more crazy spam

Discussion in 'General' started by crypted, Aug 30, 2010.

  1. crypted

    crypted Member

    Allirght, we have been inundated with an unreal amount of spam on the server lately.

    So, I added the black URIBL to Spam Assassin. Still didn't help.

    So, two questions:

    1) I want to block specific @domain.tld from all email domains. Under Global Filters -> Postfix Blacklist do I select "Senders" to disable those domains from sending email to mailboxes? Or, no? In otherwords, I want to add a global filter to block @nutsviagrasex.ch from spamming any email address. Would I add @nutsviagrasex.ch as "sender" in that filter?

    2) I've seen mention on the tutorials about DKIM. Would that be helpful?
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Please post the email headers of spam emails that had come trough. Also which scores do you use in the spamfilter policy?
     
  3. crypted

    crypted Member

    Okay. I have been receiving about 20 spam emails a day on average to my mailbox for the past three weeks. I went years without a single spam email getting to the Inbox on ISPCONFIG + Spam Assassin.

    Currently, my mailbox uses ISPConfig's default settings for "NORMAL" spamfilter. It appears the default numbers are: tag = 1, tag2 = 4.5, kill = 50, dns = 0, quarantine = 0. I wonder what can be adjusted without throwing legit emails into the Junk folder. My Junk folder grows by about 140 emails a day...crazy spam!

    Headers for this mornings spam area s follows:
    Code:
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by personalwebserver.tld (Postfix) with ESMTP id 9AE1D5416E
    	for <[email protected]>; Tue, 31 Aug 2010 06:19:15 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.derekgordon.com
    Received: from personalwebserver.tld ([127.0.0.1])
    	by localhost (personalwebserver.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id lj5xh4+WH1rG for <[email protected]>;
    	Tue, 31 Aug 2010 06:19:14 -0400 (EDT)
    Received: from automatedwealthkit.com (automatedwealthkit.com [173.244.178.212])
    	by personalwebserver.tld (Postfix) with SMTP id 2F4DB5416A
    	for <[email protected]>; Tue, 31 Aug 2010 06:19:14 -0400 (EDT)
    DKIM-Signature: v=1;
    	a=rsa-sha1; c=relaxed/relaxed; d=affiliateincomeadvantage.com;
    	s=gamma; t=1283249953; bh=tTGnhmF/h3uRT2xFtfbGQmvJL/U=; h=To:From;
    	b=BLK4eyibxrqVdbY7AqLGbf3BLekcb0bj8+nwCqMmTuHEKE6qvC/ABnZ5qjR40MVGE
    	 oorPegYQzkKrqWL8qZtwoQ5ExJj3mCKsJZ9a/NuP5o1rTIDI/2tW9/d1asZQYzN
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    	s=gamma; d=affiliateincomeadvantage.com;
    	h=To:From;
    	b=sUH4kw1ftqEVUnBhxmy1FheNz3yfZ6BmpMUSvqDUBCExeejaFTbklRMQQ95KET4n3
    	4Pw0UugjDiVdjPIv7vV1I8aXy1vWYtb8+wmm3COO6uMRXLy4WzFJtv8lFEgsRoe;
    To: [email protected]
    From: "My AuraVie" <[email protected]>
    Subject: Save over $250 on top of the line AuraVie 3 in 1 Skincare
    Date: 31 Aug 2010 06:19:13 -0400
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=windows-1252
    Content-Transfer-Encoding: quoted-printable
    
    
    
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by personalwebserver.tld (Postfix) with ESMTP id 0BF835416E
    	for <[email protected]>; Tue, 31 Aug 2010 06:08:19 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.derekgordon.com
    Received: from personalwebserver.tld ([127.0.0.1])
    	by localhost (personalwebserver.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id pQ3z2ba9ySGK for <[email protected]>;
    	Tue, 31 Aug 2010 06:08:16 -0400 (EDT)
    Received: from clickaffiliateincome.com (clickaffiliateincome.com [66.207.161.156])
    	by personalwebserver.tld (Postfix) with SMTP id 86FC85416A
    	for <[email protected]>; Tue, 31 Aug 2010 06:08:16 -0400 (EDT)
    DKIM-Signature: v=1;
    	a=rsa-sha1; c=relaxed/relaxed; d=clickaffiliateincome.com; s=gamma;
    	t=1283249296; bh=EPnKqVsLlSv9DdiBghgezgo2w5k=; h=To:From;
    	b=Jha9cB741nXRon7nxvIVm2TwMwxTyqZbsMaHkKlmXqbu1SzmKY1Hz8OIn3zH55p2L
    	 QCHPaAS1pegNEjfXALefj1KQe6mEx8IcVOqmrxIZtfD7VYWeEeNrlUslDtUezoC
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    	s=gamma; d=clickaffiliateincome.com;
    	h=To:From;
    	b=CCGcua5eXuUJLq9PNhIGnMlnw1pYvofODp/V9phxEsVecoq6ixrng3n+Ii+3EmkxE
    	aGemY0f1EWz9PjbYsn9Qikep5miYjZLP2fFg8lusBjl83sQWI5qHK8I4/rD3LQC;
    To: [email protected]
    From: "Tax Solutions" <[email protected]>
    Subject: Settle your tax debt for fractions of whats owed
    Date: 31 Aug 2010 06:08:16 -0400
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=windows-1252
    Content-Transfer-Encoding: quoted-printable
    
