German Spam still getting through?

[Jeff Mills]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi all,
I still appear to be getting some of the German spam through MailScanner, even though I have the spamassassin rules in place.

May 20 11:15:30 proxy2 postfix/smtpd[27650]: 2D9E5357047: client=eth191.nsw.adsl.internode.on.net[150.101.196.190]
May 20 11:15:30 proxy2 postfix/cleanup[27868]: 2D9E5357047: message-id=<3512b9c1fd944f8b9f at ebanctrade.com>
May 20 11:15:30 proxy2 postfix/qmgr[22186]: 2D9E5357047: from=<nsw.rs at ebanctrade.com>, size=1352, nrcpt=2 (queue active)
May 20 11:15:30 proxy2 postfix/qmgr[22186]: 2D9E5357047: to=<user1 at domain.com>, relay=none, delay=0, status=deferred (delivery temporarily su$
May 20 11:15:30 proxy2 postfix/qmgr[22186]: 2D9E5357047: to=<user2 at domain.com>, relay=none, delay=0, status=deferred (delivery temporarily susp$
May 20 11:15:30 proxy2 postfix/smtpd[27650]: disconnect from eth191.nsw.adsl.internode.on.net[150.101.196.190]
May 20 11:15:32 proxy2 MailScanner[22332]: New Batch: Scanning 1 messages, 1766 bytes
May 20 11:15:32 proxy2 MailScanner[22332]: MCP Checks: Starting
May 20 11:15:32 proxy2 MailScanner[22332]: Spam Checks: Starting
May 20 11:15:43 proxy2 MailScanner[22332]: Virus and Content Scanning: Starting
May 20 11:15:44 proxy2 MailScanner[22332]: Requeue: 2D9E5357047.5197D to A61FC357058
May 20 11:15:44 proxy2 postfix/qmgr[22233]: A61FC357058: from=<nsw.rs at ebanctrade.com>, size=1544, nrcpt=2 (queue active)
May 20 11:15:44 proxy2 MailScanner[22332]: Uninfected: Delivered 1 messages
May 20 11:15:44 proxy2 postfix/smtp[28096]: A61FC357058: to=<user1 at domain.com>, relay=10.100.100.40[10.100.100.40], delay=14, status=sent (25$
May 20 11:15:44 proxy2 postfix/smtp[28096]: A61FC357058: to=<user2 at domain.com>, relay=10.100.100.40[10.100.100.40], delay=14, status=sent (250 $
May 20 11:15:44 proxy2 postfix/qmgr[22233]: A61FC357058: removed

The resulting email is below, and the spam assassin rules is as follows:

header PROLO_GSPAM23 Subject =~ /Tuerkei in die EU/i

I've had a few of these come through today with varying subject lines.
Its got me beat as to why some are getting through and some are caught.
After reading through some recent threads, I noticed I had put the rule file in /usr/share/spamassassin instead of /etc/spamassassin (which is where my local.cf is located), so I have moved it, but it does not explain why some are picked up and some are getting through.

proxy2 root # grep GSPAM /var/log/mail.log | wc -l
43


Any ideas?

Cheers,
Jeff



-----Original Message-----
From: nsw.rs at ebanctrade.com [mailto:nsw.rs at ebanctrade.com]
Sent: Friday, May 20, 2005 11:15 AM
To: server3129 at pocold.com.au
Subject: Tuerkei in die EU


GEWALTEXZESS:
http://www.spiegel.de/politik/ausland/0,1518,345203,00.html

Politiker zerreißt Menschenrechtsbericht:
http://www.spiegel.de/politik/ausland/0,1518,325983,00.html

Schily = Hitler
http://www.spiegel.de/politik/deutschland/0,1518,345929,00.html

Schily wehrt sich gegen Hitler-Vergleiche:
http://www.spiegel.de/politik/deutschland/0,1518,345749,00.html

Sie hat ja wie eine Deutsche gelebt:
http://www.spiegel.de/panorama/0,1518,342484,00.html

http://www.npd.de/npd_info/deutschland/2005/d0205-31.html

Parallelgesellschaften - Feind hoerte mit:
http://www.npd.de/npd_info/meldungen/2005/m0305-15.html

Sie war unerlaubt spazieren:
http://www.taz.de/pt/2004/11/25/a0143.nf/text

Tiere an Autobahn geschlachtet:
http://forum.gofeminin.de/forum/actu1/__f384_actu1-TuRKEI-NEIN-DANKE.html
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!