooting this issue?

Thanks in advance for any time and consideration you give to this
email.

PS: I can't share my problematic RTF file since it contains a legal
contract I'm not allowed to share with the public.

KMcGrail at PCCC

Aug 14, 2012, 8:50 PM

Post #2 of 17 (754 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 8/14/2012 11:47 PM, admin wrote:
>
> PS: I can't share my problematic RTF file since it contains a legal
> contract I'm not allowed to share with the public.
Are you able to share the problematic file off-list?

Can you share the Output of spamassassin -D -t on the file?

admin at kilnar

Aug 14, 2012, 9:04 PM

Post #3 of 17 (765 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 2012-08-14 20:50, Kevin A. McGrail wrote:
> On 8/14/2012 11:47 PM, admin wrote:
>>
>> PS: I can't share my problematic RTF file since it contains a legal
>> contract I'm not allowed to share with the public.
> Are you able to share the problematic file off-list?
>
> Can you share the Output of spamassassin -D -t on the file?

I'll have to get permission from the person that I'm involved with in
the contract since it contains some of her personal information
(address, name, etc.) I'm sure she'll be fine with it if it becomes
necessary.

Here's the output of -D -t on the file. I let it run for about 10
minutes before giving up and killing the process.

# spamassassin -D -t < bad
Aug 14 21:57:24.258 [3883] dbg: logger: adding facilities: all
Aug 14 21:57:24.258 [3883] dbg: logger: logging level is DBG
Aug 14 21:57:24.258 [3883] dbg: generic: SpamAssassin version 3.3.1
Aug 14 21:57:24.258 [3883] dbg: generic: Perl 5.010001, PREFIX=/usr,
DEF_RULES_DIR=/usr/share/spamassassin,
LOCAL_RULES_DIR=/etc/spamassassin, LOCAL_STATE_DIR=/var/lib/spamassassin
Aug 14 21:57:24.258 [3883] dbg: config: timing enabled
Aug 14 21:57:24.259 [3883] dbg: config: score set 0 chosen.
Aug 14 21:57:24.260 [3883] dbg: util: running in taint mode? yes
Aug 14 21:57:24.260 [3883] dbg: util: taint mode: deleting unsafe
environment variables, resetting PATH
Aug 14 21:57:24.260 [3883] dbg: util: PATH included '/usr/local/sbin',
keeping
Aug 14 21:57:24.260 [3883] dbg: util: PATH included '/usr/local/bin',
keeping
Aug 14 21:57:24.260 [3883] dbg: util: PATH included '/usr/sbin',
keeping
Aug 14 21:57:24.260 [3883] dbg: util: PATH included '/usr/bin', keeping
Aug 14 21:57:24.260 [3883] dbg: util: PATH included '/sbin', keeping
Aug 14 21:57:24.260 [3883] dbg: util: PATH included '/bin', keeping
Aug 14 21:57:24.261 [3883] dbg: util: PATH included
'/opt/dell/srvadmin/bin', keeping
Aug 14 21:57:24.261 [3883] dbg: util: PATH included
'/opt/dell/srvadmin/sbin', keeping
Aug 14 21:57:24.261 [3883] dbg: util: PATH included '/root/bin',
keeping
Aug 14 21:57:24.261 [3883] dbg: util: PATH included '.', which is not
absolute, dropping
Aug 14 21:57:24.261 [3883] dbg: util: PATH included '/root/bin',
keeping
Aug 14 21:57:24.261 [3883] dbg: util: PATH included '.', which is not
absolute, dropping
Aug 14 21:57:24.261 [3883] dbg: util: final PATH set to:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/dell/srvadmin/bin:/opt/dell/srvadmin/sbin:/root/bin:/root/bin
Aug 14 21:57:24.264 [3883] dbg: dns: is Net::DNS::Resolver available?
yes
Aug 14 21:57:24.265 [3883] dbg: dns: Net::DNS version: 0.65
Aug 14 21:57:24.266 [3883] dbg: config: using "/etc/spamassassin" for
site rules pre files
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/init.pre
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/v310.pre
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/v312.pre
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/v320.pre
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/v330.pre
Aug 14 21:57:24.267 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001" for sys rules pre files
Aug 14 21:57:24.267 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001" for default rules dir
Aug 14 21:57:24.267 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org.cf
Aug 14 21:57:24.267 [3883] dbg: config: using "/etc/spamassassin" for
site rules dir
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/65_debian.cf
Aug 14 21:57:24.267 [3883] dbg: config: read file
/etc/spamassassin/blacklist.cf
Aug 14 21:57:24.268 [3883] dbg: config: read file
/etc/spamassassin/local.cf
Aug 14 21:57:24.268 [3883] dbg: config: read file
/etc/spamassassin/regex.cf
Aug 14 21:57:24.268 [3883] dbg: config: read file
/etc/spamassassin/whitelist.cf
Aug 14 21:57:24.268 [3883] dbg: config: using "/root/.spamassassin" for
user state dir
Aug 14 21:57:24.268 [3883] dbg: config: using
"/root/.spamassassin/user_prefs" for user prefs file
Aug 14 21:57:24.268 [3883] dbg: config: read file
/root/.spamassassin/user_prefs
Aug 14 21:57:24.269 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::URIDNSBL from @INC
Aug 14 21:57:24.273 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Hashcash from @INC
Aug 14 21:57:24.280 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::SPF from @INC
Aug 14 21:57:24.283 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Pyzor from @INC
Aug 14 21:57:24.285 [3883] dbg: pyzor: network tests on, attempting
Pyzor
Aug 14 21:57:24.285 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Razor2 from @INC
Aug 14 21:57:24.326 [3883] dbg: razor2: razor2 is available, version
2.84
Aug 14 21:57:24.327 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::SpamCop from @INC
Aug 14 21:57:24.336 [3883] dbg: reporter: network tests on, attempting
SpamCop
Aug 14 21:57:24.336 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC
Aug 14 21:57:24.337 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::WhiteListSubject from @INC
Aug 14 21:57:24.338 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::MIMEHeader from @INC
Aug 14 21:57:24.339 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::ReplaceTags from @INC
Aug 14 21:57:24.340 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::DKIM from @INC
Aug 14 21:57:24.345 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Check from @INC
Aug 14 21:57:24.351 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::HTTPSMismatch from @INC
Aug 14 21:57:24.352 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::URIDetail from @INC
Aug 14 21:57:24.353 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Bayes from @INC
Aug 14 21:57:24.360 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::BodyEval from @INC
Aug 14 21:57:24.362 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::DNSEval from @INC
Aug 14 21:57:24.364 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::HTMLEval from @INC
Aug 14 21:57:24.365 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::HeaderEval from @INC
Aug 14 21:57:24.370 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::MIMEEval from @INC
Aug 14 21:57:24.373 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::RelayEval from @INC
Aug 14 21:57:24.375 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::URIEval from @INC
Aug 14 21:57:24.376 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::WLBLEval from @INC
Aug 14 21:57:24.377 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::VBounce from @INC
Aug 14 21:57:24.378 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::ImageInfo from @INC
Aug 14 21:57:24.380 [3883] dbg: plugin: loading
Mail::SpamAssassin::Plugin::FreeMail from @INC
Aug 14 21:57:24.383 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/10_default_prefs.cf
Aug 14 21:57:24.383 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/10_default_prefs.cf"
for included file
Aug 14 21:57:24.383 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/10_default_prefs.cf
Aug 14 21:57:24.385 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/10_hasbase.cf
Aug 14 21:57:24.385 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/10_hasbase.cf"
for included file
Aug 14 21:57:24.386 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/10_hasbase.cf
Aug 14 21:57:24.387 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_advance_fee.cf
Aug 14 21:57:24.387 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_advance_fee.cf"
for included file
Aug 14 21:57:24.387 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_advance_fee.cf
Aug 14 21:57:24.391 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_aux_tlds.cf
Aug 14 21:57:24.391 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_aux_tlds.cf"
for included file
Aug 14 21:57:24.391 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_aux_tlds.cf
Aug 14 21:57:24.396 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_body_tests.cf
Aug 14 21:57:24.396 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_body_tests.cf"
for included file
Aug 14 21:57:24.396 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_body_tests.cf
Aug 14 21:57:24.400 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_compensate.cf
Aug 14 21:57:24.400 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_compensate.cf"
for included file
Aug 14 21:57:24.400 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_compensate.cf
Aug 14 21:57:24.401 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_dnsbl_tests.cf
Aug 14 21:57:24.401 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_dnsbl_tests.cf"
for included file
Aug 14 21:57:24.401 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_dnsbl_tests.cf
Aug 14 21:57:24.405 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_drugs.cf
Aug 14 21:57:24.405 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_drugs.cf"
for included file
Aug 14 21:57:24.405 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_drugs.cf
Aug 14 21:57:24.414 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_dynrdns.cf
Aug 14 21:57:24.414 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_dynrdns.cf"
for included file
Aug 14 21:57:24.414 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_dynrdns.cf
Aug 14 21:57:24.419 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_fake_helo_tests.cf
Aug 14 21:57:24.419 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_fake_helo_tests.cf"
for included file
Aug 14 21:57:24.419 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_fake_helo_tests.cf
Aug 14 21:57:24.422 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_freemail.cf
Aug 14 21:57:24.422 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_freemail.cf"
for included file
Aug 14 21:57:24.422 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_freemail.cf
Aug 14 21:57:24.423 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_freemail_domains.cf
Aug 14 21:57:24.423 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_freemail_domains.cf"
for included file
Aug 14 21:57:24.424 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_freemail_domains.cf
Aug 14 21:57:24.424 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::FreeMail=HASH(0x3f3d658) implements
'parse_config', priority 0
Aug 14 21:57:24.441 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_head_tests.cf
Aug 14 21:57:24.441 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_head_tests.cf"
for included file
Aug 14 21:57:24.442 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_head_tests.cf
Aug 14 21:57:24.459 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_html_tests.cf
Aug 14 21:57:24.459 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_html_tests.cf"
for included file
Aug 14 21:57:24.459 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_html_tests.cf
Aug 14 21:57:24.466 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_imageinfo.cf
Aug 14 21:57:24.466 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_imageinfo.cf"
for included file
Aug 14 21:57:24.466 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_imageinfo.cf
Aug 14 21:57:24.468 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_mailspike.cf
Aug 14 21:57:24.468 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_mailspike.cf"
for included file
Aug 14 21:57:24.468 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_mailspike.cf
Aug 14 21:57:24.468 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_meta_tests.cf
Aug 14 21:57:24.468 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_meta_tests.cf"
for included file
Aug 14 21:57:24.469 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_meta_tests.cf
Aug 14 21:57:24.471 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_net_tests.cf
Aug 14 21:57:24.471 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_net_tests.cf"
for included file
Aug 14 21:57:24.471 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_net_tests.cf
Aug 14 21:57:24.472 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_phrases.cf
Aug 14 21:57:24.472 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_phrases.cf"
for included file
Aug 14 21:57:24.472 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_phrases.cf
Aug 14 21:57:24.478 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_porn.cf
Aug 14 21:57:24.478 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_porn.cf" for
included file
Aug 14 21:57:24.478 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_porn.cf
Aug 14 21:57:24.479 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_ratware.cf
Aug 14 21:57:24.479 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_ratware.cf"
for included file
Aug 14 21:57:24.479 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_ratware.cf
Aug 14 21:57:24.489 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_uri_tests.cf
Aug 14 21:57:24.489 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_uri_tests.cf"
for included file
Aug 14 21:57:24.489 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_uri_tests.cf
Aug 14 21:57:24.492 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_vbounce.cf
Aug 14 21:57:24.492 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_vbounce.cf"
for included file
Aug 14 21:57:24.492 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/20_vbounce.cf
Aug 14 21:57:24.504 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/23_bayes.cf
Aug 14 21:57:24.504 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/23_bayes.cf"
for included file
Aug 14 21:57:24.504 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/23_bayes.cf
Aug 14 21:57:24.505 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_accessdb.cf
Aug 14 21:57:24.505 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_accessdb.cf"
for included file
Aug 14 21:57:24.506 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_accessdb.cf
Aug 14 21:57:24.506 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_antivirus.cf
Aug 14 21:57:24.506 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_antivirus.cf"
for included file
Aug 14 21:57:24.506 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_antivirus.cf
Aug 14 21:57:24.506 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_asn.cf
Aug 14 21:57:24.506 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_asn.cf" for
included file
Aug 14 21:57:24.507 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_asn.cf
Aug 14 21:57:24.507 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_dcc.cf
Aug 14 21:57:24.507 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_dcc.cf" for
included file
Aug 14 21:57:24.507 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_dcc.cf
Aug 14 21:57:24.508 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_dkim.cf
Aug 14 21:57:24.508 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_dkim.cf" for
included file
Aug 14 21:57:24.508 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_dkim.cf
Aug 14 21:57:24.510 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_hashcash.cf
Aug 14 21:57:24.510 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_hashcash.cf"
for included file
Aug 14 21:57:24.510 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_hashcash.cf
Aug 14 21:57:24.512 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_pyzor.cf
Aug 14 21:57:24.512 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_pyzor.cf"
for included file
Aug 14 21:57:24.512 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_pyzor.cf
Aug 14 21:57:24.512 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_razor2.cf
Aug 14 21:57:24.512 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_razor2.cf"
for included file
Aug 14 21:57:24.512 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_razor2.cf
Aug 14 21:57:24.513 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_replace.cf
Aug 14 21:57:24.513 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_replace.cf"
for included file
Aug 14 21:57:24.513 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_replace.cf
Aug 14 21:57:24.519 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_spf.cf
Aug 14 21:57:24.519 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_spf.cf" for
included file
Aug 14 21:57:24.519 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_spf.cf
Aug 14 21:57:24.521 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_textcat.cf
Aug 14 21:57:24.521 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_textcat.cf"
for included file
Aug 14 21:57:24.521 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_textcat.cf
Aug 14 21:57:24.522 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_uribl.cf
Aug 14 21:57:24.522 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_uribl.cf"
for included file
Aug 14 21:57:24.522 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/25_uribl.cf
Aug 14 21:57:24.526 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_de.cf
Aug 14 21:57:24.526 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_de.cf"
for included file
Aug 14 21:57:24.526 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_de.cf
Aug 14 21:57:24.530 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_fr.cf
Aug 14 21:57:24.530 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_fr.cf"
for included file
Aug 14 21:57:24.530 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_fr.cf
Aug 14 21:57:24.532 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_it.cf
Aug 14 21:57:24.533 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_it.cf"
for included file
Aug 14 21:57:24.533 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_it.cf
Aug 14 21:57:24.533 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_nl.cf
Aug 14 21:57:24.533 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_nl.cf"
for included file
Aug 14 21:57:24.533 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_nl.cf
Aug 14 21:57:24.535 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_pl.cf
Aug 14 21:57:24.535 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_pl.cf"
for included file
Aug 14 21:57:24.536 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_pl.cf
Aug 14 21:57:24.538 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_pt_br.cf
Aug 14 21:57:24.538 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_pt_br.cf"
for included file
Aug 14 21:57:24.538 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/30_text_pt_br.cf
Aug 14 21:57:24.543 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/50_scores.cf
Aug 14 21:57:24.543 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/50_scores.cf"
for included file
Aug 14 21:57:24.543 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/50_scores.cf
Aug 14 21:57:24.578 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_adsp_override_dkim.cf
Aug 14 21:57:24.578 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_adsp_override_dkim.cf"
for included file
Aug 14 21:57:24.578 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_adsp_override_dkim.cf
Aug 14 21:57:24.580 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_awl.cf
Aug 14 21:57:24.580 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_awl.cf" for
included file
Aug 14 21:57:24.581 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_awl.cf
Aug 14 21:57:24.581 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_shortcircuit.cf
Aug 14 21:57:24.581 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_shortcircuit.cf"
for included file
Aug 14 21:57:24.581 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_shortcircuit.cf
Aug 14 21:57:24.582 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist.cf
Aug 14 21:57:24.582 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist.cf"
for included file
Aug 14 21:57:24.582 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist.cf
Aug 14 21:57:24.584 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_dkim.cf
Aug 14 21:57:24.584 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_dkim.cf"
for included file
Aug 14 21:57:24.584 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_dkim.cf
Aug 14 21:57:24.587 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_spf.cf
Aug 14 21:57:24.587 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_spf.cf"
for included file
Aug 14 21:57:24.588 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_spf.cf
Aug 14 21:57:24.589 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_subject.cf
Aug 14 21:57:24.589 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_subject.cf"
for included file
Aug 14 21:57:24.589 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/60_whitelist_subject.cf
Aug 14 21:57:24.590 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/72_active.cf
Aug 14 21:57:24.590 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/72_active.cf"
for included file
Aug 14 21:57:24.591 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/72_active.cf
Aug 14 21:57:24.690 [3883] dbg: config: uri_detail adding (text =~
/(?-xism:(?i)\b(?:cli(?:quez\W|ck\Wa)ici\b|cli(?:cca\W|c\Wa|que\Wa)qu[^<.,a
]|klie?k(?:\Whi?er|ni(?:j|nite)\Wtu[tk]aj)\b))/) to
T_KHOP_FOREIGN_CLICK
Aug 14 21:57:24.690 [3883] dbg: config: uri_detail added
T_KHOP_FOREIGN_CLICK
Aug 14 21:57:24.750 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/72_scores.cf
Aug 14 21:57:24.750 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/72_scores.cf"
for included file
Aug 14 21:57:24.750 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/72_scores.cf
Aug 14 21:57:24.757 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/73_sandbox_manual_scores.cf
Aug 14 21:57:24.757 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/73_sandbox_manual_scores.cf"
for included file
Aug 14 21:57:24.757 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/73_sandbox_manual_scores.cf
Aug 14 21:57:24.758 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/local.cf
Aug 14 21:57:24.758 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/local.cf" for
included file
Aug 14 21:57:24.758 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/local.cf
Aug 14 21:57:24.758 [3883] dbg: config: fixed relative path:
/var/lib/spamassassin/3.003001/updates_spamassassin_org/regression_tests.cf
Aug 14 21:57:24.758 [3883] dbg: config: using
"/var/lib/spamassassin/3.003001/updates_spamassassin_org/regression_tests.cf"
for included file
Aug 14 21:57:24.758 [3883] dbg: config: read file
/var/lib/spamassassin/3.003001/updates_spamassassin_org/regression_tests.cf
Aug 14 21:57:25.326 [3883] dbg: rules: __AXB_MO_OL_44FE0 merged
duplicates: __AXB_MO_OL_4CBE5
Aug 14 21:57:25.326 [3883] dbg: rules: __JM_REACTOR_DATE merged
duplicates: __RATWARE_0_TZ_DATE
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_MO_OL_2E645 merged
duplicates: __AXB_MO_OL_5A31E __AXB_MO_OL_A7B9C
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_XM_OL_07794 merged
duplicates: __AXB_XM_OL_0A08A __AXB_XM_OL_2E645 __AXB_XM_OL_35FFA
__AXB_XM_OL_3857F __AXB_XM_OL_4CBE5 __AXB_XM_OL_4F240 __AXB_XM_OL_58CB5
__AXB_XM_OL_5933D __AXB_XM_OL_6554A __AXB_XM_OL_812FF __AXB_XM_OL_8B970
__AXB_XM_OL_8E871 __AXB_XM_OL_C0C83 __AXB_XM_OL_C65FA __AXB_XM_OL_CC6B7
__AXB_XM_OL_CF0C0 __AXB_XM_OL_F475E __AXB_XM_OL_F6D01
Aug 14 21:57:25.327 [3883] dbg: rules: __HAS_REPLY_TO merged
duplicates: __REPLYTO_EXISTS
Aug 14 21:57:25.327 [3883] dbg: rules: __FH_HAS_XPRIORITY merged
duplicates: __XPRIO
Aug 14 21:57:25.327 [3883] dbg: rules: __HAS_XMAIL merged duplicates:
__HAS_X_MAILER
Aug 14 21:57:25.327 [3883] dbg: rules: FH_MSGID_01C67 merged
duplicates: __MSGID_VGA
