> On Oct 13, 2015, at 6:49 AM, Kevin A. McGrail <kmcgr...@pccc.com> wrote: > > On 10/12/2015 2:15 PM, Larry Goldman wrote: >> I’m using the CPanel shared hosting on GoDaddy. Inside there, SpamAssassin >> is running. > GoDaddy might not be running sa-update or a new enough version of SA to take > advantage of the TLD updates we can push centrally.
It seems that CPanel is an independent product that GoDaddy serves. It may be that the version of CPanel in use is not using up-to-date SA, which is a problem. How can I determine which version of SA is being used, without terminal access? Here is the raw header of such spam. The “to” address is invalid, and was caught in the catch-all account. > Return-path: <Govt_Rx_CoverUp@poshperkgovtconspiracy.science> > Envelope-to: rr...@allstarcomputerservices.com > Delivery-date: Tue, 13 Oct 2015 11:34:36 -0700 > Received: from [50.2.213.68] (port=57756 helo=poshperkgovtconspiracy.science) > by p3plcpnl0508.prod.phx3.secureserver.net with esmtp (Exim 4.85) > (envelope-from <Govt_Rx_CoverUp@poshperkgovtconspiracy.science>) > id 1Zm4PD-0003yb-RD > for rr...@allstarcomputerservices.com; Tue, 13 Oct 2015 11:34:36 -0700 > Date: Tue, 13 Oct 2015 11:20:53 -0700 > To: <rr...@allstarcomputerservices.com> > Content-Type: text/plain > Nc-Ws: 17451601q-x72f5b53b2c6d08ee39bf08c7aed677cf_k22845467 > From: Govt_Rx_CoverUp <Govt_Rx_CoverUp@poshperkgovtconspiracy.science> > Mime-Version: 1.0 > Message-ID: > <0.0.72f5b53b2c6d08ee39bf08c7aed677cf.22845467.17451601.0rr...@allstarcomputerservices.com> > Ncc-Mn: > 22845467q_i72f5b53b2c6d08ee39bf08c7aed677cf-72f5b53b2c6d08ee39bf08c7aed677cfme > Subject: Health Science Institute exposes major Govt-Obama-Conspiracy > X-Spam-Status: No, score=0.1 > X-Spam-Score: 1 > X-Spam-Bar: / > X-Ham-Report: Spam detection software, running on the system > "p3plcpnl0508.prod.phx3.secureserver.net", > has NOT identified this incoming email as spam. The original > message has been attached to this so you can view it or label > similar future email. If you have any questions, see > root\@localhost for details. > > Content preview: ===================================================== Major > Conspiracy Between Obama, Congress, and the FDA > ===================================================== > Release Date: 13Oct2015 Article #22845467 [...] > > Content analysis details: (0.1 points, 8.0 required) > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was > blocked. > See > > http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block > for more information. > [URIs: allstarcomputerservices.com] > 1.2 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist > [URIs: poshperkgovtconspiracy.science] > -0.0 SPF_HELO_PASS SPF: HELO matches SPF record > -0.0 SPF_PASS SPF: sender matches SPF record > -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% > [score: 0.0000] > 0.8 RDNS_NONE Delivered to internal network by a host with no > rDNS > X-Spam-Flag: NO >
