Re: getting tons of SPAM

2014-06-27 Thread Matus UHLAR - fantomas
On 06/26/2014 04:23 PM, motty cruz wrote: as you can see, looks like Amavisd did not scan, spamassassing should have stop this email. yes, it really looked in the original mail that amavis did not scan it. The question is why it did not scan it. check the logs to see the reason - if amavis

Re: Funky HARP Spam

2014-06-27 Thread RW
On Thu, 26 Jun 2014 19:02:42 -0600 Philip Prindeville wrote: Since #x042C is outside the US-ASCII character set, this would be an encoding violation. It's not. In HTML #x042C is an ASCII representation of a unicode character. It represents a character within HTML, but as far as mime is

Re: getting tons of SPAM

2014-06-27 Thread motty cruz
Thank you, I can't figureout why spammy email get very little score, X-Quarantine-ID: 4QFxoaNchYOk X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header X-Spam-Flag: NO X-Spam-Score: 0.102 X-Spam-Level: X-Spam-Status: No,

Re: getting tons of SPAM

2014-06-27 Thread Matus UHLAR - fantomas
On 27.06.14 07:50, motty cruz wrote: I can't figureout why spammy email get very little score, X-Quarantine-ID: 4QFxoaNchYOk X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header This might explain much. seems that

Re: Funky HARP Spam

2014-06-27 Thread Philip Prindeville
On Jun 27, 2014, at 7:30 AM, RW rwmailli...@googlemail.com wrote: As I mentioned before, the real violation is in the previous mime section, which claims 7bit, but contains octets with the high-bit set. Yup. Just submitted a patch for this:

SOLVED: Re: Bayer Filter Not Working

2014-06-27 Thread Bruce Sackett
On Jun 25, 2014, at 8:45 AM, Matus UHLAR - fantomas uh...@fantomas.sk wrote: On Tue, 24 Jun 2014 15:42:22 -0700 Bruce Sackett wrote: I apologize, I’m sure it’s been covered, but I have not been successful finding results in searches on the web or through the history of the list. I get

SA rule to detect prior SA pass?

2014-06-27 Thread David B Funk
Looking at my mail streams I see evidence that spammers sometimes add faked SpamAssassin headers to their messages (I assume to try to trick recipients into thinking that the message has already been given a clean bill-of-health). I wrote a few test rules to look for these pre-existing X-Spam-

Re: SA rule to detect prior SA pass?

2014-06-27 Thread Jari Fredriksson
28.06.2014 04:43, David B Funk kirjoitti: Looking at my mail streams I see evidence that spammers sometimes add faked SpamAssassin headers to their messages (I assume to try to trick recipients into thinking that the message has already been given a clean bill-of-health). I wrote a few test

Re: SA rule to detect prior SA pass?

2014-06-27 Thread Jari Fredriksson
28.06.2014 05:47, Jari Fredriksson kirjoitti: 28.06.2014 04:43, David B Funk kirjoitti: Looking at my mail streams I see evidence that spammers sometimes add faked SpamAssassin headers to their messages (I assume to try to trick recipients into thinking that the message has already been given