Aug 14 21:57:25.327 [3883] dbg: rules: NAME_EMAIL_DIFF merged
duplicates: __NAME_EMAIL_DIFF
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_MO_OL_22B61 merged
duplicates: __AXB_MO_OL_4F240 __AXB_MO_OL_ADFF7
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_MO_OL_812FF merged
duplicates: __AXB_MO_OL_BC7E6
Aug 14 21:57:25.327 [3883] dbg: rules: __DOS_HAS_MAILING_LIST merged
duplicates: __ML4
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_XM_OL_024C2 merged
duplicates: __AXB_XM_OL_6237B
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_XM_OL_448E3 merged
duplicates: __AXB_XM_OL_5A31E
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_MO_OL_37431 merged
duplicates: __AXB_MO_OL_3857F
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_MO_OL_5933D merged
duplicates: __AXB_MO_OL_79A9A
Aug 14 21:57:25.327 [3883] dbg: rules: __AXB_MO_OL_12495 merged
duplicates: __AXB_MO_OL_4BF4C __AXB_MO_OL_F6D01
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_9B90B merged
duplicates: __AXB_MO_OL_C65FA __AXB_MO_OL_FB17C
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_07794 merged
duplicates: __AXB_MO_OL_8627E __AXB_MO_OL_F3B05
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_57545 merged
duplicates: __AXB_MO_OL_A275F __AXB_MO_OL_CC6B7
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_XM_OL_1ECD5 merged
duplicates: __AXB_XM_OL_B292B
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_XM_OL_37431 merged
duplicates: __AXB_XM_OL_44FE0 __AXB_XM_OL_4BF4C __AXB_XM_OL_4EEDB
__AXB_XM_OL_57545 __AXB_XM_OL_7C3E5 __AXB_XM_OL_7F4F5 __AXB_XM_OL_9B90B
__AXB_XM_OL_ADFF7 __AXB_XM_OL_B30D1 __AXB_XM_OL_B4B40 __AXB_XM_OL_BC7E6
__AXB_XM_OL_D2603 __AXB_XM_OL_DDE5D __AXB_XM_OL_F3B05 __AXB_XM_OL_FF5C8
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_6554A merged
duplicates: __AXB_MO_OL_C95DC
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_35FFA merged
duplicates: __AXB_MO_OL_D2603
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_B30D1 merged
duplicates: __AXB_MO_OL_CF0C0
Aug 14 21:57:25.328 [3883] dbg: rules: __HAS_LIST_ID merged duplicates:
__ML2
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_787D6 merged
duplicates: __AXB_MO_OL_7F4F5 __AXB_MO_OL_C0C83
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_58CB5 merged
duplicates: __AXB_MO_OL_B4B40
Aug 14 21:57:25.328 [3883] dbg: rules: __DOS_HAS_ANY_URI merged
duplicates: __HAS_ANY_URI __HAS_URI
Aug 14 21:57:25.328 [3883] dbg: rules: __FH_HAS_XMSMAIL merged
duplicates: __HAS_MSMAIL_PRI
Aug 14 21:57:25.328 [3883] dbg: rules: CTYPE_001C_A merged duplicates:
DATE_IN_FUTURE_96_XX
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_7C3E5 merged
duplicates: __AXB_MO_OL_8E871 __AXB_MO_OL_964DE
Aug 14 21:57:25.328 [3883] dbg: rules: __AXB_MO_OL_C9CC0 merged
duplicates: __AXB_MO_OL_F475E __AXB_MO_OL_FF5C8
Aug 14 21:57:25.329 [3883] dbg: config: finish parsing
Aug 14 21:57:25.345 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x3b41d30) implements
'finish_parsing_end', priority 0
Aug 14 21:57:25.345 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::FreeMail=HASH(0x3f3d658) implements
'finish_parsing_end', priority 0
Aug 14 21:57:25.345 [3883] dbg: replacetags: replacing tags
Aug 14 21:57:25.367 [3883] dbg: replacetags: done replacing tags
Aug 14 21:57:25.367 [3883] dbg: FreeMail: loaded freemail_domains
entries: 2110 normal, 26 wildcard
Aug 14 21:57:25.369 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::Bayes=HASH(0x3c7b9a0) implements
'learner_new', priority 0
Aug 14 21:57:25.369 [3883] dbg: bayes: learner_new
self=Mail::SpamAssassin::Plugin::Bayes=HASH(0x3c7b9a0),
bayes_store_module=Mail::SpamAssassin::BayesStore::DBM
Aug 14 21:57:25.380 [3883] dbg: bayes: learner_new: got
store=Mail::SpamAssassin::BayesStore::DBM=HASH(0x3f61638)
Aug 14 21:57:25.380 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::Bayes=HASH(0x3c7b9a0) implements
'learner_is_scan_available', priority 0
Aug 14 21:57:25.380 [3883] dbg: config: using "/root/.spamassassin" for
user state dir
Aug 14 21:57:25.380 [3883] dbg: bayes: tie-ing to DB file R/O
/root/.spamassassin/bayes_toks
Aug 14 21:57:25.383 [3883] dbg: bayes: tie-ing to DB file R/O
/root/.spamassassin/bayes_seen
Aug 14 21:57:25.387 [3883] dbg: bayes: found bayes db version 3
Aug 14 21:57:25.387 [3883] dbg: bayes: DB journal sync: last sync: 0
Aug 14 21:57:25.387 [3883] dbg: config: using "/root/.spamassassin" for
user state dir
Aug 14 21:57:25.387 [3883] dbg: bayes: not available for scanning, only
2 spam(s) in bayes DB < 200
Aug 14 21:57:25.387 [3883] dbg: bayes: untie-ing
Aug 14 21:57:25.387 [3883] dbg: config: score set 1 chosen.
Aug 14 21:57:25.387 [3883] dbg: config: time limit 30.0 s
Aug 14 21:57:25.391 [3883] dbg: message: main message type:
multipart/mixed
Aug 14 21:57:25.391 [3883] dbg: check: pms new, time limit in 28.875 s
Aug 14 21:57:25.392 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::DNSEval=HASH(0x3d682f8) implements
'check_start', priority 0
Aug 14 21:57:25.392 [3883] dbg: bayes: tie-ing to DB file R/O
/root/.spamassassin/bayes_toks
Aug 14 21:57:25.395 [3883] dbg: bayes: tie-ing to DB file R/O
/root/.spamassassin/bayes_seen
Aug 14 21:57:25.398 [3883] dbg: bayes: found bayes db version 3
Aug 14 21:57:25.399 [3883] dbg: bayes: DB journal sync: last sync: 0
Aug 14 21:57:25.399 [3883] dbg: bayes: not available for scanning, only
2 spam(s) in bayes DB < 200
Aug 14 21:57:25.399 [3883] dbg: bayes: untie-ing
Aug 14 21:57:25.399 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::Check=HASH(0x2722dd8) implements
'check_main', priority 0
Aug 14 21:57:25.399 [3883] dbg: config: internal_networks not
configured, using trusted_networks configuration for internal_networks;
if you really want internal_networks to only contain the required 127/8
add 'internal_networks !0/0' to your configuration
Aug 14 21:57:25.400 [3883] dbg: received-header: parsed as [.
ip=65.55.116.91 rdns=blu0-omc3-s16.blu0.hotmail.com
helo=blu0-omc3-s16.blu0.hotmail.com by=kilnar.com ident= envfrom= intl=0
id=30434200283 auth= msa=0 ]
Aug 14 21:57:25.400 [3883] dbg: received-header: relay 65.55.116.91
trusted? no internal? no msa? no
Aug 14 21:57:25.401 [3883] dbg: received-header: parsed as [.
ip=65.55.116.72 rdns= helo=BLU166-W35 by=blu0-omc3-s16.blu0.hotmail.com
ident= envfrom= intl=0 id= auth= msa=0 ]
Aug 14 21:57:25.401 [3883] dbg: received-header: relay 65.55.116.72
trusted? no internal? no msa? no
Aug 14 21:57:25.408 [3883] dbg: received-header: parsed as [.
ip=75.71.202.179 rdns= helo= by= ident= envfrom= intl=0 id= auth= msa=0
]
Aug 14 21:57:25.408 [3883] dbg: received-header: relay 75.71.202.179
trusted? no internal? no msa? no
Aug 14 21:57:25.408 [3883] dbg: metadata: X-Spam-Relays-Trusted:
Aug 14 21:57:25.408 [3883] dbg: metadata: X-Spam-Relays-Untrusted: [.
ip=65.55.116.91 rdns=blu0-omc3-s16.blu0.hotmail.com
helo=blu0-omc3-s16.blu0.hotmail.com by=kilnar.com ident= envfrom= intl=0
id=30434200283 auth= msa=0 ] [. ip=65.55.116.72 rdns= helo=BLU166-W35
by=blu0-omc3-s16.blu0.hotmail.com ident= envfrom= intl=0 id= auth= msa=0
] [. ip=75.71.202.179 rdns= helo= by= ident= envfrom= intl=0 id= auth=
msa=0 ]
Aug 14 21:57:25.408 [3883] dbg: metadata: X-Spam-Relays-Internal:
Aug 14 21:57:25.408 [3883] dbg: metadata: X-Spam-Relays-External: [.
ip=65.55.116.91 rdns=blu0-omc3-s16.blu0.hotmail.com
helo=blu0-omc3-s16.blu0.hotmail.com by=kilnar.com ident= envfrom= intl=0
id=30434200283 auth= msa=0 ] [. ip=65.55.116.72 rdns= helo=BLU166-W35
by=blu0-omc3-s16.blu0.hotmail.com ident= envfrom= intl=0 id= auth= msa=0
] [. ip=75.71.202.179 rdns= helo= by= ident= envfrom= intl=0 id= auth=
msa=0 ]
Aug 14 21:57:25.408 [3883] dbg: message: ---- MIME PARSER START ----
Aug 14 21:57:25.408 [3883] dbg: message: parsing multipart, got
boundary: _eb78356d-6d12-4a21-8c50-edd440caf9ed_
Aug 14 21:57:25.409 [3883] dbg: message: found part of type
multipart/alternative, boundary: _19d354d1-dd2f-4b50-8e0c-dc5c61e7c41b_
Aug 14 21:57:25.409 [3883] dbg: message: added part, type:
multipart/alternative
Aug 14 21:57:25.412 [3883] dbg: message: found part of type text/plain,
boundary: _eb78356d-6d12-4a21-8c50-edd440caf9ed_
Aug 14 21:57:25.412 [3883] dbg: message: added part, type: text/plain
Aug 14 21:57:25.412 [3883] dbg: message: parsing multipart, got
boundary: _19d354d1-dd2f-4b50-8e0c-dc5c61e7c41b_
Aug 14 21:57:25.412 [3883] dbg: message: found part of type text/plain,
boundary: _19d354d1-dd2f-4b50-8e0c-dc5c61e7c41b_
Aug 14 21:57:25.412 [3883] dbg: message: added part, type: text/plain
Aug 14 21:57:25.412 [3883] dbg: message: found part of type text/html,
boundary: _19d354d1-dd2f-4b50-8e0c-dc5c61e7c41b_
Aug 14 21:57:25.412 [3883] dbg: message: added part, type: text/html
Aug 14 21:57:25.413 [3883] dbg: message: parsing normal part
Aug 14 21:57:25.413 [3883] dbg: message: parsing normal part
Aug 14 21:57:25.413 [3883] dbg: message: parsing normal part
Aug 14 21:57:25.413 [3883] dbg: message: ---- MIME PARSER END ----
Aug 14 21:57:25.413 [3883] dbg: message: decoding quoted-printable
Aug 14 21:57:25.413 [3883] dbg: message: decoding quoted-printable
Aug 14 21:57:25.415 [3883] dbg: message: decoding base64
Aug 14 21:57:25.417 [3883] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x3521630) implements
'parsed_metadata', priority 0
Aug 14 21:57:25.417 [3883] dbg: dns: is_dns_available() last checked
1345003045.4 seconds ago; re-checking
Aug 14 21:57:25.418 [3883] dbg: dns: is Net::DNS::Resolver available?
yes
Aug 14 21:57:25.418 [3883] dbg: dns: Net::DNS version: 0.65
Aug 14 21:57:25.418 [3883] dbg: dns: name server: 127.0.0.1, LocalAddr:
0.0.0.0
Aug 14 21:57:25.419 [3883] dbg: dns: resolver socket rx buffer size is
124928 bytes
Aug 14 21:57:25.419 [3883] dbg: dns: testing resolver nameservers:
127.0.0.1, 64.111.18.230
Aug 14 21:57:25.419 [3883] dbg: dns: trying (3) linux.org...
Aug 14 21:57:25.419 [3883] dbg: dns: looking up NS for 'linux.org'
Aug 14 21:57:25.419 [3883] dbg: dns: providing a callback for id:
21280/linux.org/NS/IN
Aug 14 21:57:25.421 [3883] dbg: dns: NS lookup of linux.org using
127.0.0.1 succeeded => DNS available (set dns_available to override)
Aug 14 21:57:25.421 [3883] dbg: dns: name server: 64.111.18.230,
LocalAddr: 0.0.0.0
Aug 14 21:57:25.421 [3883] dbg: dns: resolver socket rx buffer size is
124928 bytes
Aug 14 21:57:25.421 [3883] dbg: dns: trying (3) sun.com...
Aug 14 21:57:25.421 [3883] dbg: dns: looking up NS for 'sun.com'
Aug 14 21:57:25.421 [3883] dbg: dns: providing a callback for id:
13073/sun.com/NS/IN
Aug 14 21:57:25.422 [3883] dbg: dns: NS lookup of sun.com using
64.111.18.230 succeeded => DNS available (set dns_available to override)
Aug 14 21:57:25.422 [3883] dbg: dns: name server: 64.111.18.230,
LocalAddr: 0.0.0.0
Aug 14 21:57:25.422 [3883] dbg: dns: resolver socket rx buffer size is
124928 bytes
Aug 14 21:57:25.422 [3883] dbg: dns: NS list: 127.0.0.1, 64.111.18.230
Aug 14 21:57:25.422 [3883] dbg: dns: name server: 127.0.0.1, LocalAddr:
0.0.0.0
Aug 14 21:57:25.423 [3883] dbg: dns: resolver socket rx buffer size is
124928 bytes
Aug 14 21:57:25.423 [3883] dbg: dns: is DNS available? 1
Aug 14 21:57:25.448 [3883] dbg: uridnsbl: domain microsoft.com in skip
list
Aug 14 21:57:25.448 [3883] dbg: uridnsbl: domain hotmail.com in skip
list
Aug 14 21:57:25.448 [3883] dbg: uridnsbl: domains to query: csfwg.org
Aug 14 21:57:25.448 [3883] dbg: dns: providing a callback for id:
60508/csfwg.org.multi.surbl.org/A/IN
Aug 14 21:57:25.448 [3883] dbg: async: starting: URI-DNSBL,
DNSBL:multi.surbl.org.:csfwg.org (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.448 [3883] dbg: dns: URIBL_PH_SURBL lookup start
Aug 14 21:57:25.449 [3883] dbg: dns: providing a callback for id:
61365/csfwg.org.multi.uribl.com/A/IN
Aug 14 21:57:25.449 [3883] dbg: async: starting: URI-DNSBL,
DNSBL:multi.uribl.com.:csfwg.org (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.449 [3883] dbg: dns: URIBL_BLACK lookup start
Aug 14 21:57:25.449 [3883] dbg: dns: URIBL_RED lookup start
Aug 14 21:57:25.449 [3883] dbg: dns: URIBL_GREY lookup start
Aug 14 21:57:25.449 [3883] dbg: dns: providing a callback for id:
35902/csfwg.org.dob.sibl.support-intelligence.net/A/IN
Aug 14 21:57:25.450 [3883] dbg: async: starting: URI-DNSBL,
DNSBL:dob.sibl.support-intelligence.net:csfwg.org (timeout 15.0s, min
3.0s)
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_RHS_DOB lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_SC_SURBL lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_JP_SURBL lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_AB_SURBL lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_WS_SURBL lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_OB_SURBL lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_BLOCKED lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: providing a callback for id:
61694/csfwg.org.dbl.spamhaus.org/A/IN
Aug 14 21:57:25.450 [3883] dbg: async: starting: URI-DNSBL,
DNSBL:dbl.spamhaus.org.:csfwg.org (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_DBL_ERROR lookup start
Aug 14 21:57:25.450 [3883] dbg: dns: URIBL_DBL_SPAM lookup start
Aug 14 21:57:25.451 [3883] dbg: dns: URIBL_DBL_REDIR lookup start
Aug 14 21:57:25.451 [3883] dbg: dns: providing a callback for id:
13595/csfwg.org/NS/IN
Aug 14 21:57:25.451 [3883] dbg: async: starting: URI-NS, NS:csfwg.org
(timeout 15.0s, min 3.0s)
Aug 14 21:57:25.451 [3883] dbg: dns: URIBL_SBL lookup start
Aug 14 21:57:25.451 [3883] dbg: dns: checking RBL combined.njabl.org.,
set njabl
Aug 14 21:57:25.451 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.452 [3883] dbg: dns: only inspecting the following IPs:
75.71.202.179, 65.55.116.72, 65.55.116.91
Aug 14 21:57:25.452 [3883] dbg: dns: launching DNS A query for
179.202.71.75.combined.njabl.org. in background
Aug 14 21:57:25.452 [3883] dbg: dns: providing a callback for id:
42605/179.202.71.75.combined.njabl.org/A/IN
Aug 14 21:57:25.452 [3883] dbg: async: starting: DNSBL-A,
dns:A:179.202.71.75.combined.njabl.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.453 [3883] dbg: dns: launching DNS A query for
72.116.55.65.combined.njabl.org. in background
Aug 14 21:57:25.453 [3883] dbg: dns: providing a callback for id:
36290/72.116.55.65.combined.njabl.org/A/IN
Aug 14 21:57:25.453 [3883] dbg: async: starting: DNSBL-A,
dns:A:72.116.55.65.combined.njabl.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.453 [3883] dbg: dns: launching DNS A query for
91.116.55.65.combined.njabl.org. in background
Aug 14 21:57:25.453 [3883] dbg: dns: providing a callback for id:
51086/91.116.55.65.combined.njabl.org/A/IN
Aug 14 21:57:25.454 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.combined.njabl.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.454 [3883] dbg: dns: checking RBL bl.spamcop.net., set
spamcop
Aug 14 21:57:25.454 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.454 [3883] dbg: dns: only inspecting the following IPs:
75.71.202.179, 65.55.116.72, 65.55.116.91
Aug 14 21:57:25.454 [3883] dbg: dns: launching DNS TXT query for
179.202.71.75.bl.spamcop.net. in background
Aug 14 21:57:25.455 [3883] dbg: dns: providing a callback for id:
20813/179.202.71.75.bl.spamcop.net/TXT/IN
Aug 14 21:57:25.455 [3883] dbg: async: starting: DNSBL-TXT,
dns:TXT:179.202.71.75.bl.spamcop.net. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.455 [3883] dbg: dns: launching DNS TXT query for
72.116.55.65.bl.spamcop.net. in background
Aug 14 21:57:25.455 [3883] dbg: dns: providing a callback for id:
19568/72.116.55.65.bl.spamcop.net/TXT/IN
Aug 14 21:57:25.455 [3883] dbg: async: starting: DNSBL-TXT,
dns:TXT:72.116.55.65.bl.spamcop.net. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.455 [3883] dbg: dns: launching DNS TXT query for
91.116.55.65.bl.spamcop.net. in background
Aug 14 21:57:25.456 [3883] dbg: dns: providing a callback for id:
20233/91.116.55.65.bl.spamcop.net/TXT/IN
Aug 14 21:57:25.456 [3883] dbg: async: starting: DNSBL-TXT,
dns:TXT:91.116.55.65.bl.spamcop.net. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.456 [3883] dbg: dns: checking RBL zen.spamhaus.org.,
set zen-lastexternal
Aug 14 21:57:25.456 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.456 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.456 [3883] dbg: dns: launching DNS A query for
91.116.55.65.zen.spamhaus.org. in background
Aug 14 21:57:25.457 [3883] dbg: dns: providing a callback for id:
6614/91.116.55.65.zen.spamhaus.org/A/IN
Aug 14 21:57:25.457 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.zen.spamhaus.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.457 [3883] dbg: dns: checking RBL dnsbl.sorbs.net., set
sorbs-lastexternal
Aug 14 21:57:25.457 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.457 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.457 [3883] dbg: dns: launching DNS A query for
91.116.55.65.dnsbl.sorbs.net. in background
Aug 14 21:57:25.458 [3883] dbg: dns: providing a callback for id:
27447/91.116.55.65.dnsbl.sorbs.net/A/IN
Aug 14 21:57:25.458 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.dnsbl.sorbs.net. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.458 [3883] dbg: dns: checking RBL dnsbl.sorbs.net., set
sorbs
Aug 14 21:57:25.458 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.458 [3883] dbg: dns: only inspecting the following IPs:
75.71.202.179, 65.55.116.72, 65.55.116.91
Aug 14 21:57:25.458 [3883] dbg: dns: launching DNS A query for
179.202.71.75.dnsbl.sorbs.net. in background
Aug 14 21:57:25.459 [3883] dbg: dns: providing a callback for id:
61481/179.202.71.75.dnsbl.sorbs.net/A/IN
Aug 14 21:57:25.459 [3883] dbg: async: starting: DNSBL-A,
dns:A:179.202.71.75.dnsbl.sorbs.net. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.459 [3883] dbg: dns: launching DNS A query for
72.116.55.65.dnsbl.sorbs.net. in background
Aug 14 21:57:25.459 [3883] dbg: dns: providing a callback for id:
40546/72.116.55.65.dnsbl.sorbs.net/A/IN
Aug 14 21:57:25.459 [3883] dbg: async: starting: DNSBL-A,
dns:A:72.116.55.65.dnsbl.sorbs.net. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.460 [3883] dbg: dns: checking RBL
bl.score.senderscore.com., set rnbl-lastexternal
Aug 14 21:57:25.460 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.461 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.461 [3883] dbg: dns: launching DNS A query for
91.116.55.65.bl.score.senderscore.com. in background
Aug 14 21:57:25.461 [3883] dbg: dns: providing a callback for id:
23154/91.116.55.65.bl.score.senderscore.com/A/IN
Aug 14 21:57:25.461 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.bl.score.senderscore.com. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.461 [3883] dbg: dns: checking RBL zen.spamhaus.org.,
set zen-lastexternal
Aug 14 21:57:25.461 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.462 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.462 [3883] dbg: dns: checking RBL psbl.surriel.com.,
set psbl-lastexternal
Aug 14 21:57:25.462 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.462 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.462 [3883] dbg: dns: launching DNS A query for
91.116.55.65.psbl.surriel.com. in background
Aug 14 21:57:25.462 [3883] dbg: dns: providing a callback for id:
52536/91.116.55.65.psbl.surriel.com/A/IN
Aug 14 21:57:25.463 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.psbl.surriel.com. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.463 [3883] dbg: dns: checking RBL list.dnswl.org., set
dnswl-firsttrusted
Aug 14 21:57:25.463 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.463 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.463 [3883] dbg: dns: launching DNS A query for
91.116.55.65.list.dnswl.org. in background
Aug 14 21:57:25.463 [3883] dbg: dns: providing a callback for id:
8538/91.116.55.65.list.dnswl.org/A/IN
Aug 14 21:57:25.464 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.list.dnswl.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.464 [3883] dbg: dns: checking RBL
bb.barracudacentral.org., set brbl-lastexternal
Aug 14 21:57:25.464 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.464 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.464 [3883] dbg: dns: launching DNS A query for
91.116.55.65.bb.barracudacentral.org. in background
Aug 14 21:57:25.464 [3883] dbg: dns: providing a callback for id:
24162/91.116.55.65.bb.barracudacentral.org/A/IN
Aug 14 21:57:25.464 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.bb.barracudacentral.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.465 [3883] dbg: dns: checking RBL
sa-trusted.bondedsender.org., set ssc-firsttrusted
Aug 14 21:57:25.465 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.465 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.465 [3883] dbg: dns: launching DNS TXT query for
91.116.55.65.sa-trusted.bondedsender.org. in background
Aug 14 21:57:25.465 [3883] dbg: dns: providing a callback for id:
45027/91.116.55.65.sa-trusted.bondedsender.org/TXT/IN
Aug 14 21:57:25.466 [3883] dbg: async: starting: DNSBL-TXT,
dns:TXT:91.116.55.65.sa-trusted.bondedsender.org. (timeout 15.0s, min
3.0s)
Aug 14 21:57:25.466 [3883] dbg: dns: checking RBL zen.spamhaus.org.,
set zen
Aug 14 21:57:25.466 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.466 [3883] dbg: dns: only inspecting the following IPs:
75.71.202.179, 65.55.116.72, 65.55.116.91
Aug 14 21:57:25.466 [3883] dbg: dns: launching DNS A query for
179.202.71.75.zen.spamhaus.org. in background
Aug 14 21:57:25.467 [3883] dbg: dns: providing a callback for id:
18049/179.202.71.75.zen.spamhaus.org/A/IN
Aug 14 21:57:25.467 [3883] dbg: async: starting: DNSBL-A,
dns:A:179.202.71.75.zen.spamhaus.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.467 [3883] dbg: dns: launching DNS A query for
72.116.55.65.zen.spamhaus.org. in background
Aug 14 21:57:25.467 [3883] dbg: dns: providing a callback for id:
7906/72.116.55.65.zen.spamhaus.org/A/IN
Aug 14 21:57:25.467 [3883] dbg: async: starting: DNSBL-A,
dns:A:72.116.55.65.zen.spamhaus.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.467 [3883] dbg: dns: checking RBL
sa-accredit.habeas.com., set ssc-firsttrusted
Aug 14 21:57:25.467 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.468 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.468 [3883] dbg: dns: launching DNS TXT query for
91.116.55.65.sa-accredit.habeas.com. in background
Aug 14 21:57:25.468 [3883] dbg: dns: providing a callback for id:
4294/91.116.55.65.sa-accredit.habeas.com/TXT/IN
Aug 14 21:57:25.468 [3883] dbg: async: starting: DNSBL-TXT,
dns:TXT:91.116.55.65.sa-accredit.habeas.com. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.468 [3883] dbg: dns: checking RBL iadb.isipp.com., set
iadb-firsttrusted
Aug 14 21:57:25.470 [3883] dbg: dns: IPs found: full-external:
65.55.116.91, 65.55.116.72, 75.71.202.179 untrusted: 65.55.116.91,
65.55.116.72, 75.71.202.179 originating: 75.71.202.179
Aug 14 21:57:25.470 [3883] dbg: dns: only inspecting the following IPs:
65.55.116.91
Aug 14 21:57:25.470 [3883] dbg: dns: launching DNS A query for
91.116.55.65.iadb.isipp.com. in background
Aug 14 21:57:25.471 [3883] dbg: dns: providing a callback for id:
13136/91.116.55.65.iadb.isipp.com/A/IN
Aug 14 21:57:25.471 [3883] dbg: async: starting: DNSBL-A,
dns:A:91.116.55.65.iadb.isipp.com. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.472 [3883] dbg: check: check_main, time limit in 28.795
s
Aug 14 21:57:25.472 [3883] dbg: check: running tests for priority:
-1000
Aug 14 21:57:25.474 [3883] dbg: dns: hit
<dns:179.202.71.75.dnsbl.sorbs.net> 127.0.0.10
Aug 14 21:57:25.475 [3883] dbg: dns: hit
<dns:91.116.55.65.list.dnswl.org> 127.0.5.0
Aug 14 21:57:25.475 [3883] dbg: async: select found 7 responses ready
(t.o.=0.0)
Aug 14 21:57:25.475 [3883] dbg: async: completed in 0.004 s: DNSBL-A,
dns:A:91.116.55.65.iadb.isipp.com.
Aug 14 21:57:25.476 [3883] dbg: async: completed in 0.013 s: DNSBL-A,
dns:A:179.202.71.75.dnsbl.sorbs.net.
Aug 14 21:57:25.476 [3883] dbg: async: completed in 0.011 s: DNSBL-A,
dns:A:91.116.55.65.list.dnswl.org.
Aug 14 21:57:25.476 [3883] dbg: async: completed in 0.021 s: URI-NS,
NS:csfwg.org
Aug 14 21:57:25.476 [3883] dbg: dns: providing a callback for id:
