You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by David Mehler <da...@gmail.com> on 2015/01/22 07:47:14 UTC
getting repeated spam hits
Hello,
I'm running SA 3.4 and am getting several messages like both of these,
headers below, that are getting through. I've run sa-learn on my Spam
folder to train Sa, but still they're getting through. There are two
separate sets of full headers x-d out to avoid giving server
information, but revealing the spam stuff. If anyone has any
suggestions on how to tighten this I'd like to know.
Thanks.
Dave.
headers1:
Return-Path:
<ha...@work11.suddenaffair.rocks>
Delivered-To:
xxx
Received:
from localhost (localhost [127.0.0.1]) by xxx (Postfix) with ESMTP id
82E925E628 for <xxx>; Thu, 22 Jan 2015 00:09:36 -0500 (EST)
X-Virus-Scanned:
amavisd-new at xxx
X-Spam-Flag:
NO
X-Spam-Score:
-0.009
X-Spam-Level:
X-Spam-Status:
No, score=-0.009 tagged_above=-999 required=1.2
tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
autolearn_force=no
Received:
from mail.xxx.com ([127.0.0.1]) by localhost (mail.xxx.com
[127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3As4JmZP4I6c for
<xx...@xxx.com>; Thu, 22 Jan 2015 00:09:35 -0500 (EST)
Received-SPF:
None (no SPF record) identity=mailfrom; client-ip=104.140.56.120;
helo=work11.suddenaffair.rocks;
envelope-from=haveaflingw@work11.suddenaffair.rocks;
receiver=xxx@xxx.com
Received:
from work11.suddenaffair.rocks (work11.suddenaffair.rocks
[104.140.56.120]) by mail.xxx.com (Postfix) with ESMTP id 509715E252
for <xx...@xxx.com>; Thu, 22 Jan 2015 00:09:33 -0500 (EST)
Date:
Wed, 21 Jan 2015 22:10:43 -0700
Mime-Version:
1.0
From:
Have a Fling <ha...@work11.suddenaffair.rocks>
To:
Recipient <xx...@xxx.com>
Mod-Ishly:
1354871717862081
Content-Type:
text/plain
Subject:
Re: Fulfill Your Fantasy - Have a Fling. Trial Membership expires 1-22-15.
Under-Lid:
12d433f06e13926c4b3b350868dcfbd9
Egg-Plant:
1354871712d433f06e13926c4b3b350868dcfbd9
Message-ID:
<17...@work11.suddenaffair.rocks>
Flags:
\Seen
headers2:
Return-Path:
<op...@work05.netlowerhome.rocks>
Delivered-To:
xxx@xxx.com
Received:
from localhost (localhost [127.0.0.1]) by mail.xxx.com (Postfix) with
ESMTP id 9819F5E628 for <xx...@xxx.com>; Wed, 21 Jan 2015 23:06:27 -0500
(EST)
X-Virus-Scanned:
amavisd-new at xxx.com
X-Spam-Flag:
NO
X-Spam-Score:
0.826
X-Spam-Level:
X-Spam-Status:
No, score=0.826 tagged_above=-999 required=1.2
tests=[HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.1,
MPART_ALT_DIFF=0.724, T_REMOTE_IMAGE=0.01, T_RP_MATCHES_RCVD=-0.01,
URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received:
from mail.xxx.com ([127.0.0.1]) by localhost (mail.xxx.com
[127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eYTmSlXSebkA for
<xx...@xxx.com>; Wed, 21 Jan 2015 23:06:26 -0500 (EST)
Received-SPF:
None (no SPF record) identity=mailfrom; client-ip=104.140.56.114;
helo=work05.netlowerhome.rocks;
envelope-from=oprahsnewbody@work05.netlowerhome.rocks;
receiver=xxx@xxx.com
Received:
from work05.netlowerhome.rocks (work05.netlowerhome.rocks
[104.140.56.114]) by mail.xxx.com (Postfix) with ESMTP id 435CC5E252
for <xx...@xxx.com>; Wed, 21 Jan 2015 23:05:56 -0500 (EST)
Date:
Wed, 21 Jan 2015 21:09:34 -0700
Subject:
Re: Oprah is down 4-dress-sizes - You can be too.
