Closed MXEH closed 2 years ago
Thank you for submitting the screeenshots. I have not seen this type of SpamAssassin header before. Could you please post the header you just sent as raw text? I would then try to update the header parsing expressions so that this variant is recognised and the detailed rules are displayed correctly.
First source
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=aspNetEmail=_75e2e48014514b86929a6e80bafeb356"
Precedence: bulk
List-Unsubscribe: <http://info.topdelivery.net.pl/appreg/panel/Redirect.aspx?link_id=CF1D6AAB-0078-4D9E-93DE-C9559163C1BF&mail_id=9f625b60-53d3-44a7-a5d4-6de805228f10&d=14A96185-339C-41B4-8E28-CB069D47DA14&cntct_id=WmAXexFzAVoMe11BOm5ARhYoFDQVd0NoUA0XKggWZnoWQkUu&p1=FBNFExdQBDNLWxYpa1trICl6ZXRddFkOBWkWbWULFQhLCCggHXRfdC1BEh4ZRXRKAVwNdmcAP2xsUXx0AAUYVxIYd0xuC0V4DA4EbBQ8VltnLVhVKH4sOGQZUBduCnRmS2Z8JmgrbjI5ZGVqH1REGnAcchd4GgRxCB52egl4ahlPVXhRL3wGZARbDl9Se30%3d&p2=R3tSeUBQU0deXBgIIkVuUl4yfFVafkViAjtmJDcBaAMfegoBAWExDERTfB0eI2QlLw0%2fIVRIPkgqESYxIiguARFPWhR4VhBlHhMQPxtKWgAQXk1YWChaS3RzBBF1WHRcWxUJBDxXaEZKFHA8HlMiExppe2NtFQ8BfAEE&site=aHR0cCUzYSUyZiUyZmluZm8udG9wZGVsaXZlcnkubmV0LnBsJTJmYXBwcmVnJTJmcGFuZWwlMmZSZWdpc3Rlck91dFBhZ2UuYXNweCUzZm1haWxfaWQlM2QlMjMlMjNtYWlsX2lkJTIzJTIzJTI2YW1wJTNiZCUzZDE0QTk2MTg1LTMzOUMtNDFCNC04RTI4LUNCMDY5RDQ3REExNA%3d%3d>
Feedback-ID: :51635:65841:net.pl
X-Sid: 20210909.135028.8599@topdelivery.net.pl
Message-ID: <14x65841.51635.1018684121@info.topdelivery.net.pl>
X-Spam-Subject: ***SPAM*** =?utf-8?B?8J+UtVBST01PQ0pBIDMwIHrFgiB6YSBjYcWCeSByb2sgdyBQbGF5ZXIg8J+UlCBTUFJBV0TFuSA+Pj4=?=
X-Spam-Status: Yes, score=21.2
X-Spam-Score: 212
X-Spam-Bar: +++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "*****",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: PROMOCJA 30 zĹ? za caĹ?y rok w Player Ostatne dni promocji!
30 zĹ? za caĹ?y rok w Player - zobacz nowoĹ?ci Kampania realizowana przez
Redgroup do bazy partnera Kampanie Online LTD, na zlecenie: TVN S.A. ul.
Wiertnicza 166 02-952 Warszawa, NIP: 951-00-57-883 R [...]
Content analysis details: (21.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
4.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL
blocklist
[URIs: topdelivery.net.pl]
5.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: topdelivery.net.pl]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image
area
0.5 KAM_REALLYHUGEIMGSRC RAW: Spam with image tags with ridiculously
huge http urls
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
5.0 KAM_VERY_BLACK_DBL Email that hits both URIBL Black and Spamhaus
DBL
X-Spam-Flag: YES
Another example, with more rules.
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-FEAS-AUTH-USER: Administrator@fortinet.ovh
X-Spam-Subject: ***SPAM*** I NEED YOUR SERIOUS ATTENTION.
X-Spam-Status: Yes, score=55.2
X-Spam-Score: 552
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "*****",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Dear Friend I am techinical consultant,tony maxwell by name,
I have a client .who made a fixed deposit of fund valued at USD$8,500,000.00
(Eight Million, Five Hundred Thousand United States Dollars) with a deposi
[...]
Content analysis details: (55.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[88.157.215.74 listed in psbl.surriel.com]
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
2.0 MILLION_USD BODY: Talks about millions of dollars
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
0.0 NSL_RCVD_FROM_USER Received from User
0.5 SUBJ_ALL_CAPS Subject is all capitals
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[88.157.215.74 listed in bl.score.senderscore.com]
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
[max_tony[at]aim.com]
1.0 MISSING_HEADERS Missing To: header
2.6 DEAR_FRIEND BODY: Dear Friend? That's not very dear!
1.3 HK_SCAM No description available.
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
2.0 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 LOTS_OF_MONEY Huge... sums of money
0.0 FROM_MISSP_USER From misspaced, from "User"
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
2.6 MSOE_MID_WRONG_CASE No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
10 KAM_BENEFICIARY Beneficiary scams
0.0 MONEY_FROM_MISSP Lots of money and misspaced From
2.5 KAM_NIGERIAN Nigerian Scam and Variants
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.5 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
2.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free
email?
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain
different freemails
2.5 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 T_MONEY_PERCENT X% of a lot of money for you
0.0 FROM_MISSP_EH_MATCH From misspaced, matches envelope
1.8 SPOOFED_FREEMAIL No description available.
2.5 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
1.9 SPOOFED_FREEM_REPTO Forged freemail sender with freemail
reply-to
0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider
3.0 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
X-Spam-Flag: YES
Sorry for the late response. I've managed to add support for the headers you provided. Some in-depth regex changes were necessary in order to parse the tables correctly.
The regex now parses not just the rule name, score and description, but also the specific reason this rule matched in SpamAssassin (e.g. [URIs: topdelivery.net.pl]
).
I'll do some more tests this weekend before publishing the new version through the Thunderbird store.
Spam detail parameters aren't read correctly. Reading starts with "Content preview", if the word in capital letters appears. Due to incorrect reading of rule names, more rules appear in the list with errors. The values aren't read at all and only 0 appear. Values aren't read and only 0 appear.
SpamAssassin: Version: 3.4.4 Thunderbird: Version: 78.14.0 (OS: Windows 7; ) Spam Score add-on: Version: 1.2.0