40125/dns2.csfwg.org/A/IN
Aug 14 21:57:25.476 [3883] dbg: async: starting: URI-A,
A:dns2.csfwg.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.476 [3883] dbg: dns: providing a callback for id:
53606/dns1.csfwg.org/A/IN
Aug 14 21:57:25.477 [3883] dbg: async: starting: URI-A,
A:dns1.csfwg.org. (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.477 [3883] dbg: async: completed in 0.014 s: DNSBL-A,
dns:A:91.116.55.65.dnsbl.sorbs.net.
Aug 14 21:57:25.477 [3883] dbg: async: completed in 0.015 s: DNSBL-A,
dns:A:72.116.55.65.dnsbl.sorbs.net.
Aug 14 21:57:25.477 [3883] dbg: async: completed in 0.013 s: DNSBL-A,
dns:A:91.116.55.65.bl.score.senderscore.com.
Aug 14 21:57:25.477 [3883] dbg: async: queries completed: 7, started: 2
Aug 14 21:57:25.477 [3883] dbg: async: queries active: DNSBL-A=8
DNSBL-TXT=5 URI-A=2 URI-DNSBL=4 at Tue Aug 14 21:57:25 2012
Aug 14 21:57:25.477 [3883] dbg: dns: harvested completed queries
Aug 14 21:57:25.477 [3883] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 21:57:25.477 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 282 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_neg1000_1
Aug 14 21:57:25.478 [3883] dbg: rules: run_generic_tests - compiling
eval code: head, priority -1000
Aug 14 21:57:25.478 [3883] dbg: rules: compiled head tests
Aug 14 21:57:25.478 [3883] dbg: rules: running head_eval tests; score
so far=-0.0001
Aug 14 21:57:25.478 [3883] dbg: rules: run_eval_tests - compiling eval
code: 9, priority -1000
Aug 14 21:57:25.479 [3883] dbg: eval: all '*From' addrs:
mel_kary [at] hotmail
Aug 14 21:57:25.483 [3883] dbg: eval: all '*To' addrs:
anthology [at] csfwg
Aug 14 21:57:25.483 [3883] dbg: rules: running body tests; score so
far=-0.0001
Aug 14 21:57:25.484 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 225 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_neg1000_1
Aug 14 21:57:25.484 [3883] dbg: rules: run_generic_tests - compiling
eval code: body, priority -1000
Aug 14 21:57:25.484 [3883] dbg: rules: compiled body tests
Aug 14 21:57:25.484 [3883] dbg: rules: running uri tests; score so
far=-0.0001
Aug 14 21:57:25.484 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 223 chars of
Mail::SpamAssassin::Plugin::Check::_uri_tests_neg1000_1
Aug 14 21:57:25.484 [3883] dbg: rules: run_generic_tests - compiling
eval code: uri, priority -1000
Aug 14 21:57:25.484 [3883] dbg: rules: compiled uri tests
Aug 14 21:57:25.484 [3883] dbg: rules: running body_eval tests; score
so far=-0.0001
Aug 14 21:57:25.485 [3883] dbg: rules: run_eval_tests - compiling eval
code: 11, priority -1000
Aug 14 21:57:25.485 [3883] dbg: rules: running rawbody tests; score so
far=-0.0001
Aug 14 21:57:25.485 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 231 chars of
Mail::SpamAssassin::Plugin::Check::_rawbody_tests_neg1000_1
Aug 14 21:57:25.485 [3883] dbg: rules: run_generic_tests - compiling
eval code: rawbody, priority -1000
Aug 14 21:57:25.485 [3883] dbg: rules: compiled rawbody tests
Aug 14 21:57:25.485 [3883] dbg: rules: running full tests; score so
far=-0.0001
Aug 14 21:57:25.485 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 260 chars of
Mail::SpamAssassin::Plugin::Check::_full_tests_neg1000_1
Aug 14 21:57:25.486 [3883] dbg: rules: run_generic_tests - compiling
eval code: full, priority -1000
Aug 14 21:57:25.486 [3883] dbg: rules: compiled full tests
Aug 14 21:57:25.486 [3883] dbg: rules: running meta tests; score so
far=-0.0001
Aug 14 21:57:25.486 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 285 chars of
Mail::SpamAssassin::Plugin::Check::_meta_tests_neg1000_1
Aug 14 21:57:25.486 [3883] dbg: rules: run_generic_tests - compiling
eval code: meta, priority -1000
Aug 14 21:57:25.486 [3883] dbg: rules: compiled meta tests
Aug 14 21:57:25.487 [3883] dbg: check: running tests for priority: -950
Aug 14 21:57:25.487 [3883] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 21:57:25.487 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 280 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_neg950_1
Aug 14 21:57:25.487 [3883] dbg: rules: run_generic_tests - compiling
eval code: head, priority -950
Aug 14 21:57:25.487 [3883] dbg: rules: compiled head tests
Aug 14 21:57:25.487 [3883] dbg: rules: running head_eval tests; score
so far=-0.0001
Aug 14 21:57:25.487 [3883] dbg: rules: run_eval_tests - compiling eval
code: 9, priority -950
Aug 14 21:57:25.488 [3883] dbg: rules: running body tests; score so
far=-0.0001
Aug 14 21:57:25.488 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 223 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_neg950_1
Aug 14 21:57:25.488 [3883] dbg: rules: run_generic_tests - compiling
eval code: body, priority -950
Aug 14 21:57:25.488 [3883] dbg: rules: compiled body tests
Aug 14 21:57:25.488 [3883] dbg: rules: running uri tests; score so
far=-0.0001
Aug 14 21:57:25.488 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 221 chars of
Mail::SpamAssassin::Plugin::Check::_uri_tests_neg950_1
Aug 14 21:57:25.489 [3883] dbg: rules: run_generic_tests - compiling
eval code: uri, priority -950
Aug 14 21:57:25.489 [3883] dbg: rules: compiled uri tests
Aug 14 21:57:25.489 [3883] dbg: rules: running body_eval tests; score
so far=-0.0001
Aug 14 21:57:25.489 [3883] dbg: rules: run_eval_tests - compiling eval
code: 11, priority -950
Aug 14 21:57:25.489 [3883] dbg: rules: running rawbody tests; score so
far=-0.0001
Aug 14 21:57:25.489 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 229 chars of
Mail::SpamAssassin::Plugin::Check::_rawbody_tests_neg950_1
Aug 14 21:57:25.489 [3883] dbg: rules: run_generic_tests - compiling
eval code: rawbody, priority -950
Aug 14 21:57:25.489 [3883] dbg: rules: compiled rawbody tests
Aug 14 21:57:25.490 [3883] dbg: rules: running full tests; score so
far=-0.0001
Aug 14 21:57:25.490 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 258 chars of
Mail::SpamAssassin::Plugin::Check::_full_tests_neg950_1
Aug 14 21:57:25.490 [3883] dbg: rules: run_generic_tests - compiling
eval code: full, priority -950
Aug 14 21:57:25.490 [3883] dbg: rules: compiled full tests
Aug 14 21:57:25.490 [3883] dbg: rules: running meta tests; score so
far=-0.0001
Aug 14 21:57:25.490 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 283 chars of
Mail::SpamAssassin::Plugin::Check::_meta_tests_neg950_1
Aug 14 21:57:25.490 [3883] dbg: rules: run_generic_tests - compiling
eval code: meta, priority -950
Aug 14 21:57:25.491 [3883] dbg: rules: compiled meta tests
Aug 14 21:57:25.491 [3883] dbg: check: running tests for priority: -900
Aug 14 21:57:25.491 [3883] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 21:57:25.491 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 280 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_neg900_1
Aug 14 21:57:25.491 [3883] dbg: rules: run_generic_tests - compiling
eval code: head, priority -900
Aug 14 21:57:25.491 [3883] dbg: rules: compiled head tests
Aug 14 21:57:25.491 [3883] dbg: rules: running head_eval tests; score
so far=-0.0001
Aug 14 21:57:25.492 [3883] dbg: rules: run_eval_tests - compiling eval
code: 9, priority -900
Aug 14 21:57:25.494 [3883] dbg: rules: running body tests; score so
far=-0.0001
Aug 14 21:57:25.494 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 223 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_neg900_1
Aug 14 21:57:25.494 [3883] dbg: rules: run_generic_tests - compiling
eval code: body, priority -900
Aug 14 21:57:25.494 [3883] dbg: rules: compiled body tests
Aug 14 21:57:25.494 [3883] dbg: rules: running uri tests; score so
far=-0.0001
Aug 14 21:57:25.494 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 221 chars of
Mail::SpamAssassin::Plugin::Check::_uri_tests_neg900_1
Aug 14 21:57:25.494 [3883] dbg: rules: run_generic_tests - compiling
eval code: uri, priority -900
Aug 14 21:57:25.494 [3883] dbg: rules: compiled uri tests
Aug 14 21:57:25.495 [3883] dbg: rules: running body_eval tests; score
so far=-0.0001
Aug 14 21:57:25.495 [3883] dbg: rules: run_eval_tests - compiling eval
code: 11, priority -900
Aug 14 21:57:25.495 [3883] dbg: rules: running rawbody tests; score so
far=-0.0001
Aug 14 21:57:25.495 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 229 chars of
Mail::SpamAssassin::Plugin::Check::_rawbody_tests_neg900_1
Aug 14 21:57:25.495 [3883] dbg: rules: run_generic_tests - compiling
eval code: rawbody, priority -900
Aug 14 21:57:25.495 [3883] dbg: rules: compiled rawbody tests
Aug 14 21:57:25.495 [3883] dbg: rules: running full tests; score so
far=-0.0001
Aug 14 21:57:25.496 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 258 chars of
Mail::SpamAssassin::Plugin::Check::_full_tests_neg900_1
Aug 14 21:57:25.496 [3883] dbg: rules: run_generic_tests - compiling
eval code: full, priority -900
Aug 14 21:57:25.496 [3883] dbg: rules: compiled full tests
Aug 14 21:57:25.496 [3883] dbg: rules: running meta tests; score so
far=-0.0001
Aug 14 21:57:25.496 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 283 chars of
Mail::SpamAssassin::Plugin::Check::_meta_tests_neg900_1
Aug 14 21:57:25.496 [3883] dbg: rules: run_generic_tests - compiling
eval code: meta, priority -900
Aug 14 21:57:25.496 [3883] dbg: rules: compiled meta tests
Aug 14 21:57:25.496 [3883] dbg: check: running tests for priority: -400
Aug 14 21:57:25.497 [3883] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 21:57:25.497 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 280 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_neg400_1
Aug 14 21:57:25.497 [3883] dbg: rules: run_generic_tests - compiling
eval code: head, priority -400
Aug 14 21:57:25.497 [3883] dbg: rules: compiled head tests
Aug 14 21:57:25.497 [3883] dbg: rules: running body tests; score so
far=-0.0001
Aug 14 21:57:25.497 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 223 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_neg400_1
Aug 14 21:57:25.497 [3883] dbg: rules: run_generic_tests - compiling
eval code: body, priority -400
Aug 14 21:57:25.498 [3883] dbg: rules: compiled body tests
Aug 14 21:57:25.498 [3883] dbg: rules: running uri tests; score so
far=-0.0001
Aug 14 21:57:25.498 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 221 chars of
Mail::SpamAssassin::Plugin::Check::_uri_tests_neg400_1
Aug 14 21:57:25.498 [3883] dbg: rules: run_generic_tests - compiling
eval code: uri, priority -400
Aug 14 21:57:25.498 [3883] dbg: rules: compiled uri tests
Aug 14 21:57:25.498 [3883] dbg: rules: running body_eval tests; score
so far=-0.0001
Aug 14 21:57:25.498 [3883] dbg: rules: run_eval_tests - compiling eval
code: 11, priority -400
Aug 14 21:57:25.499 [3883] dbg: rules: running rawbody tests; score so
far=-0.0001
Aug 14 21:57:25.499 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 229 chars of
Mail::SpamAssassin::Plugin::Check::_rawbody_tests_neg400_1
Aug 14 21:57:25.499 [3883] dbg: rules: run_generic_tests - compiling
eval code: rawbody, priority -400
Aug 14 21:57:25.499 [3883] dbg: rules: compiled rawbody tests
Aug 14 21:57:25.499 [3883] dbg: rules: running full tests; score so
far=-0.0001
Aug 14 21:57:25.499 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 258 chars of
Mail::SpamAssassin::Plugin::Check::_full_tests_neg400_1
Aug 14 21:57:25.499 [3883] dbg: rules: run_generic_tests - compiling
eval code: full, priority -400
Aug 14 21:57:25.499 [3883] dbg: rules: compiled full tests
Aug 14 21:57:25.500 [3883] dbg: rules: running meta tests; score so
far=-0.0001
Aug 14 21:57:25.500 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 283 chars of
Mail::SpamAssassin::Plugin::Check::_meta_tests_neg400_1
Aug 14 21:57:25.500 [3883] dbg: rules: run_generic_tests - compiling
eval code: meta, priority -400
Aug 14 21:57:25.500 [3883] dbg: rules: compiled meta tests
Aug 14 21:57:25.500 [3883] dbg: check: running tests for priority: 0
Aug 14 21:57:25.500 [3883] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 21:57:25.518 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60279 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_1
Aug 14 21:57:25.527 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60481 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_2
Aug 14 21:57:25.535 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60404 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_3
Aug 14 21:57:25.542 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60257 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_4
Aug 14 21:57:25.550 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60504 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_5
Aug 14 21:57:25.558 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 58923 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_6
Aug 14 21:57:25.564 [3883] dbg: rules: run_generic_tests - compiling
eval code: head, priority 0
Aug 14 21:57:25.564 [3883] dbg: rules: compiled head tests
Aug 14 21:57:25.565 [3883] dbg: rules: ran header rule
__LAST_EXTERNAL_RELAY_NO_AUTH ======> got hit: "[. ip=65.55.116.91
rdns=blu0-omc3-s16.blu0.hotmail.com helo=blu0-omc3-s16.blu0.hotmail.com
by=kilnar.com ident= envfrom= intl=0 id=30434200283 auth= "
Aug 14 21:57:25.565 [3883] dbg: rules: ran header rule __HOST_HOTMAIL
======> got hit: "[ ip=65.55.116.91 rdns=blu0-omc3-s16.blu0.hotmail.com
"
Aug 14 21:57:25.565 [3883] dbg: rules: ran header rule
__RCD_RDNS_MAIL_MESSY ======> got hit: "[ ip=65.55.116.91
rdns=blu0-omc3-s16.blu0.hotmail"
Aug 14 21:57:25.566 [3883] dbg: rules: ran header rule
__DOS_RELAYED_EXT ======> got hit: "Received: from
blu0-omc3-s16.blu0.hotmail.com (blu0-omc3-s16.blu0.hotmail.com
[65.55.116.91])
Aug 14 21:57:25.566 [3883] dbg: rules: [...]
Aug 14 21:57:25.566 [3883] dbg: rules: [...] by kilnar.com (Postfix)
with ESMTP id 30434200283
Aug 14 21:57:25.566 [3883] dbg: rules: [...]
Aug 14 21:57:25.566 [3883] dbg: rules: [...] for <anthology [at] csfwg>;
Tue, 14 Aug 2012 17:23:25 -0600 (MDT)
Aug 14 21:57:25.566 [3883] dbg: rules: [...]
Aug 14 21:57:25.566 [3883] dbg: rules: [...] Received: "
Aug 14 21:57:25.566 [3883] dbg: rules: ran header rule
__CTYPE_HAS_BOUNDARY ======> got hit: "boundary"
Aug 14 21:57:25.566 [3883] dbg: rules: ran header rule __CT ======> got
hit: "<YES>"
Aug 14 21:57:25.566 [3883] dbg: rules: ran header rule
__CTYPE_MULTIPART_ANY ======> got hit: "multipart/mixed"
Aug 14 21:57:25.566 [3883] dbg: rules: ran header rule __HAS_DATE
======> got hit: "<YES>"
Aug 14 21:57:25.567 [3883] dbg: rules: ran header rule
__LAST_UNTRUSTED_RELAY_NO_AUTH ======> got hit: "[. ip=65.55.116.91
rdns=blu0-omc3-s16.blu0.hotmail.com helo=blu0-omc3-s16.blu0.hotmail.com
by=kilnar.com ident= envfrom= intl=0 id=30434200283 auth= "
Aug 14 21:57:25.567 [3883] dbg: rules: ran header rule __MSGID_OK_HOST
======> got hit: "@phx.gbl>"
Aug 14 21:57:25.567 [3883] dbg: rules: ran header rule __HAS_MESSAGE_ID
======> got hit: "<YES>"
Aug 14 21:57:25.568 [3883] dbg: rules: ran header rule __MIME_VERSION
======> got hit: "<YES>"
Aug 14 21:57:25.568 [3883] dbg: rules: ran header rule __TOCC_EXISTS
======> got hit: "<YES>"
Aug 14 21:57:25.568 [3883] dbg: rules: ran header rule __HAS_RCVD
======> got hit: "<YES>"
Aug 14 21:57:25.568 [3883] dbg: rules: ran header rule __DOS_RCVD_TUE
======> got hit: " Tue, "
Aug 14 21:57:25.568 [3883] dbg: rules: ran header rule __HS_SUBJ_RE_FW
======> got hit: "RE:"
Aug 14 21:57:25.569 [3883] dbg: rules: ran header rule __HAS_SUBJECT
======> got hit: "<YES>"
Aug 14 21:57:25.569 [3883] dbg: rules: ran header rule __SUBJ_RE
======> got hit: "RE:"
Aug 14 21:57:25.570 [3883] dbg: rules: ran header rule __HAS_MSGID
======> got hit: "<"
Aug 14 21:57:25.570 [3883] dbg: rules: ran header rule __SANE_MSGID
======> got hit: "<BLU166-W3502167A19EB605F932121F5B70 [at] phx>
Aug 14 21:57:25.570 [3883] dbg: rules: [...] "
Aug 14 21:57:25.571 [3883] dbg: rules: ran header rule __HAS_TO ======>
got hit: "<YES>"
Aug 14 21:57:25.571 [3883] dbg: rules: ran header rule
__HAS_IN_REPLY_TO ======> got hit: "<YES>"
Aug 14 21:57:25.571 [3883] dbg: rules: ran header rule __HAS_X_REF
======> got hit: "<YES>"
Aug 14 21:57:25.571 [3883] dbg: rules: ran header rule __HAS_FROM
======> got hit: "<YES>"
Aug 14 21:57:25.571 [3883] dbg: rules: ran header rule __FROM_FREEMAIL
======> got hit: "@hotmail."
Aug 14 21:57:25.571 [3883] dbg: rules: ran header rule
__FROM_HOTMAIL_COM ======> got hit: "@hotmail.com"
Aug 14 21:57:25.575 [3883] dbg: async: select found 14 responses ready
(t.o.=0.0)
Aug 14 21:57:25.575 [3883] dbg: async: completed in 0.124 s: URI-DNSBL,
DNSBL:multi.uribl.com.:csfwg.org
Aug 14 21:57:25.575 [3883] dbg: async: completed in 0.110 s: DNSBL-A,
dns:A:91.116.55.65.bb.barracudacentral.org.
Aug 14 21:57:25.575 [3883] dbg: async: completed in 0.121 s: DNSBL-A,
dns:A:179.202.71.75.combined.njabl.org.
Aug 14 21:57:25.575 [3883] dbg: async: completed in 0.096 s: URI-A,
A:dns1.csfwg.org.
Aug 14 21:57:25.576 [3883] dbg: dns: providing a callback for id:
6662/230.18.111.64.zen.spamhaus.org/A/IN
Aug 14 21:57:25.576 [3883] dbg: async: starting: URI-DNSBL,
DNSBL:zen.spamhaus.org.:230.18.111.64 (timeout 15.0s, min 3.0s)
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.096 s: URI-A,
A:dns2.csfwg.org.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.120 s: DNSBL-A,
dns:A:91.116.55.65.combined.njabl.org.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.107 s: DNSBL-A,
dns:A:72.116.55.65.zen.spamhaus.org.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.104 s: DNSBL-TXT,
dns:TXT:91.116.55.65.sa-accredit.habeas.com.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.119 s: DNSBL-TXT,
dns:TXT:72.116.55.65.bl.spamcop.net.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.119 s: DNSBL-TXT,
dns:TXT:179.202.71.75.bl.spamcop.net.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.108 s: DNSBL-TXT,
dns:TXT:91.116.55.65.sa-trusted.bondedsender.org.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.126 s: URI-DNSBL,
DNSBL:multi.surbl.org.:csfwg.org
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.120 s: DNSBL-A,
dns:A:72.116.55.65.combined.njabl.org.
Aug 14 21:57:25.576 [3883] dbg: async: completed in 0.116 s: DNSBL-A,
dns:A:91.116.55.65.zen.spamhaus.org.
Aug 14 21:57:25.576 [3883] dbg: async: queries completed: 14, started:
1
Aug 14 21:57:25.577 [3883] dbg: async: queries active: DNSBL-A=2
DNSBL-TXT=1 URI-DNSBL=3 at Tue Aug 14 21:57:25 2012
Aug 14 21:57:25.577 [3883] dbg: dns: harvested completed queries
Aug 14 21:57:25.577 [3883] dbg: rules: running head_eval tests; score
so far=-0.0001
Aug 14 21:57:25.578 [3883] dbg: rules: run_eval_tests - compiling eval
code: 9, priority 0
Aug 14 21:57:25.584 [3883] dbg: FreeMail: RULE (FREEMAIL_FROM)
check_freemail_from
Aug 14 21:57:25.584 [3883] dbg: FreeMail: all from-addresses:
mel_kary [at] hotmail
Aug 14 21:57:25.584 [3883] dbg: FreeMail: HIT! mel_kary [at] hotmail is
freemail
Aug 14 21:57:25.585 [3883] dbg: rules: ran eval rule FREEMAIL_FROM
======> got hit (1)
Aug 14 21:57:25.606 [3883] dbg: dkim: using Mail::DKIM version 0.38
Aug 14 21:57:25.608 [3883] dbg: dkim: performing public key lookup and
signature verification
Aug 14 21:57:25.608 [3883] dbg: dkim: signature verification result:
none
Aug 14 21:57:25.608 [3883] dbg: dkim: adsp: performing lookup on
_adsp._domainkey.hotmail.com
Aug 14 21:57:25.643 [3883] dbg: dkim: adsp result: U/unknown (dns:
unknown), author domain 'hotmail.com'
Aug 14 21:57:25.644 [3883] dbg: spf: checking to see if the message has
a Received-SPF header that we can use
Aug 14 21:57:25.673 [3883] dbg: spf: using Mail::SPF for SPF checks
Aug 14 21:57:25.673 [3883] dbg: spf: checking HELO
(helo=blu0-omc3-s16.blu0.hotmail.com, ip=65.55.116.91)
Aug 14 21:57:25.674 [3883] dbg: dns: providing a callback for id:
36800/blu0-omc3-s16.blu0.hotmail.com/SPF/IN
Aug 14 21:57:25.675 [3883] dbg: dns: hit
<dns:179.202.71.75.zen.spamhaus.org> 127.0.0.10
Aug 14 21:57:25.676 [3883] dbg: dns: providing a callback for id:
19877/blu0-omc3-s16.blu0.hotmail.com/TXT/IN
Aug 14 21:57:25.677 [3883] dbg: spf: query for
/65.55.116.91/blu0-omc3-s16.blu0.hotmail.com: result: none, comment: ,
text: No applicable sender policy available
Aug 14 21:57:25.679 [3883] dbg: dkim: author mel_kary [at] hotmail, not
in any dkim whitelist
Aug 14 21:57:25.679 [3883] dbg: spf: already checked for Received-SPF
headers, proceeding with DNS based checks
Aug 14 21:57:25.679 [3883] dbg: spf: cannot get Envelope-From, cannot
use SPF
Aug 14 21:57:25.680 [3883] dbg: FreeMail: RULE (__freemail_reply)
check_freemail_replyto
Aug 14 21:57:25.680 [3883] dbg: FreeMail: From address:
mel_kary [at] hotmail
Aug 14 21:57:25.728 [3883] dbg: FreeMail: RULE
(FREEMAIL_REPLYTO_END_DIGIT) check_freemail_header regex:\d@
Aug 14 21:57:25.728 [3883] dbg: FreeMail: header Reply-To not found
from mail
Aug 14 21:57:25.729 [3883] dbg: FreeMail: RULE (__freemail_replyto)
check_freemail_replyto
Aug 14 21:57:25.729 [3883] dbg: FreeMail: From address:
mel_kary [at] hotmail
Aug 14 21:57:25.729 [3883] dbg: FreeMail: Reply-To is not freemail,
skipping check
Aug 14 21:57:25.729 [3883] dbg: FreeMail: RULE (__freemail_hdr_replyto)
check_freemail_header
Aug 14 21:57:25.729 [3883] dbg: FreeMail: header Reply-To not found
from mail
Aug 14 21:57:25.730 [3883] dbg: spf: def_spf_whitelist_from: already
checked spf and didn't get pass, skipping whitelist check
Aug 14 21:57:25.730 [3883] dbg: FreeMail: RULE
(FREEMAIL_ENVFROM_END_DIGIT) check_freemail_header regex:\d@
Aug 14 21:57:25.730 [3883] dbg: FreeMail: header EnvelopeFrom not found
from mail
Aug 14 21:57:25.730 [3883] dbg: spf: whitelist_from_spf: already
checked spf and didn't get pass, skipping whitelist check
Aug 14 21:57:25.731 [3883] dbg: async: select found no responses ready
(t.o.=0.0)
Aug 14 21:57:25.731 [3883] dbg: async: completed in 0.208 s: DNSBL-A,
dns:A:179.202.71.75.zen.spamhaus.org.
Aug 14 21:57:25.731 [3883] dbg: async: completed in 0.099 s: URI-DNSBL,
DNSBL:zen.spamhaus.org.:230.18.111.64
Aug 14 21:57:25.731 [3883] dbg: async: completed in 0.225 s: URI-DNSBL,
DNSBL:dbl.spamhaus.org.:csfwg.org
Aug 14 21:57:25.731 [3883] dbg: async: completed in 0.220 s: DNSBL-TXT,
dns:TXT:91.116.55.65.bl.spamcop.net.
Aug 14 21:57:25.731 [3883] dbg: async: queries completed: 4, started: 0
Aug 14 21:57:25.731 [3883] dbg: async: queries active: DNSBL-A=1
URI-DNSBL=1 at Tue Aug 14 21:57:25 2012
Aug 14 21:57:25.731 [3883] dbg: dns: harvested completed queries
Aug 14 21:57:25.731 [3883] dbg: rules: running body tests; score so
far=0.0009
Aug 14 21:57:25.735 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60166 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_1
Aug 14 21:57:25.746 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60299 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_2
Aug 14 21:57:25.758 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60330 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_3
Aug 14 21:57:25.768 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60195 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_4
Aug 14 21:57:25.779 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60455 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_5
Aug 14 21:57:25.791 [3883] dbg: rules: flush_evalstr (add_evalstr)
compiling 60430 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_6
Aug 14 21:57:25.799 [3883] dbg: rules: flush_evalstr
(run_generic_tests) compiling 8457 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_7
Aug 14 21:57:25.801 [3883] dbg: rules: run_generic_tests - compiling
eval code: body, priority 0
Aug 14 21:57:25.801 [3883] dbg: rules: compiled body tests
Aug 14 21:57:25.975 [3883] dbg: rules: ran body rule __COMPENSATION
======> got hit: "Compensation"
Aug 14 21:57:26.186 [3883] dbg: rules: ran body rule __APPROVALFVGT
======> got hit: "approval"
Aug 14 21:57:26.327 [3883] dbg: rules: ran body rule __HAS_ANY_EMAIL
======> got hit: "y [at] csfwg"
Aug 14 21:57:26.396 [3883] dbg: rules: ran body rule __NONEMPTY_BODY
======> got hit: "R"
Aug 14 21:57:26.483 [3883] dbg: rules: ran body rule __LONGWORDS_A
======> got hit:
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffdfffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
"
Aug 14 21:57:26.658 [3883] dbg: rules: ran body rule T_FRT_CONTACT
======> got hit: "cont ract"

