Re: problem with RX subjects

[JamesDR]

Sally K Scheer wrote:

As an end user who is receiving these spams despite a functioning SA installation, I sure hope you figure out how to get them stopped. Also the stock ones. I'll keep monitoring the list and pass on your solutions to our ISP. Thanks everyone. Sally Scheer

    ----- Original Message -----
    *From:* D Ivago <mailto:[EMAIL PROTECTED]>
    *To:* users@spamassassin.apache.org
    <mailto:users@spamassassin.apache.org>
    *Sent:* Monday, August 28, 2006 6:44 PM
    *Subject:* problem with RX subjects

    Hello,

    I'm running RH EL4 with SA 3.1.4 and postfix/procmail.

    Last week I moved that mailserver to a datacenter and I'm  not sure
    if it's related, but since then I get more spam then ever. The
    server is now connected with 1 NIC on a 192.168.*.* subnet and
    routed via a h/w firewall to the internet, but I don't think SA
    cares about the local IP's anyway?

    Alot of spam still gets properly filtered by SA but some spam
    manages to get in the inboxes. Mostely messages containing a subject
    wich starts like Re:RX.... and other subjects containint capital RX

    What is the best way to block these kind of spams? My score is 3,0
    atm but these spammails hardly get a core higher then 1

    I have pasted some more detailed info below from the headers (my
    IP's and adressess are scrambled for privacy purposes).

    Thanks for all suggestions!

    Ivago

<spam header snipped>


SA stopped it ;-)


--
Thanks,
JamesDR

I received (tho SA caught it) similar to this -- it was actually a "Hey this is a test spam message, if you got it expect more!" As far as the stock spams, suggest to your ISP some add on rule sets. I haven't seen a stock spam make it through yet. I also use Bayes, so you may want to look at that (for an ISP this may be difficult to setup and maintain, so their MMV.) Another thing to consider is using something like fetch mail to download your mail them pass through SA then pop it in a local box, that you download from. This would give you total control over the SA installation. I've never set this up, but I've heard a couple of people on the list mention it.

smime.p7s
Description: S/MIME Cryptographic Signature