[Mimedefang] spamassassin vs mimedefang/spamassassin - different results

Michael H Moran mhm at austin.ibm.com
Tue May 6 15:01:02 EDT 2003


Lately, I've been getting 2-3 spams a day through the
mimedefang/spamassassin combination that don't get tagged as spam.
                                                                                
However, if I run "spamassassin -D -t < msg" from the cmdline, they
are appropriately identified as spam.

Yes, I'm trying to run razor, but not sure it is properly configure. 
However, I don't see any razor matches when checked from the cmdline.

Spamassasin reports the following tests:

        BAYES_60,FROM_ENDS_IN_NUMS,MAILTO_TO_SPAM_ADDR,
        MSG_ID_ADDED_BY_MTA_3,NO_REAL_NAME,UPPERCASE_75_100,
        USER_AGENT_IMP,US_DOLLARS

Mimedefang    2.31
Spamassassin  2.53

Anyone have any thoughts ?  A sample is attached.
                                                                                
Mike

-------------- next part --------------
Received: from localhost (localhost.localdomain [127.0.0.1])
	by cac.austin.ibm.com (8.12.8/8.12.8) with ESMTP id h46EL8Pg022879
	for <mhm at localhost>; Tue, 6 May 2003 09:21:24 -0500
Received: from popmail.xxxxx.ibm.com []
	by localhost with POP3 (fetchmail-6.2.0)
	for mhm at localhost (single-drop); Tue, 06 May 2003 09:21:24 -0500 (CDT)
Received: from austin.ibm.com (netmail2.xxxxx.ibm.com []) by popmail.xxxxxx.ibm.com (AIX4.3/8.9.3p2/8.7-client1.01) with ESMTP id JAA24960 for <mhm at popmail.xxxxx.ibm.com>; Tue, 6 May 2003 09:18:28 -0500
From: david925 at portugalmail.com
Received: from northrelay03.xxxxx.ibm.com (northrelay03.xxxxx.ibm.com [])
	by xxxxx.ibm.com (8.12.9/8.12.9) with ESMTP id h46EIR9Y035582
	for <mhm at xxxxx.ibm.com>; Tue, 6 May 2003 09:18:28 -0500
Received: from d01as01.xxxxx.ibm.com (d01av01.xxxxx.ibm.com [])
	by northrelay03.xxxxx.ibm.com (8.12.9/NCO/VER6.5) with ESMTP id h46EIQvH026828
	for <mhm at austin.ibm.com>; Tue, 6 May 2003 10:18:26 -0400
Received: from e1.ny.us.ibm.com ([]) by d01as01.xxxxx.ibm.com with Microsoft SMTPSVC(5.0.2195.5329);
	 Tue, 6 May 2003 10:18:26 -0400
Received: from galadriel.portugalmail.pt ([195.245.179.73])
	by e1.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h46EHodR175896
	for <mhm at austin.ibm.com>; Tue, 6 May 2003 10:17:54 -0400
Received: by galadriel.portugalmail.pt (Postfix on SuSE Linux 7.3 (i386), from userid 65534)
	id D1AFB3B3DA; Tue,  6 May 2003 14:45:38 +0100 (WEST)
Received: from 62.17.242.2 ( [62.17.242.2])
	as user david925 at portugalmail.com@imap.portugalmail.pt by webmail.portugalmail.pt with HTTP;
	Tue,  6 May 2003 14:45:37 +0100
Message-ID: <1052228737.3eb7bc81aa638 at webmail.portugalmail.pt>
Date: Tue,  6 May 2003 14:45:37 +0100
To: david925 at portugalmail.com
Subject: [ProbableSpam] Regards...
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
User-Agent: Internet Messaging Program (IMP) 3.0
X-Originating-IP: 62.17.242.2
Content-Transfer-Encoding: 8bit            
X-MIME-Autoconverted: from 8bit to quoted-printable by e1.ny.us.ibm.com id h46EHodR175896
X-OriginalArrivalTime: 06 May 2003 14:18:26.0895 (UTC) FILETIME=[5C4E75F0:01C313DA]
X-Scanned-By: MIMEDefang 2.31 ( my scan signature )

FROM: THE DESK OF DR DAVID OKOH
DIRECTOR, CREDIT CONTROL UNIT,
UNION BANK OF NIGERIA PLC.
FAX: 234-1-7598709
PRIVATE EMAIL:david925 at portugalmail.com
STRICTLY CONFIDENTIAL