KMcGrail at PCCC

Aug 14, 2012, 9:13 PM

Post #4 of 17 (753 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

> Here's the output of -D -t on the file. I let it run for about 10
> minutes before giving up and killing the process.

Out of interest, can you let it run longer? Say an hour just to see if
does finish processing?

regards,
KAM

admin at kilnar

Aug 14, 2012, 9:20 PM

Post #5 of 17 (756 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 2012-08-14 21:13, Kevin A. McGrail wrote:
>> Here's the output of -D -t on the file. I let it run for about 10
>> minutes before giving up and killing the process.
>
> Out of interest, can you let it run longer? Say an hour just to see
> if does finish processing?
>
> regards,
> KAM

You bet! I'll fire it up in a screen session tonight (about to go to
bed) and check on it in the morning when I get to work. That should give
it PLENTY of time to finish up if it's going to finish.

I'll be in touch tomorrow with (hopefully) more information.

hege at hege

Aug 14, 2012, 11:31 PM

Post #6 of 17 (749 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On Tue, Aug 14, 2012 at 09:20:26PM -0700, John Evans wrote:
> On 2012-08-14 21:13, Kevin A. McGrail wrote:
> >>Here's the output of -D -t on the file. I let it run for about
> >>10 minutes before giving up and killing the process.
> >
> >Out of interest, can you let it run longer? Say an hour just to see
> >if does finish processing?
> >
> >regards,
> >KAM
>
> You bet! I'll fire it up in a screen session tonight (about to go to
> bed) and check on it in the morning when I get to work. That should
> give it PLENTY of time to finish up if it's going to finish.
>
> I'll be in touch tomorrow with (hopefully) more information.

Nothing new about this problem, it's "well known". RTF incorrectly marked as
text/plain will be scanned as body and regexps go wild from all the
formatting.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6582
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6584

hege at hege

Aug 14, 2012, 11:34 PM

Post #7 of 17 (752 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On Wed, Aug 15, 2012 at 09:31:40AM +0300, Henrik K wrote:
> On Tue, Aug 14, 2012 at 09:20:26PM -0700, John Evans wrote:
> > On 2012-08-14 21:13, Kevin A. McGrail wrote:
> > >>Here's the output of -D -t on the file. I let it run for about
> > >>10 minutes before giving up and killing the process.
> > >
> > >Out of interest, can you let it run longer? Say an hour just to see
> > >if does finish processing?
> > >
> > >regards,
> > >KAM
> >
> > You bet! I'll fire it up in a screen session tonight (about to go to
> > bed) and check on it in the morning when I get to work. That should
> > give it PLENTY of time to finish up if it's going to finish.
> >
> > I'll be in touch tomorrow with (hopefully) more information.
>
> Nothing new about this problem, it's "well known". RTF incorrectly marked as
> text/plain will be scanned as body and regexps go wild from all the
> formatting.
>
> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6582
> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6584

Correction, anything marked text/* will be scanned.. anyways, if you want to
fix this, you can try applying my patch which is found there.

admin at kilnar

Aug 15, 2012, 8:11 AM

Post #8 of 17 (762 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 2012-08-14 21:20, John Evans wrote:
> On 2012-08-14 21:13, Kevin A. McGrail wrote:
>>> Here's the output of -D -t on the file. I let it run for about 10
>>> minutes before giving up and killing the process.
>>
>> Out of interest, can you let it run longer? Say an hour just to see
>> if does finish processing?
>>
>> regards,
>> KAM
>
> You bet! I'll fire it up in a screen session tonight (about to go to
> bed) and check on it in the morning when I get to work. That should
> give it PLENTY of time to finish up if it's going to finish.
>
> I'll be in touch tomorrow with (hopefully) more information.

The SA check finally finished. Here are the full debug logs from the
scan. As you can see at the "23:59:21.418" mark, a timeout hits and
forces SA to move on. It looks like that time out is set to many
minutes, and I thought the default config for time_limit was 300
seconds?

Aug 14 22:21:29.635 [6233] dbg: rules: run_generic_tests - compiling
eval code: meta, priority -900
Aug 14 22:21:29.635 [6233] dbg: rules: compiled meta tests
Aug 14 22:21:29.635 [6233] dbg: check: running tests for priority: -400
Aug 14 22:21:29.635 [6233] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 22:21:29.635 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 280 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_neg400_1
Aug 14 22:21:29.636 [6233] dbg: rules: run_generic_tests - compiling
eval code: head, priority -400
Aug 14 22:21:29.636 [6233] dbg: rules: compiled head tests
Aug 14 22:21:29.636 [6233] dbg: rules: running body tests; score so
far=-0.0001
Aug 14 22:21:29.636 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 223 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_neg400_1
Aug 14 22:21:29.636 [6233] dbg: rules: run_generic_tests - compiling
eval code: body, priority -400
Aug 14 22:21:29.636 [6233] dbg: rules: compiled body tests
Aug 14 22:21:29.636 [6233] dbg: rules: running uri tests; score so
far=-0.0001
Aug 14 22:21:29.636 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 221 chars of
Mail::SpamAssassin::Plugin::Check::_uri_tests_neg400_1
Aug 14 22:21:29.637 [6233] dbg: rules: run_generic_tests - compiling
eval code: uri, priority -400
Aug 14 22:21:29.637 [6233] dbg: rules: compiled uri tests
Aug 14 22:21:29.637 [6233] dbg: rules: running body_eval tests; score
so far=-0.0001
Aug 14 22:21:29.637 [6233] dbg: rules: run_eval_tests - compiling eval
code: 11, priority -400
Aug 14 22:21:29.637 [6233] dbg: rules: running rawbody tests; score so
far=-0.0001
Aug 14 22:21:29.637 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 229 chars of
Mail::SpamAssassin::Plugin::Check::_rawbody_tests_neg400_1
Aug 14 22:21:29.638 [6233] dbg: rules: run_generic_tests - compiling
eval code: rawbody, priority -400
Aug 14 22:21:29.638 [6233] dbg: rules: compiled rawbody tests
Aug 14 22:21:29.638 [6233] dbg: rules: running full tests; score so
far=-0.0001
Aug 14 22:21:29.638 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 258 chars of
Mail::SpamAssassin::Plugin::Check::_full_tests_neg400_1
Aug 14 22:21:29.638 [6233] dbg: rules: run_generic_tests - compiling
eval code: full, priority -400
Aug 14 22:21:29.638 [6233] dbg: rules: compiled full tests
Aug 14 22:21:29.638 [6233] dbg: rules: running meta tests; score so
far=-0.0001
Aug 14 22:21:29.638 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 283 chars of
Mail::SpamAssassin::Plugin::Check::_meta_tests_neg400_1
Aug 14 22:21:29.639 [6233] dbg: rules: run_generic_tests - compiling
eval code: meta, priority -400
Aug 14 22:21:29.639 [6233] dbg: rules: compiled meta tests
Aug 14 22:21:29.639 [6233] dbg: check: running tests for priority: 0
Aug 14 22:21:29.639 [6233] dbg: rules: running head tests; score so
far=-0.0001
Aug 14 22:21:29.657 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60279 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_1
Aug 14 22:21:29.666 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60481 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_2
Aug 14 22:21:29.674 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60404 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_3
Aug 14 22:21:29.681 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60257 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_4
Aug 14 22:21:29.689 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60504 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_5
Aug 14 22:21:29.698 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 58923 chars of
Mail::SpamAssassin::Plugin::Check::_head_tests_0_6
Aug 14 22:21:29.703 [6233] dbg: rules: run_generic_tests - compiling
eval code: head, priority 0
Aug 14 22:21:29.703 [6233] dbg: rules: compiled head tests
Aug 14 22:21:29.704 [6233] dbg: rules: ran header rule
__LAST_EXTERNAL_RELAY_NO_AUTH ======> got hit: "[. ip=65.55.116.91
rdns=blu0-omc3-s16.blu0.hotmail.com helo=blu0-omc3-s16.blu0.hotmail.com
by=kilnar.com ident= envfrom= intl=0 id=30434200283 auth= "
Aug 14 22:21:29.705 [6233] dbg: rules: ran header rule __HOST_HOTMAIL
======> got hit: "[ ip=65.55.116.91 rdns=blu0-omc3-s16.blu0.hotmail.com
"
Aug 14 22:21:29.705 [6233] dbg: rules: ran header rule
__RCD_RDNS_MAIL_MESSY ======> got hit: "[ ip=65.55.116.91
rdns=blu0-omc3-s16.blu0.hotmail"
Aug 14 22:21:29.705 [6233] dbg: rules: ran header rule
__DOS_RELAYED_EXT ======> got hit: "Received: from
blu0-omc3-s16.blu0.hotmail.com (blu0-omc3-s16.blu0.hotmail.com
[65.55.116.91])
Aug 14 22:21:29.705 [6233] dbg: rules: [...]
Aug 14 22:21:29.705 [6233] dbg: rules: [...] by kilnar.com (Postfix)
with ESMTP id 30434200283
Aug 14 22:21:29.705 [6233] dbg: rules: [...]
Aug 14 22:21:29.705 [6233] dbg: rules: [...] for <anthology [at] csfwg>;
Tue, 14 Aug 2012 17:23:25 -0600 (MDT)
Aug 14 22:21:29.705 [6233] dbg: rules: [...]
Aug 14 22:21:29.705 [6233] dbg: rules: [...] Received: "
Aug 14 22:21:29.706 [6233] dbg: rules: ran header rule
__CTYPE_HAS_BOUNDARY ======> got hit: "boundary"
Aug 14 22:21:29.706 [6233] dbg: rules: ran header rule __CT ======> got
hit: "<YES>"
Aug 14 22:21:29.706 [6233] dbg: rules: ran header rule
__CTYPE_MULTIPART_ANY ======> got hit: "multipart/mixed"
Aug 14 22:21:29.706 [6233] dbg: rules: ran header rule __HAS_DATE
======> got hit: "<YES>"
Aug 14 22:21:29.706 [6233] dbg: rules: ran header rule
__LAST_UNTRUSTED_RELAY_NO_AUTH ======> got hit: "[. ip=65.55.116.91
rdns=blu0-omc3-s16.blu0.hotmail.com helo=blu0-omc3-s16.blu0.hotmail.com
by=kilnar.com ident= envfrom= intl=0 id=30434200283 auth= "
Aug 14 22:21:29.707 [6233] dbg: rules: ran header rule __MSGID_OK_HOST
======> got hit: "@phx.gbl>"
Aug 14 22:21:29.707 [6233] dbg: rules: ran header rule __HAS_MESSAGE_ID
======> got hit: "<YES>"
Aug 14 22:21:29.707 [6233] dbg: rules: ran header rule __MIME_VERSION
======> got hit: "<YES>"
Aug 14 22:21:29.708 [6233] dbg: rules: ran header rule __TOCC_EXISTS
======> got hit: "<YES>"
Aug 14 22:21:29.708 [6233] dbg: rules: ran header rule __HAS_RCVD
======> got hit: "<YES>"
Aug 14 22:21:29.708 [6233] dbg: rules: ran header rule __DOS_RCVD_TUE
======> got hit: " Tue, "
Aug 14 22:21:29.708 [6233] dbg: rules: ran header rule __HS_SUBJ_RE_FW
======> got hit: "RE:"
Aug 14 22:21:29.709 [6233] dbg: rules: ran header rule __HAS_SUBJECT
======> got hit: "<YES>"
Aug 14 22:21:29.709 [6233] dbg: rules: ran header rule __SUBJ_RE
======> got hit: "RE:"
Aug 14 22:21:29.710 [6233] dbg: rules: ran header rule __HAS_MSGID
======> got hit: "<"
Aug 14 22:21:29.710 [6233] dbg: rules: ran header rule __SANE_MSGID
======> got hit: "<BLU166-W3502167A19EB605F932121F5B70 [at] phx>
Aug 14 22:21:29.710 [6233] dbg: rules: [...] "
Aug 14 22:21:29.710 [6233] dbg: rules: ran header rule __HAS_TO ======>
got hit: "<YES>"
Aug 14 22:21:29.711 [6233] dbg: rules: ran header rule
__HAS_IN_REPLY_TO ======> got hit: "<YES>"
Aug 14 22:21:29.711 [6233] dbg: rules: ran header rule __HAS_X_REF
======> got hit: "<YES>"
Aug 14 22:21:29.711 [6233] dbg: rules: ran header rule __HAS_FROM
======> got hit: "<YES>"
Aug 14 22:21:29.711 [6233] dbg: rules: ran header rule __FROM_FREEMAIL
======> got hit: "@hotmail."
Aug 14 22:21:29.711 [6233] dbg: rules: ran header rule
__FROM_HOTMAIL_COM ======> got hit: "@hotmail.com"
Aug 14 22:21:29.714 [6233] dbg: async: select found 7 responses ready
(t.o.=0.0)
Aug 14 22:21:29.714 [6233] dbg: async: completed in 0.098 s: URI-A,
A:dns2.csfwg.org.
Aug 14 22:21:29.714 [6233] dbg: dns: providing a callback for id:
45168/230.18.111.64.zen.spamhaus.org/A/IN
Aug 14 22:21:29.714 [6233] dbg: async: starting: URI-DNSBL,
DNSBL:zen.spamhaus.org.:230.18.111.64 (timeout 15.0s, min 3.0s)
Aug 14 22:21:29.715 [6233] dbg: async: completed in 0.098 s: URI-A,
A:dns1.csfwg.org.
Aug 14 22:21:29.715 [6233] dbg: async: completed in 0.108 s: DNSBL-TXT,
dns:TXT:91.116.55.65.sa-accredit.habeas.com.
Aug 14 22:21:29.715 [6233] dbg: async: completed in 0.121 s: DNSBL-TXT,
dns:TXT:72.116.55.65.bl.spamcop.net.
Aug 14 22:21:29.715 [6233] dbg: async: completed in 0.121 s: DNSBL-TXT,
dns:TXT:179.202.71.75.bl.spamcop.net.
Aug 14 22:21:29.715 [6233] dbg: async: completed in 0.111 s: DNSBL-TXT,
dns:TXT:91.116.55.65.sa-trusted.bondedsender.org.
Aug 14 22:21:29.715 [6233] dbg: async: completed in 0.121 s: DNSBL-TXT,
dns:TXT:91.116.55.65.bl.spamcop.net.
Aug 14 22:21:29.715 [6233] dbg: async: queries completed: 7, started: 1
Aug 14 22:21:29.715 [6233] dbg: async: queries active: URI-DNSBL=2 at
Tue Aug 14 22:21:29 2012
Aug 14 22:21:29.715 [6233] dbg: dns: harvested completed queries
Aug 14 22:21:29.715 [6233] dbg: rules: running head_eval tests; score
so far=-0.0001
Aug 14 22:21:29.717 [6233] dbg: rules: run_eval_tests - compiling eval
code: 9, priority 0
Aug 14 22:21:29.723 [6233] dbg: FreeMail: RULE (FREEMAIL_FROM)
check_freemail_from
Aug 14 22:21:29.723 [6233] dbg: FreeMail: all from-addresses:
mel_kary [at] hotmail
Aug 14 22:21:29.723 [6233] dbg: FreeMail: HIT! mel_kary [at] hotmail is
freemail
Aug 14 22:21:29.724 [6233] dbg: rules: ran eval rule FREEMAIL_FROM
======> got hit (1)
Aug 14 22:21:29.745 [6233] dbg: dkim: using Mail::DKIM version 0.38
Aug 14 22:21:29.747 [6233] dbg: dkim: performing public key lookup and
signature verification
Aug 14 22:21:29.747 [6233] dbg: dkim: signature verification result:
none
Aug 14 22:21:29.747 [6233] dbg: dkim: adsp: performing lookup on
_adsp._domainkey.hotmail.com
Aug 14 22:21:29.751 [6233] dbg: dkim: adsp result: U/unknown (dns:
unknown), author domain 'hotmail.com'
Aug 14 22:21:29.751 [6233] dbg: spf: checking to see if the message has
a Received-SPF header that we can use
Aug 14 22:21:29.782 [6233] dbg: spf: using Mail::SPF for SPF checks
Aug 14 22:21:29.782 [6233] dbg: spf: checking HELO
(helo=blu0-omc3-s16.blu0.hotmail.com, ip=65.55.116.91)
Aug 14 22:21:29.783 [6233] dbg: dns: providing a callback for id:
31165/blu0-omc3-s16.blu0.hotmail.com/SPF/IN
Aug 14 22:21:29.784 [6233] dbg: dns: providing a callback for id:
33937/blu0-omc3-s16.blu0.hotmail.com/TXT/IN
Aug 14 22:21:29.785 [6233] dbg: spf: query for
/65.55.116.91/blu0-omc3-s16.blu0.hotmail.com: result: none, comment: ,
text: No applicable sender policy available
Aug 14 22:21:29.787 [6233] dbg: dkim: author mel_kary [at] hotmail, not
in any dkim whitelist
Aug 14 22:21:29.787 [6233] dbg: spf: already checked for Received-SPF
headers, proceeding with DNS based checks
Aug 14 22:21:29.788 [6233] dbg: spf: cannot get Envelope-From, cannot
use SPF
Aug 14 22:21:29.788 [6233] dbg: FreeMail: RULE (__freemail_reply)
check_freemail_replyto
Aug 14 22:21:29.788 [6233] dbg: FreeMail: From address:
mel_kary [at] hotmail
Aug 14 22:21:29.837 [6233] dbg: FreeMail: RULE
(FREEMAIL_REPLYTO_END_DIGIT) check_freemail_header regex:\d@
Aug 14 22:21:29.837 [6233] dbg: FreeMail: header Reply-To not found
from mail
Aug 14 22:21:29.837 [6233] dbg: FreeMail: RULE (__freemail_replyto)
check_freemail_replyto
Aug 14 22:21:29.838 [6233] dbg: FreeMail: From address:
mel_kary [at] hotmail
Aug 14 22:21:29.838 [6233] dbg: FreeMail: Reply-To is not freemail,
skipping check
Aug 14 22:21:29.838 [6233] dbg: FreeMail: RULE (__freemail_hdr_replyto)
check_freemail_header
Aug 14 22:21:29.838 [6233] dbg: FreeMail: header Reply-To not found
from mail
Aug 14 22:21:29.838 [6233] dbg: spf: def_spf_whitelist_from: already
checked spf and didn't get pass, skipping whitelist check
Aug 14 22:21:29.838 [6233] dbg: FreeMail: RULE
(FREEMAIL_ENVFROM_END_DIGIT) check_freemail_header regex:\d@
Aug 14 22:21:29.838 [6233] dbg: FreeMail: header EnvelopeFrom not found
from mail
Aug 14 22:21:29.839 [6233] dbg: spf: whitelist_from_spf: already
checked spf and didn't get pass, skipping whitelist check
Aug 14 22:21:29.839 [6233] dbg: async: select found no responses ready
(t.o.=0.0)
Aug 14 22:21:29.839 [6233] dbg: async: completed in 0.198 s: URI-DNSBL,
DNSBL:multi.uribl.com.:csfwg.org
Aug 14 22:21:29.840 [6233] dbg: async: completed in 0.069 s: URI-DNSBL,
DNSBL:zen.spamhaus.org.:230.18.111.64
Aug 14 22:21:29.840 [6233] dbg: dns: harvested completed queries
Aug 14 22:21:29.840 [6233] dbg: rules: running body tests; score so
far=0.0009
Aug 14 22:21:29.844 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60166 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_1
Aug 14 22:21:29.855 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60299 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_2
Aug 14 22:21:29.866 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60330 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_3
Aug 14 22:21:29.877 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60195 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_4
Aug 14 22:21:29.888 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60455 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_5
Aug 14 22:21:29.900 [6233] dbg: rules: flush_evalstr (add_evalstr)
compiling 60430 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_6
Aug 14 22:21:29.908 [6233] dbg: rules: flush_evalstr
(run_generic_tests) compiling 8457 chars of
Mail::SpamAssassin::Plugin::Check::_body_tests_0_7
Aug 14 22:21:29.910 [6233] dbg: rules: run_generic_tests - compiling
eval code: body, priority 0
Aug 14 22:21:29.910 [6233] dbg: rules: compiled body tests
Aug 14 22:21:30.078 [6233] dbg: rules: ran body rule __COMPENSATION
======> got hit: "Compensation"
Aug 14 22:21:30.292 [6233] dbg: rules: ran body rule __APPROVALFVGT
======> got hit: "approval"
Aug 14 22:21:30.434 [6233] dbg: rules: ran body rule __HAS_ANY_EMAIL
======> got hit: "y [at] csfwg"
Aug 14 22:21:30.504 [6233] dbg: rules: ran body rule __NONEMPTY_BODY
======> got hit: "R"
Aug 14 22:21:30.592 [6233] dbg: rules: ran body rule __LONGWORDS_A
======> got hit:
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
fffffffffffffffffdfffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
"
Aug 14 22:21:30.762 [6233] dbg: rules: ran body rule T_FRT_CONTACT
======> got hit: "cont ract"
Aug 14 23:59:21.418 [6233] info: check: exceeded time limit in
Mail::SpamAssassin::Plugin::Check::_body_tests_0, skipping further tests
Aug 14 23:59:21.418 [6233] dbg: dns: harvest_dnsbl_queries
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.007 .
dns:A:91.116.55.65.iadb.isipp.com.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.009 .
dns:A:72.116.55.65.zen.spamhaus.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.009 .
dns:A:179.202.71.75.zen.spamhaus.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.011 .
dns:A:91.116.55.65.bb.barracudacentral.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.011 .
dns:A:91.116.55.65.list.dnswl.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.012 .
dns:A:91.116.55.65.psbl.surriel.com.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.013 .
dns:A:179.202.71.75.dnsbl.sorbs.net.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.013 .
dns:A:91.116.55.65.bl.score.senderscore.com.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.014 .
dns:A:91.116.55.65.dnsbl.sorbs.net.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.014 .
dns:A:72.116.55.65.dnsbl.sorbs.net.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.014 .
dns:A:91.116.55.65.zen.spamhaus.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.018 .
dns:A:91.116.55.65.combined.njabl.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.018 .
dns:A:72.116.55.65.combined.njabl.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.019 .
dns:A:179.202.71.75.combined.njabl.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.020 . NS:csfwg.org
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.020 .
DNSBL:dbl.spamhaus.org.:csfwg.org
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.021 .
DNSBL:dob.sibl.support-intelligence.net:csfwg.org
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.022 .
DNSBL:multi.surbl.org.:csfwg.org
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.069 .
DNSBL:zen.spamhaus.org.:230.18.111.64
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.098 .
A:dns1.csfwg.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.098 .
A:dns2.csfwg.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.108 .
dns:TXT:91.116.55.65.sa-accredit.habeas.com.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.111 .
dns:TXT:91.116.55.65.sa-trusted.bondedsender.org.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.121 .
dns:TXT:91.116.55.65.bl.spamcop.net.
Aug 14 23:59:21.419 [6233] dbg: async: timing: 0.121 .
dns:TXT:72.116.55.65.bl.spamcop.net.
Aug 14 23:59:21.420 [6233] dbg: async: timing: 0.121 .
dns:TXT:179.202.71.75.bl.spamcop.net.
Aug 14 23:59:21.420 [6233] dbg: async: timing: 0.198 .
DNSBL:multi.uribl.com.:csfwg.org
Aug 14 23:59:21.420 [6233] dbg: check: is spam? score=0.012 required=5
Aug 14 23:59:21.421 [6233] dbg: check:
tests=FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,TIME_LIMIT_EXCEEDED,T_FRT_CONTACT
Aug 14 23:59:21.421 [6233] dbg: check:
subtests=__APPROVALFVGT,__COMPENSATION,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ANY,__DOS_RCVD_TUE,__DOS_RELAYED_EXT,__FROM_FREEMAIL,__FROM_HOTMAIL_COM,__HAS_ANY_EMAIL,__HAS_DATE,__HAS_FROM,__HAS_IN_REPLY_TO,__HAS_MESSAGE_ID,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_X_REF,__HOST_HOTMAIL,__HS_SUBJ_RE_FW,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LONGWORDS_A,__MIME_VERSION,__MSGID_OK_HOST,__NONEMPTY_BODY,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RCVD_IN_SORBS,__RCVD_IN_ZEN,__SANE_MSGID,__SUBJ_RE,__TOCC_EXISTS
Aug 14 23:59:21.421 [6233] dbg: timing: total 5873022 ms - init: 1125
(0.0%), parse: 4 (0.0%), extract_message_metadata: 54 (0.0%),
poll_dns_idle: 0.52 (0.0%), get_uri_detail_list: 25 (0.0%),
tests_pri_-1000: 18 (0.0%), compile_gen: 80 (0.0%), compile_eval: 7
(0.0%), tests_pri_-950: 4 (0.0%), tests_pri_-900: 6 (0.0%),
tests_pri_-400: 4 (0.0%), tests_pri_0: 5871779 (100.0%),
dkim_load_modules: 21 (0.0%), check_dkim_signature: 1.97 (0.0%),
check_dkim_adsp: 4 (0.0%), check_spf: 34 (0.0%)
Aug 14 23:59:21.426 [6233] dbg: plugin:
Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0x3c872b8) implements
'finish_tests', priority 0
Aug 14 23:59:21.426 [6233] dbg: plugin:
Mail::SpamAssassin::Plugin::Check=HASH(0x287cdd8) implements
'finish_tests', priority 0

