Spam getting worse?

[randynov]

One of the options for SpamAssassin is that we can write our own rules. I've tried doing so, but they have no effect. All other customizations to my user_prefs file work correctly and the file has no syntactical errors. Even very basic tests that just mark the message with a header do not work. Is there another server setting that needs to be set?

Thanks

header RN_STOCK        SUBJECT =~ /st[o0]ck/i
score   RN_STOCK        1.5
describe  RN_STOCK        Header contains stocks

[sixfortyfive]

Thought I'd share a filter I'm using that seems to help. It caught 55 messages just this weekend.

From your cpanel go to the mail filters. Add a filter.

SpamAssassin Spam Header

That contains: DRUGS_ERECTILE

You can leave "Discard" there if you want to trust that all mail flagged with this is not real mail. I chose to create a folder on my mail account, and have all this mail forwarded to that folder. This way, I can take a quick look over it before deleting it.

Destination:
/home/[AccountUsername]/mail/[domain]/[email account]/[folder name]
Example:
/home/bob/mail/bob.com/bobby/spam

This will forward all mail to the account login "bob" with the mail account of bobby@bob.com into the "spam" folder.

You can add other SpamAssassin header tags too, but I have not yet seen any that I can trust as much as this one. In my case I get a chance to look over the messages. An at least they don't distract me by showing up in my Inbox all day.

If you are currently using the SpamAssassin Spam box, then you might want to create a unique folder just for this filter to keep these messages separate. Totally up to you.

[jlarson]

Something can't be right...

I know little of how Spam Assassin works, but the recent upsurge I'm seeing along with everyone else does not look like a shrewd move by spammers. For one, it was too sudden--it was working just fine, then one day the volume exploded. Secondly, many messages are getting through with blatantly vulgar/obscene words/phrases that are not even disguised. They'll score at 4.0-4.5, but I have my cutoff set at 5 and hate to go lower--I've lost legitimate messages that way. Why might terms that should trigger rejection be scoring so low?

[sixfortyfive]

I recently asked them to upgrade SpamAssassin to 3.0.2 on cpanel31. That solved all our problems! Went from 40 spam messages a day to 1 a week, all with the same SA settings.

[Andy]

where can we check for the version of SA on the server?

[Buddha]

where can we check for the version of SA on the server?

Check your email, there should be an "X-Spam-Checker-Version" header. Well if your using SA anyway...

[Andy]

thats where i was looking. I didnt see it. I must be missing it......


OK found it..had to click to expand full headers

X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on cpanel08.gzo.com

[Ben]

It was the upgrade from 3.0.1 to 3.0.2 in January that marked the significant increase in spam for me. It's still out of control!

Ben

[mikesm]

Interesting. My mail headers say SA 3.0.1 (I'm on cpanel35), and I saw the sam increase in spam you did. So I don't think it's SA version related, at least in the 3.0 line...

Thanks,
mike

[Roman]

Is there anyway to block a senders IP address? All the SPAM I recieve comes from

Received: from [216.43.223.229] (helo=kyapadhc.com)
by cpanel15.gzo.com with smtp (Exim 4.43)

It's always the same IP with different helo's, different From addresses, etc. Spam Assassin sends them right through every time

X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on cpanel15.gzo.com
X-Spam-Level: *
X-Spam-Status: No, score=1.6 required=5.0 tests=INVALID_DATE,NO_REAL_NAME,
PRIORITY_NO_NAME autolearn=no version=3.0.2

I have even been saving the various messages in a SPAM folder and teaching Spam Assassin to mark them as SPAM by using the command

sa-learn --showdots --mbox --spam ~/username/mail/domain.com/mailusername/spam

So far, it's not increasing the detection rate by much.