    
    
    
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by personalwebserver.tld (Postfix) with ESMTP id E16BC5416E
    	for <[email protected]>; Tue, 31 Aug 2010 03:28:39 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.derekgordon.com
    Received: from personalwebserver.tld ([127.0.0.1])
    	by localhost (personalwebserver.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id sahhjH1aBXZv for <[email protected]>;
    	Tue, 31 Aug 2010 03:28:39 -0400 (EDT)
    Received: from black-jackfaq.com (black-jackfaq.com [76.73.108.215])
    	by personalwebserver.tld (Postfix) with ESMTP id 17AEB5416A
    	for <[email protected]>; Tue, 31 Aug 2010 03:28:24 -0400 (EDT)
    From: "Jennifer Cox" <[email protected]>
    To: "derek" <[email protected]>
    Reply-To: [email protected]
    Date: Tue, 31 Aug 2010 07:28:26 +0000
    Subject: New bonus offer high roller heaven
    MIME-Version: 1.0
    List-Unsubscribe: <http://www3.black-jackfaq.com/0b02452e8b07f9c74e0401000/0000000000000/000/0/00.ZVSC>
    Content-Type: multipart/related;
    	boundary="_=aspNetEmail=_642a60b212244c86914b616ee36ce2b6"
    X-Mailer: aspNetEmail ver 3.12.656.1861
    X-MimeOLE: 944-ebe3a 43672.3916.1,309
    Message-ID: <[email protected]>
    
     
  4. Mark_NL

    Mark_NL Member

    You might want to set the "SPAM tag level" to -1000 so all the mails you receive, you are able to see the spamassassin results.
     
  5. crypted

    crypted Member

    Mark, where would I see a description of what all of those #'s mean?
     
  6. Mark_NL

    Mark_NL Member

    "#" ????

    ehm, you can set is in ispconfig .. email -> policy -> click your policy -> tab Tag-level -> "SPAM tag level" set to -1000 .. save, and wait 1 minute for the changes to be done. then chek your incoming mail.
     
  7. crypted

    crypted Member

    Right, I know where the PROFILE numbers are found in the panel. :)

    I'm asking what each category means for tweaking purposes:
    tag = 1, tag2 = 4.5, kill = 50, dns = 0, quarantine = 0

    I have edited to tag = 1 to tag = -1000.

    What else should be done?

    I think kill = 50 was the default as 5.0 in ISPCONFIG 2 wasn't it?

    I want to get this tweaked as best as possible to remove all of this new spam while at the same time not having a lot of false positives as missing important emails would be a bad deal.
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Post the header of spam emails that you received after changing the level.
     
  9. Turbanator

    Turbanator Member HowtoForge Supporter

    If it helps you, here are my settings...NOTE: very aggressive since this is a corporate server meant for business email only.

    SPAM tag level -100
    SPAM tag2 level 3.09
    SPAM kill level 10
    SPAM dsn cutoff level 0
    SPAM quarantine cutoff level 0
    SPAM modifies subject Yes
    SPAM subject tag .
    SPAM subject tag2 ***SPAM***

    You should also post some of your postfix settings to make sure you have some blocklists included...I think the setting to post is the

    smtpd_recipient_restrictions = xxxxx

    another note: It helps to Move spam into the Junk folders in webmail and tell spamassasin to learn from those you select as spam to train the engine.

    /usr/bin/sa-learn --spam /var/vmail/*/*/.Junk/*/*
     
  10. crypted

    crypted Member

    First, all I changed was tag level to -1000 and every email went to Junk all day. I was wondering why no one responded. Evidently, they did so. That was the only setting I altered.

    Postfix main.cf smtpd_recipient_restrictions shows:
    Code:
    smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination
    Also, I a few days ago I added URIBL to local.cf for Spam Assassin:
    Code:
    urirhssub       URIBL_BLACK  multi.uribl.com.        A   2
    body            URIBL_BLACK  eval:check_uridnsbl('URIBL_BLACK')
    describe        URIBL_BLACK  Contains an URL listed in the URIBL blacklist
    tflags          URIBL_BLACK  net       
    score           URIBL_BLACK  3.0
    
    Where can I find out what each setting is that Turbanator referred to? And their maximum and minimum values? That will be an assistance for playing around with them to tweak performance.


    SA-LEARN runs twice a day. Sucks because it will now learn a bunch of GOOD email.
     
  11. Turbanator

    Turbanator Member HowtoForge Supporter

    Those are amavisd-new settings I believe.
    Spam DSN cutoff level
    Amavis feature: spam_dsn_cutoff_level_maps
    Spam score at which not to generate delivery status notifications.

    Spam Quarantine Cutoff Level
    Amavis feature: spam_quarantine_cutoff_level_maps
    Score at which not to quarantine

    (I know..not much help).

    Here is my postfix smtpd setting I referred to with some rbl's added:

    smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination, reject_rbl_client zen.spamhaus.org,reject_rbl_client dul.dnsbl.sorbs.net,reject_rbl_client bl.spamcop.net,permit

    I don't know anything about the uribl, but now I'm interested in it...a thought, maybe change from multi to the black only or blakc and grey to see if it helps. Multi seems like it'll give false positives.
     
  12. crypted

    crypted Member

    Regarding the good emails today all being filtered out... Each score ranged from -3 to 0.5. However, they ended up in Junk. The only change I made to the NORMAL POLICY was tag level = -1000 as suggested.

    Code:
    X-Virus-Scanned: Debian amavisd-new at my.derekgordon.com
    X-Spam-Flag: NO
    X-Spam-Score: -2.307
    X-Spam-Level: 
    X-Spam-Status: No, score=-2.307 tagged_above=-1000 required=4.5
    	tests=[AWL=0.291, BAYES_00=-2.599, HTML_MESSAGE=0.001]
    
    When reviewing this, it seems that this should not have been filtered out.

    Why did all of those get marked as ***SPAM*** and filtered out?
     
  13. Turbanator

    Turbanator Member HowtoForge Supporter

    can you post a screenshot of each:
    - your policy screen levels (especially tag marking for the 1st subject level)
    - the user this went to and the different tabs (in case there is a strange custom rule somewhere)

    -what if you remove the uribl code and see what happens.
     
  14. crypted

    crypted Member

    URIBL was disabled.

    HOWTOFORGE notice regarding this last post you made went to Junk immediately.

    Code:
    X-Virus-Scanned: Debian amavisd-new at my.derekgordon.com
    X-Spam-Flag: NO
    X-Spam-Score: -2.55
    X-Spam-Level: 
    X-Spam-Status: No, score=-2.55 tagged_above=-50 required=4.95
    	tests=[AWL=0.049, BAYES_00=-2.599]
    
    SPAM tag level = -50
    SPAM tag2 level = 4.95
    SPAM kill level = 5
    SPAM dsn cutoff level = 0
    SPAM quarantine cutoff level = 0
    SPAM modifies subject = yes
    SPAM subject tag = ***SPAM***
    SPAM subject tag2 = (blank)

    All other pages for the PROFILE are the exact same as the Normal filter.
     
  15. Turbanator

    Turbanator Member HowtoForge Supporter

    compare your settings with mine in the pevious post. you shouldn't be tagging level 1, that shoul dbe blank. only tag level 2.

    SPAM subject tag
    SPAM subject tag2 ***SPAM***
     
  16. crypted

    crypted Member

    And that resolves the first problem!!!

    I wish there was something helpful to explain each value and how they linked together. Searched Google for one, no luck... So of course I screwed the pooch.

    Now, I will at least be able to get the header spam report for those damn emails that slip through.

    Must wait for more spam. Will report back when more information is available.

    Thanks for that.
     
  17. Turbanator

    Turbanator Member HowtoForge Supporter

    Up to you, but you might want to increase your Kill level too.

    for research, I believe all those settings are controls for amavisd-new . So going there will give you the answers.
     
  18. crypted

    crypted Member

    TONS of spam between 1am and 6am this morning. I'm pasting a few of the headers:

    Code:
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by my.mypersonaldomain.tld (Postfix) with ESMTP id 567DA5416E
    	for <[email protected]>; Wed,  1 Sep 2010 07:19:32 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.mypersonaldomain.tld
    X-Spam-Flag: NO
    X-Spam-Score: 1.273
    X-Spam-Level: *
    X-Spam-Status: No, score=1.273 tagged_above=-100 required=5
    	tests=[BAYES_40=-0.185, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457]
    Received: from my.mypersonaldomain.tld ([127.0.0.1])
    	by localhost (my.mypersonaldomain.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id ZL+VA8P6CGRT for <[email protected]>;
    	Wed,  1 Sep 2010 07:19:24 -0400 (EDT)
    Received: from secure.voip-telephony-services.info (secure.voip-telephony-services.info [173.244.178.205])
    	by my.mypersonaldomain.tld (Postfix) with SMTP id 677525416A
    	for <[email protected]>; Wed,  1 Sep 2010 07:19:24 -0400 (EDT)
    DKIM-Signature: v=1;
    	a=rsa-sha1; c=relaxed/relaxed; d=lilleurl.me; s=gamma; t=1283339964;
    	bh=ybgWChrDqqU9XsbO50Q55t7oRkc=; h=To:From;
    	b=kMbOCRP82/YwhMkqpypsxT3MVr4deEXcWIf+JG3n5qcvxi7sATbT978DAhS6VMNVz
    	 ahk7FQGfhv2DVQGRNNv1B9jw5HcGXP8/VWqf4bTUFtsz0loYEqmB5ZVQEZ7TC0c
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    	s=gamma; d=lilleurl.me;
    	h=To:From;
    	b=KzIudBZ6uYWO0s8DSM9P1+bntKemqvGfvaImd+emC6aOTHF3Q65M7b8PfVtL0UbYS
    	WuG0yJgu7Z+XmiIRJm5pUnmP43XuCVPgFHP3xWuDHF2+iOh6nGTPjxHMjkIOrdi;
    From: "DebtGoal" <[email protected]>
    To: [email protected]
    Reply-To: "DebtGoal" <[email protected]>
    Subject: Introducing DebtGoal
    Date: 01 Sep 2010 07:19:24 -0400
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/html; charset="ISO-8859-1"
    Content-Transfer-Encoding: quoted-printable
    
    
    
    
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by my.mypersonaldomain.tld (Postfix) with ESMTP id 5E57B5416E
    	for <[email protected]>; Wed,  1 Sep 2010 07:12:04 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.mypersonaldomain.tld
    X-Spam-Flag: NO
    X-Spam-Score: 4.459
    X-Spam-Level: ****
    X-Spam-Status: No, score=4.459 tagged_above=-100 required=5
    	tests=[BAYES_50=0.001, HTML_IMAGE_RATIO_06=0.001, HTML_MESSAGE=0.001,
    	MIME_HTML_ONLY=1.457, SPF_HELO_PASS=-0.001, URIBL_BLACK=3]
    Received: from my.mypersonaldomain.tld ([127.0.0.1])
    	by localhost (my.mypersonaldomain.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id Gtf+pmVEjFXL for <[email protected]>;
    	Wed,  1 Sep 2010 07:12:03 -0400 (EDT)
    Received: from benefitpositions.com (benefitpositions.com [184.107.51.201])
    	by my.mypersonaldomain.tld (Postfix) with SMTP id 5B4BF5416A
    	for <[email protected]>; Wed,  1 Sep 2010 07:12:03 -0400 (EDT)
    DKIM-Signature: v=1;
    	a=rsa-sha1; c=relaxed/relaxed; d=makemechangemymind.com; s=gamma;
    	t=1283339522; bh=ItolHEoqpJJLeyKV/1zbY2aIeFw=; h=To:From;
    	b=aaNdKew6a45dhdD37r0nsnm45g97B5w9cMZ3xQlUZMheOyCkEmC+d7b9YoM7sDeG8
    	 kt2d2RO05qxiGwnYKqy7OflPO8iVm49aWy492s0uQZpTAXO0rzvQtrkicLC9By5
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    	s=gamma; d=makemechangemymind.com;
    	h=To:From;
    	b=qou0eH7VlqAwOkL9gn0rvT5k9yf8Z0DY1THkx3hpn+NoijyXuw0bqyAbxC5OpB/j8
    	snHkgItRKveAel7hxp5EsR9ELXFjIldXx7huWwb+HhfHXUHuf+Ctkm9Gm3W3h/a;
    From: "Payday Loans" <[email protected]>
    To: [email protected]
    Reply-To: "Payday Loans" <[email protected]>
    Subject: Tired of missing bill payments?
    Date: 01 Sep 2010 07:12:02 -0400
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/html; charset=ISO-8859-1
    Content-Transfer-Encoding: 7bit
    Content-Disposition: inline
    
    
    
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by my.mypersonaldomain.tld (Postfix) with ESMTP id 7B9F554186
    	for <[email protected]>; Wed,  1 Sep 2010 06:31:54 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.mypersonaldomain.tld
    X-Spam-Flag: NO
    X-Spam-Score: 4.04
    X-Spam-Level: ****
    X-Spam-Status: No, score=4.04 tagged_above=-100 required=5
    	tests=[BAYES_50=0.001, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905,
    	RCVD_IN_XBL=3.033, RDNS_NONE=0.1]
    Received: from my.mypersonaldomain.tld ([127.0.0.1])
    	by localhost (my.mypersonaldomain.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id lXpDjgrlMC8P for <[email protected]>;
    	Wed,  1 Sep 2010 06:31:50 -0400 (EDT)
    Received: from microsof-b4bfee (unknown [95.78.92.181])
    	by my.mypersonaldomain.tld (Postfix) with ESMTP id 43D525416A
    	for <[email protected]>; Wed,  1 Sep 2010 06:31:49 -0400 (EDT)
    Received: from smtprly-de01.mx.aol.com (smtprly-de01.mx.aol.com [205.188.170.1]) by cia-mc03.mx.aol.com (v129.4) with ESMTP id MAILCIAMD063-ceb6a970000000; Wed, 1 Sep 2010 13:31:49 +0300
    Received: from webmail-m047 (webmail-m047.sim.aol.com [64.12.101.226]) by smtprly-de01.mx.aol.com (v129.4) with ESMTP id MAILSMTPRLYMB010-ceb6a970000000; Wed, 1 Sep 2010 13:31:49 +0300
    To: [email protected]
    Subject: Having your thingy flaccid?
    Date: Wed, 1 Sep 2010 13:31:49 +0300
    X-MB-Message-Source: WebUI
    X-AOL-IP: microsof-b4bfee
    X-MB-Message-Type: User
    MIME-Version: 1.0
    From: [email protected]
    Content-Type: multipart/alternative; 
     boundary="--------MB_8CD13796E55425B6_8B6_FFF8_webmail-d047.sysops.aol.com"
    X-Mailer: AOL Webmail 32447-STANDARD
    Received: from microsof-b4bfee by webmail-m047.sysops.aol.com (64.12.101.226) with HTTP (WebMailUI); Wed, 1 Sep 2010 13:31:49 +0300
    Message-Id: <[email protected]>
    X-AOL-SENDER: [email protected]
    
    
    