admin at kilnar

Aug 15, 2012, 8:12 AM

Post #9 of 17 (747 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 2012-08-14 23:34, Henrik K wrote:
> On Wed, Aug 15, 2012 at 09:31:40AM +0300, Henrik K wrote:
>> On Tue, Aug 14, 2012 at 09:20:26PM -0700, John Evans wrote:
>> > On 2012-08-14 21:13, Kevin A. McGrail wrote:
>> > >>Here's the output of -D -t on the file. I let it run for about
>> > >>10 minutes before giving up and killing the process.
>> > >
>> > >Out of interest, can you let it run longer? Say an hour just to
>> see
>> > >if does finish processing?
>> > >
>> > >regards,
>> > >KAM
>> >
>> > You bet! I'll fire it up in a screen session tonight (about to go
>> to
>> > bed) and check on it in the morning when I get to work. That
>> should
>> > give it PLENTY of time to finish up if it's going to finish.
>> >
>> > I'll be in touch tomorrow with (hopefully) more information.
>>
>> Nothing new about this problem, it's "well known". RTF incorrectly
>> marked as
>> text/plain will be scanned as body and regexps go wild from all the
>> formatting.
>>
>> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6582
>> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6584
>
> Correction, anything marked text/* will be scanned.. anyways, if you
> want to
> fix this, you can try applying my patch which is found there.

Thanks for the patch! I'll apply it to my system and see if this
resolves the problems that I'm seeing.

KMcGrail at PCCC

Aug 15, 2012, 8:14 AM

Post #10 of 17 (749 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 8/15/2012 11:11 AM, John Evans wrote:
> On 2012-08-14 21:20, John Evans wrote:
>> On 2012-08-14 21:13, Kevin A. McGrail wrote:
>>>> Here's the output of -D -t on the file. I let it run for about 10
>>>> minutes before giving up and killing the process.
>>>
>>> Out of interest, can you let it run longer? Say an hour just to see
>>> if does finish processing?
>>>
>>> regards,
>>> KAM
>>
>> You bet! I'll fire it up in a screen session tonight (about to go to
>> bed) and check on it in the morning when I get to work. That should
>> give it PLENTY of time to finish up if it's going to finish.
>>
>> I'll be in touch tomorrow with (hopefully) more information.
>
> The SA check finally finished. Here are the full debug logs from the
> scan. As you can see at the "23:59:21.418" mark, a timeout hits and
> forces SA to move on. It looks like that time out is set to many
> minutes, and I thought the default config for time_limit was 300 seconds?
Exactly my concern as well. Even if the RTF container's MIME type was
set incorrectly, I would still expect a timeout because there has to be
allowances for this.

Henrik, why don't you think the timeout hit?

Regards,
KAM

hege at hege

Aug 15, 2012, 8:24 AM

Post #11 of 17 (749 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On Wed, Aug 15, 2012 at 11:14:58AM -0400, Kevin A. McGrail wrote:
>
> Henrik, why don't you think the timeout hit?

Probably because regexps hanging and it's impossible to timeout them.

KMcGrail at PCCC

Aug 15, 2012, 10:15 AM

Post #12 of 17 (751 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 8/15/2012 11:24 AM, Henrik K wrote:
> On Wed, Aug 15, 2012 at 11:14:58AM -0400, Kevin A. McGrail wrote:
>> Henrik, why don't you think the timeout hit?
> Probably because regexps hanging and it's impossible to timeout them.
Interesting. OK. I look forwarding to see if your patch helped!

--
*Kevin A. McGrail*
President

Peregrine Computer Consultants Corporation
3927 Old Lee Highway, Suite 102-C
Fairfax, VA 22030-2422

http://www.pccc.com/

703-359-9700 x50 / 800-823-8402 (Toll-Free)
703-359-8451 (fax)
KMcGrail [at] PCCC <mailto:kmcgrail [at] pccc>

Attachments:

pccc_logo.gif (10.2 KB)

admin at kilnar

Aug 15, 2012, 3:08 PM

Post #13 of 17 (750 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 2012-08-15 10:15, Kevin A. McGrail wrote:
> On 8/15/2012 11:24 AM, Henrik K wrote:
>
>> On Wed, Aug 15, 2012 at 11:14:58AM -0400, Kevin A. McGrail wrote:
>>
>>> Henrik, why don't you think the timeout hit?
>>
>> Probably because regexps hanging and it's impossible to timeout
>> them.
> Interesting. OK. I look forwarding to see if your patch helped!

Kevin,

I added the patch and it hung in the same place. The 'spamassassin -D
-t < bad' command eventually went through after a LONG timeout. I didn't
capture the results of the SA command (forgot to redirect output), but
the patch to substr(X, 0, 30000) didn't seem to help any. Could be that
30,000 is too long? That delves deep into the attachment, and I'm
wondering if the top-end of the attachment (within that 30k range) has
content that triggers a regex that doesn't like what it sees?

Just throwing some ideas out there.

Thoughts?

--
John Evans

jhardin at impsec

Aug 15, 2012, 3:25 PM

Post #14 of 17 (746 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On Wed, 15 Aug 2012, John Evans wrote:

> On 2012-08-15 10:15, Kevin A. McGrail wrote:
>> On 8/15/2012 11:24 AM, Henrik K wrote:
>>
>> > On Wed, Aug 15, 2012 at 11:14:58AM -0400, Kevin A. McGrail wrote:
>> >
>> > > Henrik, why don't you think the timeout hit?
>> >
>> > Probably because regexps hanging and it's impossible to timeout
>> > them.
>> Interesting. OK. I look forwarding to see if your patch helped!
>
> Kevin,
>
> I added the patch and it hung in the same place. The 'spamassassin -D -t <
> bad' command eventually went through after a LONG timeout. I didn't capture
> the results of the SA command (forgot to redirect output), but the patch to
> substr(X, 0, 30000) didn't seem to help any. Could be that 30,000 is too
> long? That delves deep into the attachment, and I'm wondering if the top-end
> of the attachment (within that 30k range) has content that triggers a regex
> that doesn't like what it sees?
>
> Just throwing some ideas out there.
>
> Thoughts?

Add this to your .pre file and see if it helps isolate a specific
poorly-performing rule:

loadplugin HitFreqsRuleTiming ./HitFreqsRuleTiming.pm

Also do "--debug area=rules" instead of "-D", that may make the
problematic rule more apparent.

And capture STDERR to a file! :)

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
But if there is no such inalienable right [to self defense], the
entire nature of the social contract is changed. Each man’s worth
is measured solely by his utility to the state, and as such the
value of his life rides a roller coaster not unlike the stock
market: dependent not only upon the preferences of the party in
power but upon the whims of its political leaders and the
permanent bureaucratic class. -- Mike McDaniel
-----------------------------------------------------------------------
Today: the 67th anniversary of the end of World War II

admin at kilnar

Aug 15, 2012, 9:59 PM

Post #15 of 17 (761 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 2012-08-15 15:25, John Hardin wrote:
> On Wed, 15 Aug 2012, John Evans wrote:
>
>> On 2012-08-15 10:15, Kevin A. McGrail wrote:
>>> On 8/15/2012 11:24 AM, Henrik K wrote:
>>> > On Wed, Aug 15, 2012 at 11:14:58AM -0400, Kevin A. McGrail
>>> wrote:
>>> > > > Henrik, why don't you think the timeout hit?
>>> > > Probably because regexps hanging and it's impossible to
>>> timeout
>>> > them.
>>> Interesting. OK. I look forwarding to see if your patch helped!
>>
>> Kevin,
>>
>> I added the patch and it hung in the same place. The 'spamassassin
>> -D -t < bad' command eventually went through after a LONG timeout. I
>> didn't capture the results of the SA command (forgot to redirect
>> output), but the patch to substr(X, 0, 30000) didn't seem to help any.
>> Could be that 30,000 is too long? That delves deep into the
>> attachment, and I'm wondering if the top-end of the attachment (within
>> that 30k range) has content that triggers a regex that doesn't like
>> what it sees?
>>
>> Just throwing some ideas out there.
>>
>> Thoughts?
>
> Add this to your .pre file and see if it helps isolate a specific
> poorly-performing rule:
>
> loadplugin HitFreqsRuleTiming ./HitFreqsRuleTiming.pm
>
> Also do "--debug area=rules" instead of "-D", that may make the
> problematic rule more apparent.
>
> And capture STDERR to a file! :)

Thanks for the suggestion. Here is more debugging information. I'll
separate each file that was produced with a line of '======'.

I did snip some information from STDOUT because the contents revealed
information that I can't legally share since it's a legal contract that
I'm discussing with someone. If, at some point, it becomes necessary to
get hands on the RTF file, I'll check with the other party if it's okay
to share the information with some people, off list.

STDERR:
Aug 15 22:11:37.560 [9165] info: check: exceeded time limit in
Mail::SpamAssassin::Plugin::Check::_body_tests_0, skipping further tests
Aug 15 22:11:37.596 [9165] warn: HitFreqsRuleTiming: writing timing
data to /root/tmp/timing.log

=====================

STDOUT:
<contents of the email w/ RTF attachment SNIPPED>
Spam detection software, running on the system "kilnar.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or
label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: <SNIP>
Content analysis details: (0.0 points, 5.0 required)

pts rule name description
---- ----------------------
--------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at
http://www.dnswl.org/, no
trust
[65.55.116.91 listed in list.dnswl.org]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser
mail provider
(mel_kary[at]hotmail.com)
0.0 T_FRT_CONTACT BODY: ReplaceTags: Contact
0.0 TIME_LIMIT_EXCEEDED Exceeded time limit / deadline

