[Rspamd-Users] fuzzy denied (high score in gif)

[Alexander Moisseev]

On 31.10.18 13:54, Emanuel Gonzalez wrote:
> How can I access the full hash? the only thing I see in the Rspamd log is this:
> 
> 2018-10-31 07:47:49 #10856(normal) <702613>; task; rspamd_task_write_log: id: <5BD9884F.00002B.04288 at CCONTABLENVA>, qid: <1gHo2N-0002Wk-ER>, ip: 186.137.222.28, user: soledad at domain.com.ar, from: <soledad at domain.com.ar>, (default: F (no action): [15.79/nan] [FUZZY_DENIED(11.99){1:2462e1bc90:1.00:bin;},HTML_SHORT_LINK_IMG_1(2.00){},FROM_DN_EQ_ADDR(1.00){},MID_RHS_NOT_FQDN(0.50){},MANY_INVISIBLE_PARTS(0.20){3;},MIME_GOOD(-0.10){multipart/mixed;multipart/related;multipart/alternative;text/plain;},RCVD_NO_TLS_LAST(0.10){},ZERO_FONT(0.10){1;},ARC_NA(0.00){},ASN(0.00){asn:10318, ipnet:186.137.208.0/20, country:AR;},FROM_EQ_ENVFROM(0.00){},HAS_ATTACHMENT(0.00){},HAS_X_PRIO_THREE(0.00){3;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ONE(0.00){1;},RCVD_VIA_SMTP_AUTH(0.00){},TO_DN_ALL(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){},BAYES_HAM(-0.00){19.96%;},TO_DOM_EQ_FROM_DOM(0.00){}]), len: 95067, time: 1062.984ms real, 22.377ms virtual, dns req: 14, digest: <65ec109a1be9ae93a7be049a603897bb>, rcpts: <info at doma
>   in.com.ar>, mime_rcpts: <info at domain.com.ar>
> 
> As far as I could analyze, the hash corresponds to the image of a gif that several users are using when signing their emails.
> 

If you grep the log lines with the id <702613> you should find a "fuzzy_insert_result" line that contains the full hash starting with the hash part from the symbol options (2462e1bc90).