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by my.mypersonaldomain.tld (Postfix) with ESMTP id 20E305416E
    	for <[email protected]>; Wed,  1 Sep 2010 06:14:11 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.mypersonaldomain.tld
    X-Spam-Flag: NO
    X-Spam-Score: 3.889
    X-Spam-Level: ***
    X-Spam-Status: No, score=3.889 tagged_above=-100 required=5
    	tests=[BAYES_00=-2.599, HTML_IMAGE_RATIO_04=0.172, HTML_MESSAGE=0.001,
    	HTML_TAG_BALANCE_BODY=1.263, MIME_HTML_ONLY=1.457,
    	SPF_HELO_PASS=-0.001, SPF_SOFTFAIL=0.596, URIBL_BLACK=3]
    Received: from my.mypersonaldomain.tld ([127.0.0.1])
    	by localhost (my.mypersonaldomain.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id BA5vnulXq0hL for <[email protected]>;
    	Wed,  1 Sep 2010 06:14:06 -0400 (EDT)
    Received: from clickaffiliateincome.com (clickaffiliateincome.com [66.207.161.156])
    	by my.mypersonaldomain.tld (Postfix) with SMTP id 87E295416A
    	for <[email protected]>; Wed,  1 Sep 2010 06:14:06 -0400 (EDT)
    DKIM-Signature: v=1;
    	a=rsa-sha1; c=relaxed/relaxed; d=motion.buildingonlineincome.com;
    	s=gamma; t=1283336045; bh=/C3Vef27Bvl9Ksbw3Z0HeZPsoh0=; h=To:From;
    	b=SS8ncmb/GnvQgnQwlrW2FlfWfpGBF1/vHD1PwezbNRgXhCBc/gxW/ecDhi9xz44st
    	 9BNs0kolpZfoQpuwAtjtEMjh05Rjcuq5NTj6f7tQSal8eNNjKkOhHLqFOhQ2ohQ
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    	s=gamma; d=motion.buildingonlineincome.com;
    	h=To:From;
    	b=C6XcNk9BsupuCphRMhmHWKV6QuMNR5LwZLeuG1Ty2JVR/r6jvgwD3Yz31jCqq/8km
    	8Fu/AEgi7AVK0CWIbhslge9oqNdvgnLTsT82a3CyiiBtrO+zfR3Hscvh+Ce/w1v;
    From: "Green Dot Prepaid" <[email protected]>
    To: [email protected]
    Reply-To: "Green Dot Prepaid" <[email protected]>
    Subject: A prepaid card could be what you need  
    Date: 01 Sep 2010 06:14:05 -0400
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/html; charset="ISO-8859-1"
    Content-Transfer-Encoding: quoted-printable
    
    
    
    
    Return-Path: <[email protected]>
    Delivered-To: [email protected]
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by my.mypersonaldomain.tld (Postfix) with ESMTP id 35BD05416E
    	for <[email protected]>; Wed,  1 Sep 2010 05:53:40 -0400 (EDT)
    X-Virus-Scanned: Debian amavisd-new at my.mypersonaldomain.tld
    X-Spam-Flag: NO
    X-Spam-Score: 1.795
    X-Spam-Level: *
    X-Spam-Status: No, score=1.795 tagged_above=-100 required=5
    	tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, SPF_HELO_PASS=-0.001,
    	SPF_PASS=-0.001, URIBL_BLACK=3]
    Received: from my.mypersonaldomain.tld ([127.0.0.1])
    	by localhost (my.mypersonaldomain.tld [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id gmKM-YJGQOWf for <[email protected]>;
    	Wed,  1 Sep 2010 05:53:37 -0400 (EDT)
    Received: from affiliate-entrepreneur.com (affiliate-entrepreneur.com [173.244.178.211])
    	by my.mypersonaldomain.tld (Postfix) with SMTP id CDAEE5416A
    	for <[email protected]>; Wed,  1 Sep 2010 05:53:37 -0400 (EDT)
    DKIM-Signature: v=1;
    	a=rsa-sha1; c=relaxed/relaxed; d=affiliate-entrepreneur.com;
    	s=gamma; t=1283334817; bh=/7Btram1KhhpzEfwr2u31zvTtCY=; h=To:From;
    	b=MJ8ztxevqCkEYQtX31EFh1AHhSRLvP0BpAzpMlBien3SS9r2sqCI0+X9t6hs+tZC3
    	 zmIyVcsglzMwFDkxQ50+s2cO7CG8hj8QO8N0P35Fbb7rC3NzjuwdCOr2iD0q6n+
    DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
    	s=gamma; d=affiliate-entrepreneur.com;
    	h=To:From;
    	b=Esrr2M21JQOA6+snM4tIrgNUrZYxEpEqB8jGdM3ObAFp2cwvONkJ28chp/DuFjlkF
    	swcf+OlU7GrRxypoUUeoKP2kBwEAYn4Xk51i8tBlEcXYLY8zhCcRK3mWn1SvvNm;
    From: "EarnFromHome" <[email protected]>
    To: [email protected]
    Reply-To: "EarnFromHome" <[email protected]>
    Subject: Get an extra income from home part time
    Date: 01 Sep 2010 05:53:37 -0400
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/plain; charset=windows-1252
    Content-Transfer-Encoding: quoted-printable
    
    Several had XSpam scores of 1.7 or less. The average was 3.5.

    I don't fully understand XSpam scores so I'm worried about setting it too low and throwing tons of mail to Junk.

    Thoughts?
     
  19. crypted

    crypted Member

    Almost all spam received the last five hours had a rating between -2.3 to -0.5.
     
  20. till

    till Super Moderator Staff Member ISPConfig Developer

    Do you you run sa-update once a day to update the spamassasin rules?
     

Share This Page