=====================
/root/tmp/timing.log:
v1
T __FILL_THIS_FORM_SHORT2 0.3123 0.3123 1
T __FILL_THIS_FORM_FRAUD_PHISH1 0.1155 0.1155 1
T __FILL_THIS_FORM_LOAN1 0.0836 0.0836 1
T __freemail_reply 0.0467 0.0467 1
T __FILL_THIS_FORM_LONG1 0.0333 0.0333 1
T SPF_HELO_PASS 0.0329 0.0329 1
T __FILL_THIS_FORM_SHORT1 0.0328 0.0328 1
T DKIM_ADSP_DISCARD 0.0268 0.0268 1
T __LOTSA_MONEY_00 0.0207 0.0207 1
T __KAM_LOTTO2 0.0178 0.0178 1
T __LOTTO_WINNINGS 0.0164 0.0164 1
T FB_GVR 0.0150 0.0150 1
T DRUGS_SMEAR1 0.0129 0.0129 1
T FB_GET_MEDS 0.0114 0.0114 1
T T_FRT_VIRGIN1 0.0105 0.0105 1
T __VBOUNCE_AVREPORT0 0.0103 0.0103 1
T FUZZY_XPILL 0.0100 0.0100 1
T __DRUGS_PAIN10 0.0098 0.0098 1
T __DRUGS_PAIN4 0.0098 0.0098 1
T __DRUGS_ANXIETY3 0.0098 0.0098 1
T __DRUGS_ERECTILE1 0.0098 0.0098 1
T FRT_BIGGERMEM1 0.0095 0.0095 1
T __LOTTO_ADMITS_1 0.0093 0.0093 1
T __DRUGS_ANXIETY1 0.0089 0.0089 1
T FUZZY_MILLION 0.0087 0.0087 1
T __DRUGS_SLEEP1 0.0086 0.0086 1
T ONLINE_PHARMACY 0.0084 0.0084 1
T REMOVE_BEFORE_LINK 0.0084 0.0084 1
T __DRUGS_PAIN3 0.0082 0.0082 1
T __FRAUD_IRJ 0.0081 0.0081 1
T __DRUGS_DIET6 0.0081 0.0081 1
T __LOTSA_MONEY_05 0.0080 0.0080 1
T __DRUGS_DIET1 0.0078 0.0078 1
T __DRUGS_SLEEP2 0.0077 0.0077 1
T __DRUGS_DIET2 0.0077 0.0077 1
T __DRUGS_ERECTILE3 0.0075 0.0075 1
T __DRUGS_PAIN9 0.0075 0.0075 1
T __FRAUD_KJV 0.0071 0.0071 1
T __FRAUD_NEB 0.0069 0.0069 1
T __DOS_MEET_EACH_OTHER 0.0063 0.0063 1
T __HK_LOTTO_1 0.0060 0.0060 1
T __MOVE_MONEY 0.0052 0.0052 1
T __SUBSCRIPTION_INFO 0.0051 0.0051 1
T LOTTO_AGENT 0.0051 0.0051 1
T LOTTO_DEPT 0.0049 0.0049 1
T __FEES 0.0046 0.0046 1
T __PCT_OF_PMTS 0.0045 0.0045 1
T FUZZY_AMBIEN 0.0044 0.0044 1
T __PCT_FOR_YOU_1 0.0044 0.0044 1
T BODY_ENHANCEMENT 0.0042 0.0042 1
T TRACKER_ID 0.0040 0.0040 1
T __YOU_WON_03 0.0040 0.0040 1
T __SURVIVORS 0.0040 0.0040 1
T BAD_CREDIT 0.0039 0.0039 1
T USER_IN_WHITELIST 0.0036 0.0036 1
T __DEAL 0.0036 0.0036 1
T BODY_ENHANCEMENT2 0.0034 0.0034 1
T __RANDOM_PICK 0.0034 0.0034 1
T __TRUNK_BOX 0.0034 0.0034 1
T __FRAUD_DPR 0.0033 0.0033 1
T HK_SCAM_N1 0.0033 0.0033 1
T __HK_LOTTO_BALLOT 0.0031 0.0031 1
T __DECEASED 0.0031 0.0031 1
T __FRAUD_GAN 0.0031 0.0031 1
T __IS_LEGAL 0.0029 0.0029 1
T __DORMANT_ACCT 0.0029 0.0029 1
T __LONGWORDS_C 0.0028 0.0028 1
T __FRAUD_IOU 0.0028 0.0028 1
T __LONGWORDS_B 0.0028 0.0028 1
T __ATM_CARD 0.0027 0.0027 1
T __V_NO_COST 0.0027 0.0027 1
T __FRAUD_BEP 0.0027 0.0027 1
T __V_SHMUCK 0.0027 0.0027 1
T __FRAUD_IRT 0.0027 0.0027 1
T __UNSUB_EMAIL 0.0026 0.0026 1
T __FRAUD_WNY 0.0025 0.0025 1
T __FRAUD_AON 0.0024 0.0024 1
T __FRAUD_ZFJ 0.0024 0.0024 1
T __LONGWORDS_A 0.0023 0.0023 1
T __FRAUD_PTS 0.0022 0.0022 1
T __LUCKY_WINNER 0.0021 0.0021 1
T __SUM_OF_FUND 0.0021 0.0021 1
T __BARRISTER 0.0021 0.0021 1
T __V_NOMINATION 0.0021 0.0021 1
T __V_BIOGRAPHY 0.0021 0.0021 1
T FRT_ADOBE2 0.0020 0.0020 1
T FRT_APPROV 0.0020 0.0020 1
T T_FRT_ABSOLUT 0.0020 0.0020 1
T T_FRT_FOLLOW2 0.0020 0.0020 1
T T_FRT_LOLITA1 0.0019 0.0019 1
T T_FRT_SLUT 0.0019 0.0019 1
T T_FRT_FOLLOW1 0.0019 0.0019 1
T __DEAD_PARENT 0.0019 0.0019 1
T __FRAUD_MLY 0.0019 0.0019 1
T T_FRT_FUCK1 0.0019 0.0019 1
T __I_INHERIT 0.0019 0.0019 1
T T_FRT_FREE 0.0019 0.0019 1
T __YOUR_FUND 0.0019 0.0019 1
T __DRUGS_DIET10 0.0019 0.0019 1
T T_FRT_CLICK 0.0019 0.0019 1
T T_FRT_OPPORTUN1 0.0019 0.0019 1
T T_FRT_PACKAGE 0.0019 0.0019 1
T __THEY_INHERIT 0.0019 0.0019 1
T FRT_ROLEX 0.0019 0.0019 1
T FRT_PENIS1 0.0019 0.0019 1
T __FRAUD_TDP 0.0019 0.0019 1
T __LOTTO_RELATED 0.0019 0.0019 1
T __FOUND_YOU 0.0019 0.0019 1
T __DESTROY_ME 0.0018 0.0018 1
T T_FRT_HEALTH 0.0018 0.0018 1
T __AGREED_RATIO 0.0018 0.0018 1
T __INTL_BANK 0.0018 0.0018 1
T __OUR_BEHALF 0.0018 0.0018 1
T T_FRT_PROFILE2 0.0018 0.0018 1
T FRT_PRICE 0.0018 0.0018 1
T __CONTACT_YOU 0.0018 0.0018 1
T T_FRT_PROFIT1 0.0018 0.0018 1
T T_FRT_STOCK1 0.0018 0.0018 1
T T_FRT_STOCK2 0.0018 0.0018 1
T T_FRT_CANSPAM 0.0018 0.0018 1
T T_FRT_EXPERIENCE 0.0018 0.0018 1
T __V_EXCELLENCE 0.0018 0.0018 1
T T_FRT_BELOW2 0.0018 0.0018 1
T T_FRT_BEFORE 0.0018 0.0018 1
T FRT_OFFER2 0.0018 0.0018 1
T T_FRT_HOUR 0.0018 0.0018 1
T __FRAUD 0.0016 0.0016 1
T T_FUZZY_OPTOUT 0.0016 0.0016 1
T __DRUGS_PAIN7 0.0016 0.0016 1
T __DRUGS_ERECTILE6 0.0016 0.0016 1
T __DRUGS_PAIN8 0.0015 0.0015 1
T __DRUGS_DIET7 0.0015 0.0015 1
T __DRUGS_PAIN5 0.0015 0.0015 1
T __DRUGS_SLEEP3 0.0015 0.0015 1
T __DRUGS_ERECTILE8 0.0015 0.0015 1
T __DRUGS_ANXIETY7 0.0015 0.0015 1
T __DRUGS_DIET8 0.0015 0.0015 1
T __DRUGS_ERECTILE5 0.0015 0.0015 1
T __DRUGS_MUSCLE2 0.0015 0.0015 1
T __DRUGS_ANXIETY4 0.0015 0.0015 1
T T_FRT_CONTACT 0.0014 0.0014 1
T __FRAUD_FBI 0.0014 0.0014 1
T USER_IN_BLACKLIST 0.0013 0.0013 1
T PERSCRIPTION 0.0013 0.0013 1
T FB_SOFTTABS 0.0013 0.0013 1
T DRUG_ED_CAPS 0.0013 0.0013 1
T TVD_PH_REC 0.0013 0.0013 1
T HK_SCAM_N8 0.0013 0.0013 1
T __FRAUD_JNB 0.0013 0.0013 1
T HK_SCAM_S25 0.0013 0.0013 1
T NO_MEDICAL 0.0013 0.0013 1
T __TVD_PH_BODY_03 0.0013 0.0013 1
T __LOTTO_WIN_01 0.0013 0.0013 1
T __DOS_BODY_SUN 0.0013 0.0013 1
T __NOT_SCAM 0.0013 0.0013 1
T ANATRIM 0.0013 0.0013 1
T __HK_LOTTO_STAATS 0.0013 0.0013 1
T __YOU_WON_01 0.0013 0.0013 1
T __DOS_BODY_THU 0.0013 0.0013 1
T DRUG_ED_ONLINE 0.0013 0.0013 1
T __SCAM 0.0013 0.0013 1
T __FRAUD_JYG 0.0013 0.0013 1
T __FRAUD_MCQ 0.0013 0.0013 1
T __DOS_BODY_MON 0.0013 0.0013 1
T __FRAUD_ULK 0.0013 0.0013 1
T __AFR_UNION 0.0013 0.0013 1
T __DRUGS_ERECTILE2 0.0013 0.0013 1
T __BANK_DRAFT 0.0013 0.0013 1
T __YOU_INHERIT 0.0013 0.0013 1
T __DRUGS_ANXIETY8 0.0013 0.0013 1
T __COURIER 0.0013 0.0013 1
T __DRUGS_ANXIETY2 0.0013 0.0013 1
T __FRAUD_ETX 0.0013 0.0013 1
T TVD_INCREASE_SIZE 0.0013 0.0013 1
T __FRAUD_AUM 0.0013 0.0013 1
T __DOS_BODY_WED 0.0013 0.0013 1
T __DOS_BODY_SAT 0.0013 0.0013 1
T __FRAUD_LTX 0.0013 0.0013 1
T __DRUGS_ERECTILE_L 0.0013 0.0013 1
T __DRUGS_ERECTILE4 0.0013 0.0013 1
T __V_REGISTRY 0.0013 0.0013 1
T __DOS_STEADY_COURSE 0.0013 0.0013 1
T __FRAUD_WDR 0.0013 0.0013 1
T __DIED_IN 0.0013 0.0013 1
T __LOTTO_VERIFY 0.0013 0.0013 1
T __DIPLOMATIC 0.0013 0.0013 1
T __FRAUD_UUY 0.0013 0.0013 1
T __DRUGS_DIET_PHEN 0.0013 0.0013 1
T DRUG_ED_SILD 0.0013 0.0013 1
T __YOUR_PROFIT 0.0013 0.0013 1
T TVD_PH_BODY_ACCOUNTS_PRE 0.0013 0.0013 1
T __DOS_BODY_STOCK 0.0013 0.0013 1
T __DLND_ATTACH 0.0013 0.0013 1
T __CHARITY 0.0013 0.0013 1
T __YOU_ASSIST 0.0013 0.0013 1
T __MILLIONS 0.0013 0.0013 1
T UNCLAIMED_MONEY 0.0013 0.0013 1
T __AM_DYING 0.0013 0.0013 1
T TVD_QUAL_MEDS 0.0013 0.0013 1
T __CONTACT_ATTY 0.0013 0.0013 1
T __I_WILL_YOU 0.0013 0.0013 1
T FIN_FREE 0.0013 0.0013 1
T __HK_LOTTO_2 0.0013 0.0013 1
T __NIGERIA 0.0013 0.0013 1
T DEAR_SOMETHING 0.0012 0.0012 1
T PRICES_ARE_AFFORDABLE 0.0012 0.0012 1
T __FRAUD_BGP 0.0012 0.0012 1
T __FB_PICK 0.0012 0.0012 1
T __DRUGS_ERECTILE_C 0.0012 0.0012 1
T __DOS_BODY_FRI 0.0012 0.0012 1
T __INHERIT_PMT 0.0012 0.0012 1
T __V_EXECS_PROS 0.0012 0.0012 1
T __BENEFICIARY 0.0012 0.0012 1
T __INVEST_COUNTRY 0.0012 0.0012 1
T __WIDOW 0.0012 0.0012 1
T __DOS_FIN_ADVANTAGE 0.0012 0.0012 1
T __EARLY_DEMISE 0.0012 0.0012 1
T __DOS_STRONG_CF 0.0012 0.0012 1
T __FRAUD_XVW 0.0012 0.0012 1
T HK_SCAM_N3 0.0012 0.0012 1
T __TVD_PH_BODY_01 0.0012 0.0012 1
T TVD_PH_SEC 0.0012 0.0012 1
T __TRTMT_DEFILED 0.0012 0.0012 1
T __V_ACHIEVEMENT 0.0012 0.0012 1
T __V_DISTINGUISHED 0.0012 0.0012 1
T __DRUGS_DIET5 0.0012 0.0012 1
T DEAR_WINNER 0.0012 0.0012 1
T FUZZY_ROLEX 0.0012 0.0012 1
T __UN 0.0012 0.0012 1
T __VBOUNCE_MAILSWEEP2 0.0012 0.0012 1
T JOIN_MILLIONS 0.0012 0.0012 1
T __BACK_SCRATCH 0.0012 0.0012 1
T __TVD_PH_BODY_07 0.0012 0.0012 1
T T_EMRCP 0.0012 0.0012 1
T __BOUNCE_NONWORKING 0.0012 0.0012 1
T EM_ROLEX 0.0011 0.0011 1
T T_FRT_ERECTION 0.0011 0.0011 1
T FUZZY_ERECT 0.0010 0.0010 1
T __COMPENSATION 0.0010 0.0010 1
T USER_IN_DKIM_WHITELIST 0.0010 0.0010 1
T T_TVD_FUZZY_SECURITIES 0.0009 0.0009 1
T __SENDER_BOT 0.0009 0.0009 1
T T_FUZZY_SPRM 0.0008 0.0008 1
T T_TVD_FUZZY_SECTOR 0.0005 0.0005 1
T FUZZY_CREDIT 0.0005 0.0005 1
T FUZZY_CPILL 0.0005 0.0005 1
T DATE_IN_FUTURE_Q_PLUS 0.0004 0.0004 1
T T_LFUZ_PWRMALE 0.0004 0.0004 1
T FUZZY_PHARMACY 0.0004 0.0004 1
T T_FRT_PHARMAC 0.0004 0.0004 1
T USER_IN_ALL_SPAM_TO 0.0003 0.0003 1
T NO_PRESCRIPTION 0.0003 0.0003 1
T FREEMAIL_FROM 0.0003 0.0003 1
T __DRUGS_PAIN14 0.0003 0.0003 1
T __SINGLE_HEADER_1K 0.0003 0.0003 1
T USER_IN_DEF_WHITELIST 0.0003 0.0003 1
T USER_IN_WHITELIST_TO 0.0002 0.0002 1
T WEIRD_QUOTING 0.0002 0.0002 1
T FB_TO_STOP_DISTRO 0.0002 0.0002 1
T __FRAUD_FCW 0.0002 0.0002 1
T __FRAUD_TCC 0.0002 0.0002 1
T __FRAUD_MQO 0.0002 0.0002 1
T __FIXED_RATEFVGT 0.0002 0.0002 1
T __FB_DESIGNER 0.0002 0.0002 1
T FB_THIS_ADVERT 0.0002 0.0002 1
T __FB_S_SYMBOL 0.0002 0.0002 1
T __FRAUD_PVN 0.0002 0.0002 1
T MORE_SEX 0.0002 0.0002 1
T FB_INCREASE_YOUR 0.0002 0.0002 1
T HK_SCAM_S3 0.0002 0.0002 1
T __FORGED_RCVD_TRAIL 0.0002 0.0002 1
T EXCUSE_REMOVE 0.0002 0.0002 1
T __FB_INK_PEN 0.0002 0.0002 1
T FB_SAVE_PERSC 0.0002 0.0002 1
T EXCUSE_4 0.0002 0.0002 1
T FB_REPLICA_ROLEX 0.0002 0.0002 1
T __FRAUD_YPO 0.0002 0.0002 1
T __FB_TIMEPIECE 0.0002 0.0002 1
T __FRAUD_FVU 0.0002 0.0002 1
T FB_ACHIEVE_BACH 0.0002 0.0002 1
T __FRAUD_RLX 0.0002 0.0002 1
T __FB_LOTTERY 0.0002 0.0002 1
T __FB_OMEGA 0.0002 0.0002 1
T __FRAUD_YQV 0.0002 0.0002 1
T __FRAUD_YJA 0.0002 0.0002 1
T __MBA 0.0002 0.0002 1
T __DOS_RELAYED_EXT 0.0002 0.0002 1
T __FB_BRAND_NAME 0.0002 0.0002 1
T __APPROVALFVGT 0.0002 0.0002 1
T MILLION_USD 0.0002 0.0002 1
T __PREAPPROVEDFVGT 0.0002 0.0002 1
T __MASTERS 0.0002 0.0002 1
T BANKING_LAWS 0.0002 0.0002 1
T __YOU_HAVE_WON 0.0002 0.0002 1
T PENIS_ENLARGEMENT_SOLUTION 0.0002 0.0002 1
T __FB_PROJECTED 0.0001 0.0001 1
T URG_BIZ 0.0001 0.0001 1
T __FB_GAME 0.0001 0.0001 1
T __FRAUD_GBW 0.0001 0.0001 1
T __RUDE_HTML_1 0.0001 0.0001 1
T __YOUR_CREDITFVGT 0.0001 0.0001 1
T __HAS_ANY_EMAIL 0.0001 0.0001 1
T __DRUGS_ANXIETY_XAN 0.0001 0.0001 1
T __LAST_EXTERNAL_RELAY_NO_AUTH 0.0001 0.0001 1
T __FB_WALLETS 0.0001 0.0001 1
T FB_QUALITY_REPLICA 0.0001 0.0001 1
T __DRUGS_ANXIETY_VAL 0.0001 0.0001 1
T __DRUGS_PAIN_VIOXX 0.0001 0.0001 1
T GUARANTEED_100_PERCENT 0.0001 0.0001 1
T __HAS_MSGID 0.0001 0.0001 1
T __freemail_safe_fwd 0.0001 0.0001 1
T __FORGED_HOTMAIL_RCVD 0.0001 0.0001 1
T __HAS_TO 0.0001 0.0001 1
T __MIME_VERSION 0.0001 0.0001 1
T SPF_NEUTRAL 0.0001 0.0001 1
T RATWARE_EFROM 0.0001 0.0001 1
T __HDRS_LCASE 0.0001 0.0001 1
T __FB_MA 0.0001 0.0001 1
T __DOS_BODY_TICKER 0.0001 0.0001 1
T __FB_BCs 0.0001 0.0001 1
T __FB_BA 0.0001 0.0001 1
T __VM_WORD 0.0001 0.0001 1
T __VA_WORD 0.0001 0.0001 1
T __CS_WORD 0.0001 0.0001 1
T __HOST_HOTMAIL 0.0001 0.0001 1
T __CRBOUNCE_SPAMLION 0.0001 0.0001 1
T __AFF_004470_NUMBER 0.0001 0.0001 1
T __ACH_CANCELLED_04 0.0001 0.0001 1
T __ISO_2022_JP_DELIM 0.0001 0.0001 1
T __BIGDOLLARSFVGT 0.0001 0.0001 1
T __CT 0.0001 0.0001 1
T __HAS_SUBJECT 0.0001 0.0001 1
T __HAS_X_REF 0.0001 0.0001 1
T SUSPICIOUS_RECIPS 0.0001 0.0001 1
T RCVD_NUMERIC_HELO 0.0001 0.0001 1
T __FB_NUM_PERCNT 0.0001 0.0001 1
T __MSGID_OK_HOST 0.0001 0.0001 1
T __NONEMPTY_BODY 0.0001 0.0001 1
T __TOCC_EXISTS 0.0001 0.0001 1
T __HAS_MESSAGE_ID 0.0001 0.0001 1
T LOCALPART_IN_SUBJECT 0.0001 0.0001 1
T __SUBJ_RE 0.0001 0.0001 1
T __SANE_MSGID 0.0001 0.0001 1
T __HAS_IN_REPLY_TO 0.0001 0.0001 1
T __HAS_DATE 0.0001 0.0001 1
T __DOS_RCVD_TUE 0.0001 0.0001 1
T __DOS_LINK 0.0001 0.0001 1
T __freemail_replyto 0.0001 0.0001 1
T __RCD_RDNS_MAIL_MESSY 0.0001 0.0001 1
T __HS_SUBJ_RE_FW 0.0001 0.0001 1
T __LAST_UNTRUSTED_RELAY_NO_AUTH 0.0001 0.0001 1
T __FROM_FREEMAIL 0.0001 0.0001 1
T __HAS_FROM 0.0001 0.0001 1
T __HAS_RCVD 0.0001 0.0001 1
T __FROM_HOTMAIL_COM 0.0001 0.0001 1
T RCVD_HELO_IP_MISMATCH 0.0001 0.0001 1
T __CTYPE_HAS_BOUNDARY 0.0001 0.0001 1
T SUBJ_ALL_CAPS 0.0001 0.0001 1
T __CTYPE_MULTIPART_ANY 0.0001 0.0001 1
T __FH_HAS_XMSMAIL 0.0001 0.0001 1
T __DOS_COMING_TO_YOUR_PLACE 0.0001 0.0001 1
T __DOS_EMAIL_DIRECTLY 0.0001 0.0001 1
T FB_SPACED_PHN_3B 0.0001 0.0001 1
T __MSGID_BEFORE_RECEIVED 0.0001 0.0001 1
T FREEMAIL_REPLYTO_END_DIGIT 0.0001 0.0001 1
T __FROM_RIGH_BRACK 0.0001 0.0001 1
T __DOUBLE_IP_LOOSE 0.0001 0.0001 1
T FROM_NO_USER 0.0001 0.0001 1
T NO_RDNS_DOTCOM_HELO 0.0001 0.0001 1
T __DOS_WRITE_ME_AT 0.0001 0.0001 1
T HASHCASH_2SPEND 0.0001 0.0001 1
T UNRESOLVED_TEMPLATE 0.0001 0.0001 1
T __FB_GLASHUTE 0.0001 0.0001 1
T __MANY_RECIPS 0.0001 0.0001 1
T AXB_BODYMAIL_SBL112884 0.0001 0.0001 1
T SUBJECT_IN_WHITELIST 0.0001 0.0001 1
T __AUTO_GEN_CM 0.0001 0.0001 1
T INVALID_DATE 0.0001 0.0001 1
T HEADER_SPAM 0.0001 0.0001 1
T __VBOUNCE_AMAVISD2 0.0001 0.0001 1
T HK_RANDOM_REPLYTO 0.0001 0.0001 1
T __DOS_MY_OLD_JOB 0.0001 0.0001 1
T MIME_BOUND_DIGITS_15 0.0001 0.0001 1
T HK_RANDOM_ENVFROM 0.0001 0.0001 1
T __RCVD_ZIXMAIL 0.0001 0.0001 1
T __DOS_TAKING_HOME 0.0001 0.0001 1
T __VBOUNCE_REJ_FILT 0.0000 0.0000 1
T FSL_MID_419 0.0000 0.0000 1
T __V_INNERCIRCLE 0.0000 0.0000 1
T __KHOP_PGP_I2 0.0000 0.0000 1
T CURR_PRICE 0.0000 0.0000 1
T __V_INFORM_YOU 0.0000 0.0000 1
T __KHOP_PGP_I1 0.0000 0.0000 1
T __DOS_DROP_ME_A_LINE 0.0000 0.0000 1
T MSGID_WSP_TRAIL 0.0000 0.0000 1
T __V_PRINCETONPRE 0.0000 0.0000 1
T CHARSET_FARAWAY_HEADER 0.0000 0.0000 1
T __DOS_LET_GO_JOB 0.0000 0.0000 1
T AMAZON_COPYRIGHT 0.0000 0.0000 1
T __MISSING_REF 0.0000 0.0000 1
T __KB_DATE_CONTAINS_TAB 0.0000 0.0000 1
T BUG6152_INVALID_DATE_TZ_ABSURD 0.0000 0.0000 1
T FREEMAIL_ENVFROM_END_DIGIT 0.0000 0.0000 1
T __VBOUNCE_QUOTED_EXE 0.0000 0.0000 1
T __V_USCAVANITY 0.0000 0.0000 1
T __DBLCLAIM 0.0000 0.0000 1
T __VBOUNCE_ATT_QUAR 0.0000 0.0000 1
T __FROM_ENCODED_QP 0.0000 0.0000 1
T __FSL_UA_1 0.0000 0.0000 1
T __FORGED_AOL_RCVD 0.0000 0.0000 1
T __VBOUNCE_EXIM 0.0000 0.0000 1
T __MISSING_REPLY 0.0000 0.0000 1
T FSL_RCVD_USER 0.0000 0.0000 1
T __BOUNCE_OOO_3 0.0000 0.0000 1
T __DOS_CORRESPOND_EMAIL 0.0000 0.0000 1
T __VBOUNCE_PROBLEME 0.0000 0.0000 1
T __MIME_VERSION_APPLEMAIL 0.0000 0.0000 1
T __CRBOUNCE_SPAMARREST 0.0000 0.0000 1
T __V_SBCAVANITY 0.0000 0.0000 1
T __freemail_hdr_replyto 0.0000 0.0000 1
T __VBOUNCE_MAILSWEEP 0.0000 0.0000 1
T FROM_ILLEGAL_CHARS 0.0000 0.0000 1
T __MSGID_HEX_UID 0.0000 0.0000 1
T __CRBOUNCE_TMDA 0.0000 0.0000 1
T FH_DATE_IS_19XX 0.0000 0.0000 1
T __V_DPHPVANITY 0.0000 0.0000 1
T __HAS_THREAD_INDEX 0.0000 0.0000 1
T __X_CRON_ENV 0.0000 0.0000 1
T FSL_HELO_DEVICE 0.0000 0.0000 1
T __ML5 0.0000 0.0000 1
T __BOUNCE_OOO_2 0.0000 0.0000 1
T USER_IN_BLACKLIST_TO 0.0000 0.0000 1
T __CTE 0.0000 0.0000 1
T __BOUNCE_NO_RESEND 0.0000 0.0000 1
T __TO_EQ_FROM_2 0.0000 0.0000 1
T __VBOUNCE_GUIN 0.0000 0.0000 1
T RCVD_ILLEGAL_IP 0.0000 0.0000 1
T USER_IN_DEF_SPF_WL 0.0000 0.0000 1
T __VBOUNCE_MAILMARSHAL 0.0000 0.0000 1
T FH_HOST_EQ_PACBELL_D 0.0000 0.0000 1
T __VBOUNCE_STRIP_ATTACH 0.0000 0.0000 1
T __DOS_HAS_MAILING_LIST 0.0000 0.0000 1
T __REPLY_FREEMAIL 0.0000 0.0000 1
T __CD 0.0000 0.0000 1
T FH_HAS_XAIMC 0.0000 0.0000 1
T __HAS_ERRORS_TO 0.0000 0.0000 1
T DKIM_ADSP_CUSTOM_MED 0.0000 0.0000 1
T GTUBE 0.0000 0.0000 1
T USER_IN_SPF_WHITELIST 0.0000 0.0000 1
T __ML3 0.0000 0.0000 1
T AXB_XMA_BASP 0.0000 0.0000 1
T __CRBOUNCE_PREC_SPAM 0.0000 0.0000 1
T __HELO_DYNAMIC_DHCP 0.0000 0.0000 1
T __TO___LOWER 0.0000 0.0000 1
T __RATWARE_NAME_ID 0.0000 0.0000 1
T __CRBOUNCE_SZ 0.0000 0.0000 1
T __HAS_X_MAILING_LIST 0.0000 0.0000 1
T __MAILMAN_21 0.0000 0.0000 1
T __HAS_LIST_ID 0.0000 0.0000 1
T __SUBJ_HAS_FROM_1 0.0000 0.0000 1
T __CRBOUNCE_EXI 0.0000 0.0000 1
T __TO_EQ_FROM_1 0.0000 0.0000 1
T __IMS_HTML_BUILDS 0.0000 0.0000 1
T __FH_HAS_XPRIORITY 0.0000 0.0000 1
T __CRBOUNCE_ASK 0.0000 0.0000 1
T __AXB_MO_OL_37431 0.0000 0.0000 1
T __BOUNCE_X_ERR_STAT 0.0000 0.0000 1
T __AUTO_GEN_XXSP 0.0000 0.0000 1
T __HAS_ORIGINALLY 0.0000 0.0000 1
T __AUTO_GEN_AG 0.0000 0.0000 1
T __DISPONOT 0.0000 0.0000 1
T __MIMEOLE_MS 0.0000 0.0000 1
T __HAS_X_LOOP 0.0000 0.0000 1
T __YESBOUNCE_AUTO_REPLIED_REJ 0.0000 0.0000 1
T POSTCARD_05 0.0000 0.0000 1
T __LYRIS_EZLM_REMAILER 0.0000 0.0000 1
T X_IP 0.0000 0.0000 1
T __AUTO_GEN_XBT 0.0000 0.0000 1
T __AUTO_GEN_3 0.0000 0.0000 1
T __AUTO_GEN_BBTL 0.0000 0.0000 1
T __GATED_THROUGH_RCVD_REMOVER 0.0000 0.0000 1
T __NAME_EQ_EMAIL 0.0000 0.0000 1
T __HAS_TNEF 0.0000 0.0000 1
T __BOUNCE_ETRUST 0.0000 0.0000 1
T __HAS_X_BEEN_THERE 0.0000 0.0000 1
T USER_IN_MORE_SPAM_TO 0.0000 0.0000 1
T __RDNS_DYNAMIC_DHCP 0.0000 0.0000 1
T __OLDPEG 0.0000 0.0000 1
T __AUTO_GEN_MS 0.0000 0.0000 1
T __HELO_DYNAMIC_HCC 0.0000 0.0000 1
T __RRCPTO 0.0000 0.0000 1
T __DOS_HAS_LIST_ID 0.0000 0.0000 1
T __SUBJ_ILLEGAL_CHARS 0.0000 0.0000 1
T __HAS_SENDER 0.0000 0.0000 1
T __RDNS_DYNAMIC_HCC 0.0000 0.0000 1
T __TO_EQ_FROM_DOM_1 0.0000 0.0000 1
T __TO_EQ_FROM_DOM_2 0.0000 0.0000 1
T __HAS_CC 0.0000 0.0000 1
T HASHCASH_23 0.0000 0.0000 1
T SUBJECT_IN_BLACKLIST 0.0000 0.0000 1
T T_LOTTO_AGENT_FM 0.0000 0.0000 1
T __VBOUNCE_DOMINO2 0.0000 0.0000 1
T __DOS_HI 0.0000 0.0000 1
T __BODY_STARTS_WITH_FROM_LINE 0.0000 0.0000 1
T DOS_RCVD_IP_TWICE_C 0.0000 0.0000 1
T __freemail_safe_rls 0.0000 0.0000 1
T __BOUNCE_ESMTP 0.0000 0.0000 1
T FS_WILL_HELP 0.0000 0.0000 1
T FH_HELO_ALMOST_IP 0.0000 0.0000 1
T __FS_REPLICA 0.0000 0.0000 1
T FH_FROMEML_NOTLD 0.0000 0.0000 1
T __SUBJECT_FUZZY_VPILL 0.0000 0.0000 1
T __RDNS_STATIC 0.0000 0.0000 1
T __FORGED_JUNO_RCVD 0.0000 0.0000 1
T __CTYPE_CHARSET_QUOTED 0.0000 0.0000 1
T BAD_ENC_HEADER 0.0000 0.0000 1
T __FORGED_EUDORAMAIL_RCVD 0.0000 0.0000 1
T __SUBJ_VEGAS 0.0000 0.0000 1
T __EXCLAIM_SUBJ 0.0000 0.0000 1
T MSGID_OUTLOOK_INVALID 0.0000 0.0000 1
T __RDNS_DYNAMIC_COMCAST 0.0000 0.0000 1
T __RDNS_DYNAMIC_ATTBI 0.0000 0.0000 1
T FS_APPROVE_YOU 0.0000 0.0000 1
T FH_HOST_EQ_DYNAMICIP 0.0000 0.0000 1
T __ENV_AND_HDR_FROM_MATCH 0.0000 0.0000 1
T __NSL_RCVD_FROM_41 0.0000 0.0000 1
T __RCD_RDNS_MX 0.0000 0.0000 1
T TO_MALFORMED 0.0000 0.0000 1
T __RDNS_DYNAMIC_NTL 0.0000 0.0000 1
T FORGED_YAHOO_RCVD 0.0000 0.0000 1
T TVD_SUBJ_WIPE_DEBT 0.0000 0.0000 1
T __DOS_RCVD_WED 0.0000 0.0000 1
T __RDNS_DYNAMIC_TDS 0.0000 0.0000 1
T HELO_DYNAMIC_DIALIN 0.0000 0.0000 1
T __VBOUNCE_MMS 0.0000 0.0000 1
T __CRBOUNCE_UOL 0.0000 0.0000 1
T __AXB_XM_OL_964DE 0.0000 0.0000 1
T __BOUNCE_OOO_H2 0.0000 0.0000 1
T __HELO_DYNAMIC_IPADDR 0.0000 0.0000 1