Good Day,

I KNOW THIS PROPOSAL WILL COME TO YOU AS A SURPRISE EXPECIALLY WHEN 
YOU DO NOT KNOW THE WRITER,CONDSIDERING THE HUGE SUM OF MONEY 
INVOLVED WHICH COULD MAKE ANY APPREHENSIVE. LET ME START BY 
INTRODUCING MYSELF TO YOU, I AM DR DAVID OKOH, DIRECTOR CREDIT 
CONTROL UNIT, UNION BANK OF NIGERIA PLC. LAGOS. I SAW YOUR CONTACT 
DURING MY PRIVATE SEARCH AT THE INFORMATION CENTRE HERE IN NIGERIA 
CHAMBER OF COMMENCE AND INDUSTRY AND I WANT TO BELIEVE THAT YOU 
WILL BE VERY HONEST, COMMITTED AND CAPABLE OF ASSISTING IN THIS 
BUSINESS VENTURE.

FIRSTLY, LET ME EXPLAIN THE SOURCE OF THIS FUNDS AND WHAT YOU ARE 
EXPECTED TO DO. A FORIGNER LATE ENGINEER THEOPHILUS BAKER, AN OIL 
MERCHANT/CONTRACTOR WITH THE GOVERNMENT OF NIGERIA, UNTIL HIS 
DE ATH,OVER A YEAR AGO, WAS A VICTIM OF A KENYA AIRWAYS: BUS (A310-
300) FLIGHT KQ430 PLANE CRASH. THE DECEASED, ENGNIEER THEOPILIUS 
BAKER, BANKED WITH US AND HAS A CLOSING BALANCE AS A JULY 2000 WORTH 
$10.5M (TEN MILLION FIVE HUNDRED THOSAND USD). WHICH MY BANK, NOW 
EXPECTES A NEXT-OF-KIN TO CLAIM AS THE BENEFICIARY OF THE FUNDS, 
EFFORTS HAS BEEN MADE BY UNION BANK OF NIGERIA TO GET IN TOUCH WITH 
THE BAKER\'S FAMILY OR RELATIVE BUT TO NO SUCCESS.

BASED ON THE PERCEIVED POSSIBILITY OF NOT BEING ABLE TO LOCATE 
ENGNIEER THEOPILUS\'S NEXT-OF-KIN, THE MANAGEMENT UNDER THE 
INFLUENCE OF OUR CHAIRMAN AND THE BOARD OF DIRECTORS ARE MAKING 
ARRANGEMENTS FOR THE FUNDS TO BE DECLARED UNCLAIMED AND CHANNELED 
TO AN UNKNOWN ACCOUNT.IT IS BASED ON THIS THAT WE HAVE CONTACTED 
YOU TO STAND AS THE NEXT-OF-KIN OF LATE ENGR. THEOPILUS BAKER SO THAT 
THE FUNDS WILL BE RELEASED AND PAID INTO YOUR ACCOUNT AS THE 
BENEFICIARY AND THE NEXT-OF-KIN T O THE DECEASED.

ALL DOCUMENTS, AND PROOF TO ENABLE YOU GET THE FUNDS HAVE BEEN 
CAREFULLY WORKED OUT AS WE HAVE SECURED FROM THE DIFFERENT 
OFFICES CONCERNED FOR THE SMOOTH TRANSFER OF THE FUND TO YOUR 
NOMINATED ACCOUNT.IT HAS BEEN AGREED THAT THE OWNER OF THE 
ACCOUNT WILL BE COMPENSATED WITH 20% OF THE REMITTED FUNDS, WHILE 
WE KEEP 75% AND 5% WILL BE SET ASIDE TO OFFSET EXPENSES BOTH LOCALLY 
AND INTERNATIONAL.

IF THIS PROPOSAL SATISFIES YOU, PLEASE REACH ME THROUGH MY DIRECT 
FAX (234-1-7598709)FOR MORE INFORMATION. I AWAITS YOUR URGENT 
RESPONSE, ALL THE BEST AND GOD BLESS YOU.

YOURS FAITHFULLY,
DR DAVID OKOH
__________________________________________________________
O email preferido dos portugueses agora com 
100Mb de espa?o e acesso gratuito ? Internet
http://www.portugalmail.com/gold/


More information about the MIMEDefang mailing list