SPam getting through....

Tue May 25 20:50:31 IST 2004

Rob,

Check out the Spamassassin Rules Emporium (SARE), http://www.rulesemporium.com/

The antidrug.cf might be a good set of rules to implement.  I use quite a few of these rules.  Usually to add them just download them then drop them in /etc/mail/spamassassin/ which is the same location as your local.cf file.  I use local.cf quite a bit to add my custom rules.

Thanks,
Chase

-----Original Message-----
From: Rob [mailto:rob at THEHOSTMASTERS.COM]
Sent: Tuesday, May 25, 2004 3:06 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] SPam getting through....

I just have these additions in the /etc/Mailscanner/spam.assassin.prefs file

#Jan 15 2003
#for all that habeas crap vigra email crap!
score HABEAS_SWE -3.0

#Jan 16 2003
#for those emails with random words in it....
describe UDES_BUY01 Another buy scam
full     UDES_BUY01 /Genierc and Sepur Viarga|Cilais or \(Spuer Vagira\)|Genierc Virgaa/i
score    UDES_BUY01 10

And i am using the bigevil file too...

Other than that , that's it....

Rob....

----- Original Message ----- 
From: Casanova, Chase <mailto:Chase.Casanova at rdu.com>  
To: MAILSCANNER at JISCMAIL.AC.UK 
Sent: Tuesday, May 25, 2004 1:09 PM
Subject: Re: SPam getting through....

Rob,

I don't think that ou have to worry too much about timeouts if that is all that you have for this month.  MailScanner should have put a Spamassassin Timeout message in the header had that been the case.  This one you're more likely dealing with a spamassassin rule problem or lack of a rule that would have caught this spam.  Are you using any rules outside of the ones that installed with spamassassin?

-Chase

-----Original Message-----
From: Rob [mailto:rob at THEHOSTMASTERS.COM]
Sent: Tuesday, May 25, 2004 12:49 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] SPam getting through....

Since May 23 I have 635 of the below....

May 25 12:38:01 mx3 MailScanner[22500]: SpamAssassin timed out and was killed, consecutive failure 1 of 20 
May 25 12:43:16 mx3 MailScanner[22495]: SpamAssassin timed out and was killed, consecutive failure 1 of 20

Anything I should be looking at..... I did notice some in the past , but since it always said 1 of 20 rather than 10 or so of 20 I did not pay too much attention to it... does this mean line in the log file that says this means that an email got through?

Thanks..

Rob....

----- Original Message ----- 
From: Damian Mendoza <mailto:damian at WORKGROUPSOLUTIONS.COM>  
To: MAILSCANNER at JISCMAIL.AC.UK 
Sent: Tuesday, May 25, 2004 12:00 PM
Subject: Re: SPam getting through....

look for spamassassin timed out messages in the log files

Damian

  _____  

From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Rob
Sent: Tuesday, May 25, 2004 8:56 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: SPam getting through....

I seem to be getting allot of spam in the last 2 weeks, here is an example of headers from a popular one... it seems like it was not even scanned for spam or that mailscanner did not see it as spam at all??

I am using SA 2.63 and MS 4.28.6-1

Any help appreciated....

Thanks...

Return-Path: < unoalia at clickforadate.com>
Received: from clickforadate.com ([222.65.41.83])
 by localhost.localdomain (8.12.11/8.12.5) with SMTP id i4P8klDQ013184;
 Tue, 25 May 2004 04:46:59 -0400
Message-ID: < 883e01c44248$5c25dbc0$38c986cf at unoalia>
From: "garrett lovato" < unoalia at clickforadate.com>
To: "adrian hurl" < candi at stupidguytalk.org>
Cc: "quinn alston" < rob at stupidguytalk.org>,
        "victor jacoby" < adult-jokes at stupidguytalk.org>
Subject: Ppbykdbg your prescripti0n source
Date: Tue, 25 May 2004 01:06:42 -1000
MIME-Version: 1.0
Content-Type: text/plain;
 charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
X-MailScanner-Information: Please contact info at thehostmasters.com for more info
X-MailScanner: Found to be clean
X-MailScanner-From: unoalia at clickforadate.com
X-UIDL: #,A"!RS)#!53("!>S+"!

hexdigtoint  nrl-mag  nesheiwa  

We are your your convenient, safe and private online source for FDA
a`p`p`roved pharmacy prescriptions. 

---------------------------------------------------------------------------
the rest was cut, no need to see crude...

-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html
-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send leave mailscanner to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/ and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20040525/6ca89e85/attachment.html