T FSL_HELO_BARE_IP_1 0.0000 0.0000 1
T HELO_OEM 0.0000 0.0000 1
T HELO_LH_HOME 0.0000 0.0000 1
T __BOUNCE_FROM_DAEMON 0.0000 0.0000 1
T HELO_DYNAMIC_SPLIT_IP 0.0000 0.0000 1
T T_RP_MATCHES_RCVD 0.0000 0.0000 1
T __RDNS_DYNAMIC_VELOX 0.0000 0.0000 1
T MISSING_HEADERS 0.0000 0.0000 1
T __RDNS_DYNAMIC_IPADDR 0.0000 0.0000 1
T __RCD_RDNS_SMTP_MESSY 0.0000 0.0000 1
T __RDNS_INDICATOR_RES 0.0000 0.0000 1
T __RDNS_INDICATOR_TYPE2 0.0000 0.0000 1
T __RDNS_INDICATOR_TYPE 0.0000 0.0000 1
T __RDNS_DYNAMIC_YAHOOBB 0.0000 0.0000 1
T MSGID_SHORT 0.0000 0.0000 1
T __RCD_RDNS_MX_MESSY 0.0000 0.0000 1
T __RDNS_INDICATOR_DYN 0.0000 0.0000 1
T HELO_DYNAMIC_IPADDR2 0.0000 0.0000 1
T FS_PHARMASUB2 0.0000 0.0000 1
T __HOTMAILCOM 0.0000 0.0000 1
T __BAT_BOUNDARY 0.0000 0.0000 1
T HELO_LOCALHOST 0.0000 0.0000 1
T FH_FAKE_RCVD_LINE_B 0.0000 0.0000 1
T HELO_DYNAMIC_HOME_NL 0.0000 0.0000 1
T FH_HELO_EQ_CHARTER 0.0000 0.0000 1
T TT_MSGID_TRUNC 0.0000 0.0000 1
T UNCLOSED_BRACKET 0.0000 0.0000 1
T __MSGID_OK_DIGITS 0.0000 0.0000 1
T __HELO_STATIC_ROGERS 0.0000 0.0000 1
T __RDNS_NONE 0.0000 0.0000 1
T HELO_DYNAMIC_CHELLO_NL 0.0000 0.0000 1
T FROM_BLANK_NAME 0.0000 0.0000 1
T TO_PPPM 0.0000 0.0000 1
T __RDNS_DYNAMIC_SPLIT_IP 0.0000 0.0000 1
T __RCD_RDNS_MTA_MESSY 0.0000 0.0000 1
T __RDNS_DYNAMIC_TTNET 0.0000 0.0000 1
T __RDNS_DYNAMIC_DIALIN 0.0000 0.0000 1
T __HELO_NO_DOMAIN 0.0000 0.0000 1
T PHARM7 0.0000 0.0000 1
T __FROM_EBAY 0.0000 0.0000 1
T __RDNS_DYNAMIC_ASAHI 0.0000 0.0000 1
T __RDNS_DYNAMIC_ADELPHIA 0.0000 0.0000 1
T __MSGID_LIST 0.0000 0.0000 1
T FH_FAKE_RCVD_LINE 0.0000 0.0000 1
T __FH_FRM_53 0.0000 0.0000 1
T __RDNS_DYNAMIC_CHELLO_NL 0.0000 0.0000 1
T __NSL_ORIG_FROM_41 0.0000 0.0000 1
T PHARM4 0.0000 0.0000 1
T __RDNS_DYNAMIC_RR2 0.0000 0.0000 1
T __BOUNCE_COULD_NOT 0.0000 0.0000 1
T MSGID_YAHOO_CAPS 0.0000 0.0000 1
T __DOS_SINGLE_EXT_RELAY 0.0000 0.0000 1
T __RDNS_DYNAMIC_VTR 0.0000 0.0000 1
T TVD_SUBJ_ACC_NUM 0.0000 0.0000 1
T __VACATION 0.0000 0.0000 1
T AXB_X_RCV_WLOCAL 0.0000 0.0000 1
T AXB_XRCVD_EYOU_SEND 0.0000 0.0000 1
T __RDNS_DYNAMIC_VIRTUA 0.0000 0.0000 1
T __RDNS_DYNAMIC_HOME_NL 0.0000 0.0000 1
T __RDNS_SHORT 0.0000 0.0000 1
T __RDNS_DYNAMIC_ROGERS 0.0000 0.0000 1
T __FHOST_VERIZON 0.0000 0.0000 1
T __FHELO_VERIZON 0.0000 0.0000 1
T __DKIM_EXISTS 0.0000 0.0000 1
T SUBJECT_FUZZY_CHEAP 0.0000 0.0000 1
T __MSGID_OK_HEX 0.0000 0.0000 1
T FS_OBFU_PRMCY 0.0000 0.0000 1
T __RDNS_DYNAMIC_TELIA 0.0000 0.0000 1
T FSL_HELO_NON_FQDN_1 0.0000 0.0000 1
T __SUBJ_3DIGIT 0.0000 0.0000 1
T KB_RATWARE_OUTLOOK_MID 0.0000 0.0000 1
T FH_HOST_IN_ADDRARPA 0.0000 0.0000 1
T __RDNS_DYNAMIC_CHELLO_NO 0.0000 0.0000 1
T __RDNS_DYNAMIC_SPACELAN 0.0000 0.0000 1
T FSL_FAKE_HOTMAIL_RVCD 0.0000 0.0000 1
T __XM_SKYRI 0.0000 0.0000 1
T __DOS_RCVD_FRI 0.0000 0.0000 1
T ENGLISH_UCE_SUBJECT 0.0000 0.0000 1
T THEBAT_UNREG 0.0000 0.0000 1
T __VBOUNCE_SCREENSAVER 0.0000 0.0000 1
T FS_WE_WANT 0.0000 0.0000 1
T __DOUBLE_IP_SPAM_2 0.0000 0.0000 1
T FS_LARGE_PERCENT2 0.0000 0.0000 1
T __AXB_XM_OL_8627E 0.0000 0.0000 1
T DKIM_ADSP_CUSTOM_HIGH 0.0000 0.0000 1
T __AT_HOTMAIL_MSGID 0.0000 0.0000 1
T INVALID_DATE_TZ_ABSURD 0.0000 0.0000 1
T __DOS_RCVD_THU 0.0000 0.0000 1
T MSGID_MULTIPLE_AT 0.0000 0.0000 1
T L_SPAM_TOOL_13 0.0000 0.0000 1
T HK_NAME_DRUGS 0.0000 0.0000 1
T PHARM6 0.0000 0.0000 1
T FSL_CTYPE_WIN1251 0.0000 0.0000 1
T LOCAL_CRON 0.0000 0.0000 1
T DKIM_ADSP_ALL 0.0000 0.0000 1
T __RATWARE_BOUND_A 0.0000 0.0000 1
T STOX_REPLY_TYPE 0.0000 0.0000 1
T __BOUNCE_RPATH_ERRMAIL 0.0000 0.0000 1
T __AOL_IP 0.0000 0.0000 1
T __FSL_HELO_USER_1 0.0000 0.0000 1
T __RDNS_DYNAMIC_OOL 0.0000 0.0000 1
T __PGP_SIGNED 0.0000 0.0000 1
T __FH_MSGID_01C7 0.0000 0.0000 1
T MSGID_SPAM_CAPS 0.0000 0.0000 1
T __RCVD_WITH_EXCHANGE 0.0000 0.0000 1
T RDNS_LOCALHOST 0.0000 0.0000 1
T __MSGID_RANDY 0.0000 0.0000 1
T SUBJECT_DRUG_GAP_L 0.0000 0.0000 1
T HK_LOTTO_NAME 0.0000 0.0000 1
T __RATWARE_BOUND_B 0.0000 0.0000 1
T FSL_FAKE_GMAIL_RCVD 0.0000 0.0000 1
T __GAPPY_SUBJECT 0.0000 0.0000 1
T TVD_RCVD_SPACE_BRACKET 0.0000 0.0000 1
T __CTYPE_HTML 0.0000 0.0000 1
T __WACKY_SENDMAIL_VERSION 0.0000 0.0000 1
T FS_START_DOYOU2 0.0000 0.0000 1
T __VBOUNCE_SYM_AVF 0.0000 0.0000 1
T __FRAUD_VQE 0.0000 0.0000 1
T __FSL_HELO_USER_2 0.0000 0.0000 1
T __TO_NO_ARROWS_R 0.0000 0.0000 1
T __FROM_ALL_NUMS 0.0000 0.0000 1
T FS_NUDE 0.0000 0.0000 1
T FROM_LOCAL_NOVOWEL 0.0000 0.0000 1
T FH_HOST_EQ_VERIZON_P 0.0000 0.0000 1
T USER_IN_DEF_DKIM_WL 0.0000 0.0000 1
T HELO_DYNAMIC_HEXIP 0.0000 0.0000 1
T __UA_MUTT 0.0000 0.0000 1
T SPF_HELO_SOFTFAIL 0.0000 0.0000 1
T SPF_HELO_FAIL 0.0000 0.0000 1
T __BOUNCE_AUTO_REPLY 0.0000 0.0000 1
T __VBOUNCE_WARNING 0.0000 0.0000 1
T REGIS 0.0000 0.0000 1
T __VBOUNCE_MAILSWEEP3 0.0000 0.0000 1
T TVD_RCVD_IP4 0.0000 0.0000 1
T PHARM3 0.0000 0.0000 1
T __BOUNCE_CTYPE 0.0000 0.0000 1
T __AXB_XM_OL_C95DC 0.0000 0.0000 1
T __NONBOUNCE_READ_RECEIPT_CTYPE 0.0000 0.0000 1
T __DOMINO_RCVD 0.0000 0.0000 1
T SUBJECT_DRUG_GAP_C 0.0000 0.0000 1
T __FROM_MISSPACED 0.0000 0.0000 1
T LOGWATCH 0.0000 0.0000 1
T RCVD_FAKE_HELO_DOTCOM 0.0000 0.0000 1
T FS_AT_NO_COST 0.0000 0.0000 1
T __VBOUNCE_DISALLOWED 0.0000 0.0000 1
T FEEDBACK_TB 0.0000 0.0000 1
T FH_FROM_GET_NAME 0.0000 0.0000 1
T __DOUBLE_IP_SPAM_1 0.0000 0.0000 1
T TVD_FINGER_02 0.0000 0.0000 1
T MIME_BOUND_DD_DIGITS 0.0000 0.0000 1
T SUBJ_AS_SEEN 0.0000 0.0000 1
T __VBOUNCE_FORBIDDEN 0.0000 0.0000 1
T HASHCASH_21 0.0000 0.0000 1
T CTYPE_001C_B 0.0000 0.0000 1
T __MSGID_APPLEMAIL 0.0000 0.0000 1
T DATE_IN_PAST_96_XX 0.0000 0.0000 1
T __CRBOUNCE_QURB 0.0000 0.0000 1
T NSL_RCVD_HELO_USER 0.0000 0.0000 1
T SUBJ_BUY 0.0000 0.0000 1
T DKIM_ADSP_NXDOMAIN 0.0000 0.0000 1
T FH_FROM_CASH 0.0000 0.0000 1
T __FROM_ENDS_IN_NUMS 0.0000 0.0000 1
T HASHCASH_24 0.0000 0.0000 1
T __CTYPE_MULTIPART_ALT 0.0000 0.0000 1
T __HK_NAME_MR_MRS 0.0000 0.0000 1
T __MY_RCVD_EXCITE 0.0000 0.0000 1
T FS_WEIGHT_LOSS 0.0000 0.0000 1
T __XM_GNUS 0.0000 0.0000 1
T __THEBAT_MUA_V1 0.0000 0.0000 1
T FH_MSGID_XXX 0.0000 0.0000 1
T __BOUNCE_DEL_FAIL 0.0000 0.0000 1
T __CT_TEXT_PLAIN 0.0000 0.0000 1
T __AXB_MO_OL_812FF 0.0000 0.0000 1
T __VBOUNCE_SYM_EMP 0.0000 0.0000 1
T SPF_HELO_NEUTRAL 0.0000 0.0000 1
T __SUBJECT_ENCODED_QP 0.0000 0.0000 1
T RATWARE_EGROUPS 0.0000 0.0000 1
T __BOUNCE_NO_VAL 0.0000 0.0000 1
T ALL_TRUSTED 0.0000 0.0000 1
T __FROM_12LTRDOM_1 0.0000 0.0000 1
T __HOTMAIL_BAYDAV_MSGID 0.0000 0.0000 1
T NO_RELAYS 0.0000 0.0000 1
T NSL_RCVD_FROM_USER 0.0000 0.0000 1
T __AXB_MO_OL_787D6 0.0000 0.0000 1
T __CGATE_RCVD 0.0000 0.0000 1
T __HK_NAME_FROM 0.0000 0.0000 1
T __HK_NAME_DR 0.0000 0.0000 1
T FORGED_TELESP_RCVD 0.0000 0.0000 1
T __XM_MSOE5 0.0000 0.0000 1
T __VISTA_MSGID 0.0000 0.0000 1
T __BOUNCE_RETURNED 0.0000 0.0000 1
T __XM_MSOE6 0.0000 0.0000 1
T __BOUNCE_INTERSCAN 0.0000 0.0000 1
T __AXB_MO_OL_22B61 0.0000 0.0000 1
T __PLING_QUERY 0.0000 0.0000 1
T __VBOUNCE_INTERSCAN3 0.0000 0.0000 1
T SUBJ_YOUR_FAMILY 0.0000 0.0000 1
T FROM_OFFERS 0.0000 0.0000 1
T FROM_STARTS_WITH_NUMS 0.0000 0.0000 1
T __IMS_HTML_RCVD 0.0000 0.0000 1
T FROM_DOMAIN_NOVOWEL 0.0000 0.0000 1
T __AXB_MO_OL_B292B 0.0000 0.0000 1
T __IMS_MSGID 0.0000 0.0000 1
T __XM_PHPMAILER_FORGED 0.0000 0.0000 1
T __MSGID_HEXISH 0.0000 0.0000 1
T TVD_RCVD_SINGLE 0.0000 0.0000 1
T HASHCASH_25 0.0000 0.0000 1
T __TB_MIME_BDRY_NO_Z 0.0000 0.0000 1
T __XM_OUTLOOK_EXPRESS 0.0000 0.0000 1
T __BOUNCE_OOO_H1 0.0000 0.0000 1
T PHARM5 0.0000 0.0000 1
T __AXB_XM_OL_56DF6 0.0000 0.0000 1
T PHARM1 0.0000 0.0000 1
T KB_FORGED_MOZ4 0.0000 0.0000 1
T __ANACRON_SUBJ 0.0000 0.0000 1
T __MOLE_2962 0.0000 0.0000 1
T __NAKED_TO 0.0000 0.0000 1
T SUBJ_YOUR_DEBT 0.0000 0.0000 1
T __FSL_HELO_USER_3 0.0000 0.0000 1
T __RP_MATCHES_RCVD 0.0000 0.0000 1
T __BOUNCE_OOO_H3 0.0000 0.0000 1
T __JM_REACTOR_DATE 0.0000 0.0000 1
T __BOUNCE_UNDELIVERABLE_ML 0.0000 0.0000 1
T __YAHOO_BULK 0.0000 0.0000 1
T LOCALHOST 0.0000 0.0000 1
T SUBJECT_DIET 0.0000 0.0000 1
T DATE_DOTS 0.0000 0.0000 1
T FORGED_HOTMAIL_RCVD2 0.0000 0.0000 1
T SPF_FAIL 0.0000 0.0000 1
T __ANY_QUALCOMM_MUA 0.0000 0.0000 1
T CSFWG_MEMBERS 0.0000 0.0000 1
T __VBOUNCE_VIOLATION 0.0000 0.0000 1
T SORTED_RECIPS 0.0000 0.0000 1
T __0_TZ_7 0.0000 0.0000 1
T DATE_IN_PAST_06_12 0.0000 0.0000 1
T __PC_RND_HEADER 0.0000 0.0000 1
T __AXB_XM_OL_E9F46 0.0000 0.0000 1
T __KB_MSGID_OUTLOOK_888 0.0000 0.0000 1
T __AXB_XM_OL_22B61 0.0000 0.0000 1
T __AXB_MO_OL_57545 0.0000 0.0000 1
T POSTCARD_08 0.0000 0.0000 1
T __XM_MS_IN_GENERAL 0.0000 0.0000 1
T PHARM2 0.0000 0.0000 1
T __MSGID_DOLLARS_MAYBE 0.0000 0.0000 1
T X_MAILER_CME_6543_MSN 0.0000 0.0000 1
T __FH_RCV_53 0.0000 0.0000 1
T TVD_RCVD_IP 0.0000 0.0000 1
T __DATE_700 0.0000 0.0000 1
T __AXB_XM_OL_32D97 0.0000 0.0000 1
T __CRBOUNCE_BLOCKED 0.0000 0.0000 1
T __IS_EXCH 0.0000 0.0000 1
T __IPLANET_MESSAGING_SERVER 0.0000 0.0000 1
T __USER_AGENT_MSN 0.0000 0.0000 1
T __CRON_HEADER 0.0000 0.0000 1
T __AT_EXCITE_MSGID 0.0000 0.0000 1
T __BOUNCE_STAT_FAIL 0.0000 0.0000 1
T __FROM_RUNON 0.0000 0.0000 1
T __VBOUNCE_DOMINO1 0.0000 0.0000 1
T __AXB_MO_OL_E9F46 0.0000 0.0000 1
T JM_FAKE_PSMTP_RCVD 0.0000 0.0000 1
T __AXB_MO_OL_56DF6 0.0000 0.0000 1
T __TT_BROKEN_VIAGRA 0.0000 0.0000 1
T __AXB_MO_OL_B30D1 0.0000 0.0000 1
T __ML1 0.0000 0.0000 1
T __FS_S_TRADE 0.0000 0.0000 1
T FEEDBACK_TW 0.0000 0.0000 1
T SPF_PASS 0.0000 0.0000 1
T __AXB_MO_OL_8B970 0.0000 0.0000 1
T FH_FROM_GIVEAWAY 0.0000 0.0000 1
T __VBOUNCE_INFLEX 0.0000 0.0000 1
T __VBOUNCE_AV_RESULTS 0.0000 0.0000 1
T __ANY_IMS_MUA 0.0000 0.0000 1
T __VBOUNCE_ALERT 0.0000 0.0000 1
T __AXB_MO_OL_12495 0.0000 0.0000 1
T __XM_WWWMAIL 0.0000 0.0000 1
T RATWARE_MPOP_WEBMAIL 0.0000 0.0000 1
T __AXB_XM_OL_024C2 0.0000 0.0000 1
T __MSGID_DOLLARS_OK 0.0000 0.0000 1
T __BOUNCE_NOTIF 0.0000 0.0000 1
T __AXB_MO_OL_5933D 0.0000 0.0000 1
T AXB_XM_RAINBOW 0.0000 0.0000 1
T __ML_TURNS_SP_TO_TAB 0.0000 0.0000 1
T __REPTO_QUOTE 0.0000 0.0000 1
T __VBOUNCE_SENDER 0.0000 0.0000 1
T __IMS_MUA 0.0000 0.0000 1
T FS_REPLICAWATCH 0.0000 0.0000 1
T SERGIO_SUBJECT_VIAGRA01 0.0000 0.0000 1
T __FROM_NEEDS_MIME 0.0000 0.0000 1
T __EUDORA_MSGID 0.0000 0.0000 1
T __UA_PAN 0.0000 0.0000 1
T __BOUNCE_ADDR_ERR 0.0000 0.0000 1
T __AXB_MO_OL_6554A 0.0000 0.0000 1
T SUBJ_DOLLARS 0.0000 0.0000 1
T __VBOUNCE_DETECTED 0.0000 0.0000 1
T __AXB_MO_OL_07794 0.0000 0.0000 1
T __OIMO_MSGID 0.0000 0.0000 1
T __UA_XNEWS 0.0000 0.0000 1
T __VBOUNCE_INTERSCAN 0.0000 0.0000 1
T __TT_VALIUM 0.0000 0.0000 1
T __X_MAILER_APPLEMAIL 0.0000 0.0000 1
T __AXB_XM_OL_C9CC0 0.0000 0.0000 1
T __MIME_BDRY_0D0D 0.0000 0.0000 1
T __DOS_RCVD_SAT 0.0000 0.0000 1
T FS_START_LOSE 0.0000 0.0000 1
T __XM_OL_4_72_2106_4 0.0000 0.0000 1
T __AXB_XM_OL_1ECD5 0.0000 0.0000 1
T __AUTO_GEN_PREC 0.0000 0.0000 1
T __VBOUNCE_GWAVA 0.0000 0.0000 1
T __BOUNCE_RET_MAIL 0.0000 0.0000 1
T __TT_VIAGRA 0.0000 0.0000 1
T LOTTO_AGENT_RPLY 0.0000 0.0000 1
T __VBOUNCE_YOUSENT 0.0000 0.0000 1
T __AXB_MO_OL_7EB15 0.0000 0.0000 1
T __AXB_XM_OL_37431 0.0000 0.0000 1
T HASHCASH_20 0.0000 0.0000 1
T __AXB_XM_OL_A50F8 0.0000 0.0000 1
T __AXB_XM_OL_F5C60 0.0000 0.0000 1
T __AXB_MO_OL_32D97 0.0000 0.0000 1
T __UA_MSOMAC 0.0000 0.0000 1
T __VBOUNCE_DEL_WARN 0.0000 0.0000 1
T __CRBOUNCE_UNVERIF 0.0000 0.0000 1
T __RDNS_DYNAMIC_HEXIP 0.0000 0.0000 1
T __AXB_MO_OL_35FFA 0.0000 0.0000 1
T __VBOUNCE_INTERSCAN2 0.0000 0.0000 1
T __0_TZ_1 0.0000 0.0000 1
T __AXB_MO_OL_58CB5 0.0000 0.0000 1
T __FROM_AOL_COM 0.0000 0.0000 1
T __THEBAT_MUA 0.0000 0.0000 1
T __AXB_MO_OL_326A6 0.0000 0.0000 1
T __BOUNCE_SYMANTEC 0.0000 0.0000 1
T DATE_IN_PAST_03_06 0.0000 0.0000 1
T __MSOE_MID_WRONG_CASE 0.0000 0.0000 1
T D_SENT_BY_APTLC 0.0000 0.0000 1
T __AXB_MO_OL_2E645 0.0000 0.0000 1
T __AXB_XM_OL_3AC1D 0.0000 0.0000 1
T __TT_BROKEN_VALIUM 0.0000 0.0000 1
T __AXB_XM_OL_787D6 0.0000 0.0000 1
T __CRBOUNCE_VANQ 0.0000 0.0000 1
T __AOL_MUA 0.0000 0.0000 1
T __MIMEOLE_1106 0.0000 0.0000 1
T __AXB_XM_OL_FB17C 0.0000 0.0000 1
T __FH_MSG_53 0.0000 0.0000 1
T DATE_IN_FUTURE_03_06 0.0000 0.0000 1
T __OUTLOOK_DOLLARS_MUA 0.0000 0.0000 1
T __VBOUNCE_MELDING 0.0000 0.0000 1
T FROM_LOCAL_HEX 0.0000 0.0000 1
T APOSTROPHE_FROM 0.0000 0.0000 1
T __AXB_XM_OL_7EB15 0.0000 0.0000 1
T __AXB_MO_OL_B9B11 0.0000 0.0000 1
T __AXB_XM_OL_A275F 0.0000 0.0000 1
T __UNPARSEABLE_RELAY_COUNT 0.0000 0.0000 1
T __SUBJ_APPROVE 0.0000 0.0000 1
T __FSL_UA_2 0.0000 0.0000 1
T HASHCASH_HIGH 0.0000 0.0000 1
T __AXB_MO_OL_6237B 0.0000 0.0000 1
T __ANY_OUTLOOK_MUA 0.0000 0.0000 1
T __SUBJECT_UTF8_B_ENCODED 0.0000 0.0000 1
T __CRON_FROM 0.0000 0.0000 1
T __AXB_MO_OL_3AC1D 0.0000 0.0000 1
T FSL_XM_419 0.0000 0.0000 1
T __VBOUNCE_JMAIL 0.0000 0.0000 1
T __AXB_MO_OL_4204A 0.0000 0.0000 1
T __MAILER_OL_6626 0.0000 0.0000 1
T __VBOUNCE_NAV_DETECT 0.0000 0.0000 1
T __OE_MUA 0.0000 0.0000 1
T FROM_LOCAL_DIGITS 0.0000 0.0000 1
T DATE_IN_FUTURE_12_24 0.0000 0.0000 1
T __AXB_XM_OL_4204A 0.0000 0.0000 1
T __TAB_IN_FROM 0.0000 0.0000 1
T __CRBOUNCE_VERIF 0.0000 0.0000 1
T __AXB_XM_OL_448E3 0.0000 0.0000 1
T DATE_IN_PAST_24_48 0.0000 0.0000 1
T __AXB_MO_OL_62CA2 0.0000 0.0000 1
T __BOUNCE_READ_NOTIFICATION 0.0000 0.0000 1
T __0_TZ_4 0.0000 0.0000 1
T __BOUNCE_UNDELIVERABLE 0.0000 0.0000 1
T FS_ABIGGER 0.0000 0.0000 1
T __HDR_ORDER_FTSDMCXXXX 0.0000 0.0000 1
T SPF_SOFTFAIL 0.0000 0.0000 1
T __HS_SUBJ_UC_FW 0.0000 0.0000 1
T __AXB_MO_OL_DDE5D 0.0000 0.0000 1
T __VBOUNCE_EMANAGER 0.0000 0.0000 1
T __VBOUNCE_VIR_FOUND 0.0000 0.0000 1
T __MSGID_BEFORE_OKAY 0.0000 0.0000 1
T __VBOUNCE_RAV 0.0000 0.0000 1
T __VBOUNCE_SCANMAIL 0.0000 0.0000 1
T __AXB_MO_OL_44FE0 0.0000 0.0000 1
T __AT_YAHOO_MSGID 0.0000 0.0000 1
T __EUDORA_MUA 0.0000 0.0000 1
T DATE_IN_FUTURE_24_48 0.0000 0.0000 1
T __UA_MSOEMAC 0.0000 0.0000 1
T __CRBOUNCE_0SPAM2 0.0000 0.0000 1
T __OE_MSGID_2 0.0000 0.0000 1
T __VBOUNCE_BITDEFENDER 0.0000 0.0000 1
T __AXB_XM_OL_12495 0.0000 0.0000 1
T __HAS_DKIM_SIGHD 0.0000 0.0000 1
T __THREAD_INDEX_GOOD 0.0000 0.0000 1
T __FROM_YAHOO_COM 0.0000 0.0000 1
T __OIMO_MUA 0.0000 0.0000 1
T __DOS_HAS_LIST_UNSUB 0.0000 0.0000 1
T DKIM_ADSP_CUSTOM_LOW 0.0000 0.0000 1
T __VBOUNCE_INF_ATTACH 0.0000 0.0000 1
T __FROM_ISO_2022_JP 0.0000 0.0000 1
T __DOS_RCVD_SUN 0.0000 0.0000 1
T __AXB_MO_OL_F5C60 0.0000 0.0000 1
T __MUA_TBIRD 0.0000 0.0000 1
T FEEDBACK_MNEME 0.0000 0.0000 1
T __BOUNCE_Y_AUTOGEN 0.0000 0.0000 1
T __CRBOUNCE_RP 0.0000 0.0000 1
T __MAJORDOMO_SUBJ 0.0000 0.0000 1
T __AXB_MO_OL_0A08A 0.0000 0.0000 1
T DATE_IN_PAST_12_24 0.0000 0.0000 1
T __DOS_RCVD_MON 0.0000 0.0000 1
T __FMO_EXCL_OE3790 0.0000 0.0000 1
T HASHCASH_22 0.0000 0.0000 1
T __HAS_REPLY_TO 0.0000 0.0000 1
T __XM_OL_10_0_4115 0.0000 0.0000 1
T __AXB_MO_OL_9B90B 0.0000 0.0000 1
T __UA_KNODE 0.0000 0.0000 1
T __HAS_OFFICE1214_IN_MAILER 0.0000 0.0000 1
T __XM_MOZ4 0.0000 0.0000 1
T __Tbd 0.0000 0.0000 1
T __AXB_MO_OL_024C2 0.0000 0.0000 1
T __AT_AOL_MSGID 0.0000 0.0000 1
T __VBOUNCE_NAV2 0.0000 0.0000 1
T __FROM_MSN_COM 0.0000 0.0000 1
T __HAS_SQUIRRELMAIL_IN_MAILER 0.0000 0.0000 1
T __AXB_MO_OL_8E893 0.0000 0.0000 1
T __BOUNCE_MAIL_DEL_FAIL 0.0000 0.0000 1
T __FS_SUBJ_RE 0.0000 0.0000 1
T __AXB_MO_OL_448E3 0.0000 0.0000 1
T CSFWG_OFFICERS 0.0000 0.0000 1
T __FROM_PAYPAL 0.0000 0.0000 1
T __VBOUNCE_ANTIGEN 0.0000 0.0000 1
T __UA_GNUS 0.0000 0.0000 1
T __XM_OL_28001441 0.0000 0.0000 1
T __CRBOUNCE_MIB 0.0000 0.0000 1
T __MSGID_JAVAMAIL 0.0000 0.0000 1
T __AXB_XM_OL_B9B11 0.0000 0.0000 1
T __TT_OBSCURED_VIAGRA 0.0000 0.0000 1
T __MOZILLA_MSGID 0.0000 0.0000 1
T __MID_START_001C 0.0000 0.0000 1
T __FROM_LEFT_BRACK 0.0000 0.0000 1
T __VBOUNCE_AMAVISD 0.0000 0.0000 1
T __AXB_XM_OL_62CA2 0.0000 0.0000 1
T __TT_OBSCURED_VALIUM 0.0000 0.0000 1
T __FMO_EXCL_O3416 0.0000 0.0000 1
T __AXB_MO_OL_1ECD5 0.0000 0.0000 1
T __VBOUNCE_LUTHER 0.0000 0.0000 1
T __0_TZ_6 0.0000 0.0000 1
T DATE_IN_FUTURE_48_96 0.0000 0.0000 1
T __OE_MSGID_1 0.0000 0.0000 1
T __BOUNCE_AUTO_RESPOND 0.0000 0.0000 1
T __XM_OL_28004682 0.0000 0.0000 1
T __HAS_MIMEOLE 0.0000 0.0000 1
T __AUTO_GEN_4 0.0000 0.0000 1
T __SYMPATICO_MSGID 0.0000 0.0000 1
T __VBOUNCE_FROMPT 0.0000 0.0000 1
T __FROM_ENCODED_B64 0.0000 0.0000 1
T __AXB_MO_OL_4EEDB 0.0000 0.0000 1
T __CRBOUNCE_RP_2 0.0000 0.0000 1
T __0_TZ_3 0.0000 0.0000 1
T __VBOUNCE_RAPPORT 0.0000 0.0000 1
T __CRBOUNCE_SI2 0.0000 0.0000 1
T __VBOUNCE_BANNED_MAT 0.0000 0.0000 1
T __VBOUNCE_MSGLABS 0.0000 0.0000 1
T __AXB_MO_OL_A50F8 0.0000 0.0000 1
T __VBOUNCE_CONT_VIOL 0.0000 0.0000 1
T __VBOUNCE_EMVD 0.0000 0.0000 1
T __BOUNCE_UNDEL_MSG 0.0000 0.0000 1
T __SUBJECT_ENCODED_B64 0.0000 0.0000 1
T __XM_OL_48072300 0.0000 0.0000 1
T __BOUNCE_NOTDEL 0.0000 0.0000 1
T __AT_MSN_MSGID 0.0000 0.0000 1
T __VBOUNCE_NAV 0.0000 0.0000 1
T __MSGID_COMMENT 0.0000 0.0000 1
T __BOUNCE_MAILDELFAIL 0.0000 0.0000 1
T __VBOUNCE_MAILMARSHAL2 0.0000 0.0000 1
T __BOUNCE_DATA_FORMAT 0.0000 0.0000 1
T __XM_VBULLETIN 0.0000 0.0000 1
T __VBOUNCE_GSHIELD 0.0000 0.0000 1
T __XM_PHP 0.0000 0.0000 1
T __AXB_MO_OL_C9CC0 0.0000 0.0000 1
T __ANACRON_FROM 0.0000 0.0000 1
T __BOUNCE_RPATH_MD 0.0000 0.0000 1
T __0_TZ_2 0.0000 0.0000 1
T __VBOUNCE_PT_BLOCKED 0.0000 0.0000 1
T __NAME_IS_EMAIL 0.0000 0.0000 1
T __HAS_UA 0.0000 0.0000 1
T __0_TZ_5 0.0000 0.0000 1
T __HAS_XMAIL 0.0000 0.0000 1
T __MAILER_OL_5510 0.0000 0.0000 1
T __VBOUNCE_MIME_INFO 0.0000 0.0000 1
T POSTGRES 0.0000 0.0000 1
T __BOUNCE_RPATH_NULL 0.0000 0.0000 1
T __AXB_XM_OL_8E893 0.0000 0.0000 1
T __BOUNCE_MSGDELFAIL 0.0000 0.0000 1
T __BOUNCE_AUTO_RESPONSE 0.0000 0.0000 1
T __OUTLOOK_DOLLARS_OTHER 0.0000 0.0000 1
T __SUBJECT_NEEDS_MIME 0.0000 0.0000 1
T __TO_UNDISCLOSED 0.0000 0.0000 1
T T_DATE_IN_FUTURE_96_Q 0.0000 0.0000 1
T __AXB_XM_OL_326A6 0.0000 0.0000 1
T __VBOUNCE_NAVFAIL 0.0000 0.0000 1
T __VBOUNCE_UNDELIV 0.0000 0.0000 1
T __VBOUNCE_EMAIL_REJ 0.0000 0.0000 1
T __VBOUNCE_GWAVA2 0.0000 0.0000 1
T __FROM_VEGAS 0.0000 0.0000 1
T __VBOUNCE_REJECTED 0.0000 0.0000 1
T __CRBOUNCE_GETRESP 0.0000 0.0000 1
T __MOZILLA_MUA 0.0000 0.0000 1
T __AXB_XM_OL_07794 0.0000 0.0000 1
T __AXB_MO_OL_7C3E5 0.0000 0.0000 1
T __AXB_XM_OL_A7B9C 0.0000 0.0000 1
T __AXB_XM_OL_79A9A 0.0000 0.0000 1
T D_SENT_BY_DEBCONF 0.0000 0.0000 1
T DATE_IN_FUTURE_06_12 0.0000 0.0000 1

