On Tue, 31 May 2011, Lars Jørgensen wrote:
We don't get much spam through the spamassassin filter, but we do get a bit of german spam which only seems to trigger RVCD_IN_XBL and thus not get a high enough score to be discarded. I have included a sample below (hoping that I don't offend anyone and that it'll get through people's spam filters).
It's much better practice to post the complete spam, including _all_ headers (not just the ones your mail client shows you by default) to a website you control or to someplace like pastebin, and then send the URL for that to the list.
If you can post a version of the message that's gone through your SA so that we can see what version you're running and what rules it hit, that helps even more.
Sending spams to the list can fall afoul of spam filters, but it also is generally not a complete message (including all the headers), and sending it through the mail system again can alter it and remove important spam indicators (or insert new false ones).
Has anybody seen these and know of a good rule to catch them?
Please provide a complete sample as above and we'll be better able to help.
-- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- Mine eyes have seen the horror of the voting of the horde; They've looted the fromagerie where guv'ment cheese is stored; If war's not won before the break they grow so quickly bored; Their vote counts as much as yours. -- Tam ----------------------------------------------------------------------- 6 days until the 67th anniversary of D-Day