Ceru-Lean:
2047072610080931
From:
Oprah's-New-Body <op...@work05.netlowerhome.rocks>
Mime-Version:
1.0
Message-ID:
<10...@work05.netlowerhome.rocks>
Mis-Usage:
12d433f06e13926c4b3b350868dcfbd910080931
Polo-Nize:
12d433f06e13926c4b3b350868dcfbd9
To:
<xx...@xxx.com>
Content-Type:
multipart/alternative; boundary="10080931"
Flags:
\Seen
RE: getting repeated spam hits
Posted by Marieke Janssen <mj...@myguard.nl>.
>I'm running SA 3.4 and am getting several messages like both of these,
headers below, that are getting through. I've run sa-learn on my Spam folder
to train Sa, but still they're getting through. There are two separate sets
of full headers x-d out to avoid giving server information, but revealing
the spam stuff. If anyone has any suggestions on how to tighten this I'd
like to know.
> X-Spam-Status: No, score=-0.009 tagged_above=-999 required=1.2
tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
autolearn_force=no
>No, score=0.826 tagged_above=-999 required=1.2
tests=[HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.1, MPART_ALT_DIFF=0.724,
T_REMOTE_IMAGE=0.01, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001]
autolearn=no autolearn_force=no
I don't see BAYES_XX in your tests, look likes bayes isn't being used. Make
sure you train at least 200 ham and 200 spam, otherwise bayes does not kick
in.
That being said, I don't see many rules at all. And a required=1.2 is very
low. Did you ever run sa-update and restart amavis? Make sure the new rules
are being used.
And take a look at the URIBL_BLOCKED, one of your rbl lists is blocked. You
are doing too many queries (>100k) or you are using a (public) nameserver
which does.
You can also do a lint, spamassassin -D --lint and check if there are any
errors or not installed dependencies.
/MJ
Re: getting repeated spam hits
Posted by John Hardin <jh...@impsec.org>.
On Thu, 22 Jan 2015, David Mehler wrote:
> I've run sa-learn on my Spam folder to train Sa, but still they're
> getting through.
> X-Spam-Status:
> No, score=-0.009 tagged_above=-999 required=1.2
> tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
> autolearn_force=no
>
> X-Spam-Status:
> No, score=0.826 tagged_above=-999 required=1.2
> tests=[HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.1,
> MPART_ALT_DIFF=0.724, T_REMOTE_IMAGE=0.01, T_RP_MATCHES_RCVD=-0.01,
> URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
No BAYES rule hits at all. Either you haven't trained enough spam *and
ham* for Bayes to start scoring messages, or Amavis is using a different
Bayes database than the one you are training.
As others have noted, you should set up a local recursing (not forwarding)
DNS server for your mail system to use, so that you avoid URIBL_BLOCKED.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If guns kill people, then...
-- pencils miss spel words.
-- cars make people drive drunk.
-- spoons make people fat.
-----------------------------------------------------------------------
Tomorrow: John Moses Browning's 160th Birthday
Re: getting repeated spam hits
Posted by Thom Miller <th...@cagroups.com>.
On 01/22/2015 09:31 AM, John Hardin wrote:
> On Thu, 22 Jan 2015, Thom Miller wrote:
>
>> On 01/21/2015 11:47 PM, David Mehler wrote:
>>> X-Spam-Status:
>>> No, score=-0.009 tagged_above=-999 required=1.2
>>> tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
>>> autolearn_force=no
>>
>> Both of your tests show URIBL_BLOCKED. It appears you are not able to
>> contact a particular DNSBL server (because you're blocked).
>
> Nit: URI BL server, not DNS BL server.
>
Oops, you're absolutely right :)
Either way, using a local, non forwarding, DNS server should do the trick.
-Thom
Re: getting repeated spam hits
Posted by John Hardin <jh...@impsec.org>.
On Thu, 22 Jan 2015, Thom Miller wrote:
> On 01/21/2015 11:47 PM, David Mehler wrote:
>> X-Spam-Status:
>> No, score=-0.009 tagged_above=-999 required=1.2
>> tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
>> autolearn_force=no
>
> Both of your tests show URIBL_BLOCKED. It appears you are not able to
> contact a particular DNSBL server (because you're blocked).
Nit: URI BL server, not DNS BL server.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If guns kill people, then...
-- pencils miss spel words.
-- cars make people drive drunk.
-- spoons make people fat.
-----------------------------------------------------------------------
Tomorrow: John Moses Browning's 160th Birthday
Re: getting repeated spam hits
Posted by Thom Miller <th...@cagroups.com>.
On 01/21/2015 11:47 PM, David Mehler wrote:
> Hello,
>
> I'm running SA 3.4 and am getting several messages like both of these,
> headers below, that are getting through. I've run sa-learn on my Spam
> folder to train Sa, but still they're getting through. There are two
> separate sets of full headers x-d out to avoid giving server
> information, but revealing the spam stuff. If anyone has any
> suggestions on how to tighten this I'd like to know.
> ...
> X-Spam-Status:
> No, score=-0.009 tagged_above=-999 required=1.2
> tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
> autolearn_force=no
Both of your tests show URIBL_BLOCKED. It appears you are not able to
contact a particular DNSBL server (because you're blocked).
Unless you run a large email system and send a lot of requests to the
server, you are most likely blocked due to using a common nameserver
(such as your ISPs nameserver). You may wish to run your own caching
nameserver to avoid this problem (if this is why you're blocked).
> Received:
> from work11.suddenaffair.rocks (work11.suddenaffair.rocks
> [104.140.56.120]) by mail.xxx.com (Postfix) with ESMTP id 509715E252
> for <xx...@xxx.com>; Thu, 22 Jan 2015 00:09:33 -0500 (EST)
>
I just checked this IP address (104.140.56.120) and it's listed in at
least 7 blocklists.
You'll need to find out why you're "blocked". Once you can contact the
DNSBL server(s), you should be able to catch spam like these two.
-Thom
Re: getting repeated spam hits
Posted by Benny Pedersen <me...@junc.eu>.
On 22. jan. 2015 12.22.52 Axb <ax...@gmail.com> wrote:
> On 01/22/2015 12:16 PM, Benny Pedersen wrote:
> >
> > tflags missing noautolearn for uribl_blocked
>
> wrong:
>
> #URIBL BLOCK RULES - Bit 1 means your DNS has been blocked and this rule
> should be triggered to notify you.
> urirhssub URIBL_BLOCKED multi.uribl.com. A 1
> body URIBL_BLOCKED eval:check_uridnsbl('URIBL_BLOCKED')
> describe URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL
> was blocked. See
> http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more
> information.
> tflags URIBL_BLOCKED net noautolearn
> reuse URIBL_BLOCKED
now we all know :)
doh reuse
Re: getting repeated spam hits
Posted by Axb <ax...@gmail.com>.
On 01/22/2015 12:16 PM, Benny Pedersen wrote:
>
> tflags missing noautolearn for uribl_blocked
wrong:
#URIBL BLOCK RULES - Bit 1 means your DNS has been blocked and this rule
should be triggered to notify you.
urirhssub URIBL_BLOCKED multi.uribl.com. A 1
body URIBL_BLOCKED eval:check_uridnsbl('URIBL_BLOCKED')
describe URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL
was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more
information.
tflags URIBL_BLOCKED net noautolearn
reuse URIBL_BLOCKED
Re: getting repeated spam hits
Posted by Benny Pedersen <me...@junc.eu>.
On 22. jan. 2015 07.49.21 David Mehler <da...@gmail.com> wrote:
> X-Spam-Status:
> No, score=-0.009 tagged_above=-999 required=1.2
> tests=[T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham
> autolearn_force=no
tflags missing noautolearn for uribl_blocked
to resolve it more install bind9 without any forwarders, and change
resolv.conf to nameserver 127.0.0.1
set named.conf to bind only for the same ip
then test, dig ipv4.google.com
if it says 127.0.0.1 in the nameserver field, you have solved it all
possible add rocks to blacklist_uri_hosts
check spamassassin --lint