--
John Evans

KMcGrail at PCCC

Aug 16, 2012, 6:13 AM

Post #16 of 17 (751 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On 8/15/2012 6:08 PM, John Evans wrote:
> I added the patch and it hung in the same place. The 'spamassassin -D
> -t < bad' command eventually went through after a LONG timeout. I
> didn't capture the results of the SA command (forgot to redirect
> output), but the patch to substr(X, 0, 30000) didn't seem to help any.
> Could be that 30,000 is too long? That delves deep into the
> attachment, and I'm wondering if the top-end of the attachment (within
> that 30k range) has content that triggers a regex that doesn't like
> what it sees?
>
> Just throwing some ideas out there.
>
> Thoughts?
>
Henrik wrote the patch which I have not reviewed (or don't remember
reviewing) but as noted, we are flying a bit blind. We are guessing the
issue is a wrong MIME type in the container of the email.

I could argue such a malformed message is a danger to any system and you
should use glue to discard the message.

But without seeing the message, I really can't expend much time on this
shotgun approach.

I recommend you ask the sender if it's ok to send the email to
private [at] spamassassin so at least the PMC members can look at it.

Regards,
KAM

jhardin at impsec

Aug 16, 2012, 6:29 AM

Post #17 of 17 (747 views)
Permalink

Re: SpamAssassin Hanging on RTF Attachments [In reply to]

On Thu, 16 Aug 2012, Kevin A. McGrail wrote:

> On 8/15/2012 6:08 PM, John Evans wrote:
>> I added the patch and it hung in the same place. The 'spamassassin -D -t <
>> bad' command eventually went through after a LONG timeout. I didn't
>> capture the results of the SA command (forgot to redirect output), but the
>> patch to substr(X, 0, 30000) didn't seem to help any. Could be that 30,000
>> is too long? That delves deep into the attachment, and I'm wondering if
>> the top-end of the attachment (within that 30k range) has content that
>> triggers a regex that doesn't like what it sees?
>>
>> Just throwing some ideas out there.
>>
>> Thoughts?
>>
> Henrik wrote the patch which I have not reviewed (or don't remember
> reviewing) but as noted, we are flying a bit blind. We are guessing the
> issue is a wrong MIME type in the container of the email.
>
> I could argue such a malformed message is a danger to any system and you
> should use glue to discard the message.
>
> But without seeing the message, I really can't expend much time on this
> shotgun approach.
>
> I recommend you ask the sender if it's ok to send the email to
> private [at] spamassassin so at least the PMC members can look at it.

...or see if the sender can compose and email a RTF contract with similar
but invented details. If that triggers the bug then it would be easier to
provide that as evidence.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Men by their constitutions are naturally divided in to two parties:
1. Those who fear and distrust the people and wish to draw all
powers from them into the hands of the higher classes. 2. Those who
identify themselves with the people, have confidence in them,
cherish and consider them as the most honest and safe, although not
the most wise, depository of the public interests.
-- Thomas Jefferson
-----------------------------------------------------------------------
8 days until the 1933rd anniversary of the destruction of Pompeii

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads