Lking 0 Posted July 3, 2014 I was working under the assumption that, since I get so many of these, that a lot of other people are, too. ... Drake Timing is another thing to consider. For example: Lets assume the an IP address is not on the SpamCop Black list because it is a new IP or one of several used by the spammer in rotation so this IP has timed off of the BL. Using this unlisted IP the spammer starts sending his trash, being lucky they don't send anything to a honeypot. But during the first minute or two they send say 10,000 spam including several to you. Until some number of those spam are reported by you or others the IP will not get on, or back on, the BL. So from an individual's prospective it may look ineffective. However, those that receive any of the 90,000+ spam sent from this IP after it gets back on the list may have a different view. It is difficult to evaluate the "big" picture result when we are looking through the 'straw' of our own limited view/account. I assume the spam you are talking about are in you inbox, not placed in your hold folder as possible spam. Share this post Link to post Share on other sites
Mighty 0 Posted July 3, 2014 I assume the spam you are talking about are in you inbox, not placed in your hold folder as possible spam. Correct. That's what prompted me to start this thread. Too bad Spamassassin doesn't spot big stretches of blank lines and generate separate Bayesian scores for the chunks of text. That could be another heuristic to watch for, to split out the spam text from the junk text. Sorry, just rambling. Drake Share this post Link to post Share on other sites
raydragon 0 Posted July 11, 2014 If you can summarise the SpamAssassin scores for the ones that make it to your Inbox ? Where in the header do I find that score (I "think" I've got it, but just want to be sure). Share this post Link to post Share on other sites
Dave_L 0 Posted July 11, 2014 Where in the header do I find that score (I "think" I've got it, but just want to be sure). I think it's this: X-spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter8 X-spam-Level: **** X-spam-Status: hits=4.7 tests=DATE_IN_PAST_12_24,TVD_SPACE_RATIO version=3.2.4 X-spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter8 X-spam-Level: X-spam-Status: hits=0.3 tests=DIET_1,HTML_MESSAGE version=3.2.4 In the first example, the score is 4.7. In the second, it's 0.3. Share this post Link to post Share on other sites
Ex_Brit 0 Posted July 11, 2014 (edited) I think these lines are important too: X-SpamCop-Checked: X-SpamCop-Disposition: Blocked SpamAssassin=4 Edited July 11, 2014 by Ex_Brit Share this post Link to post Share on other sites
michaelanglo 0 Posted July 11, 2014 I think these lines are important too: X-SpamCop-Checked: X-SpamCop-Disposition: Blocked SpamAssassin=4 Interesting, rather. The =4 is a transcription of X-spam-Level: **** and the rest depends on what level you have set plus whitelisting and any other checks. Share this post Link to post Share on other sites
Ex_Brit 0 Posted July 11, 2014 My SA limit is 1 and I use whitelisting. Everyone uses different ones. Share this post Link to post Share on other sites
Mighty 0 Posted July 12, 2014 Today, most of my spam has a Spamassassin level of 0.5. A few have crept up close to 2. The few that have been stopped were 4 or 5. Drake Share this post Link to post Share on other sites
michaelanglo 0 Posted July 12, 2014 Today, most of my spam has a Spamassassin level of 0.5. A few have crept up close to 2. The few that have been stopped were 4 or 5. So, if this is typical, even setting the level to 1 wouldn't help you much. Eash person's settings may vary of course but in the 10+ years I've used SC it's been excellent and I've hardly ever received any spam in my actual email client inbox. It's blocked everything bad. Settings I have are as follows but as I said, results may vary do play around with them: Options, Select your email filtering blacklists. Block All - yes (checked) Tag Only - blank (unchecked) SpamAssassin - Checked and set to limit '1' Block Russian - yes (checked) DNS Blacklists - all are selected. Click Submit if you changed anything. Try adjusting settings and I think you'll find it works well. I do not use the graylist as it, for me at least, simply adds complication to the equation. If you have Block All checked then surely the SpamAssassin limit doesn't do anything ? Share this post Link to post Share on other sites
Ex_Brit 0 Posted July 12, 2014 That's a setting I was advised to use years ago and I've stuck with it. Not sure how it all works to be honest. Share this post Link to post Share on other sites
AggieLady 0 Posted July 18, 2014 (edited) I am having the same problem: SpamCop used to block most (maybe 90%) of the spam and send it to Held Mail. For the past few months, more spam has been getting through than is sent to Held Mail, and less than 10 % is being blocked. For example, I cleaned out my held mail box yesterday afternoon. Since that time, I've gotten 60 emails, 43 of which were spam that was NOT filtered out. My held mailbox was empty. I have spam Assassin set to 3 and all the other filters checked. The only thing I haven't used is "Block All." Is there a less drastic option that will work? It does seem that the filters are just not working. Edited July 18, 2014 by AggieLady Share this post Link to post Share on other sites
michaelanglo 0 Posted July 19, 2014 I am having the same problem: SpamCop used to block most (maybe 90%) of the spam and send it to Held Mail. For the past few months, more spam has been getting through than is sent to Held Mail, and less than 10 % is being blocked. For example, I cleaned out my held mail box yesterday afternoon. Since that time, I've gotten 60 emails, 43 of which were spam that was NOT filtered out. My held mailbox was empty. I have spam Assassin set to 3 and all the other filters checked. The only thing I haven't used is "Block All." Is there a less drastic option that will work? It does seem that the filters are just not working. As noted we to need to look at the SpamAssassin hits for those that got through ('Leaked') it may be that setting the level to 2 will help. Somewhere you can find my notes on How I use SpamCop mail. The only extras I use is that I have items in my personal blacklist such as Blacklist br (Brazil) and biz and mx But last month I only got 10 Spams in Held of which 4 were from personal blacklist items and 2 leaks (my oldest mailbox now is strong filtering applied by the ISP). Share this post Link to post Share on other sites
Mighty 0 Posted July 19, 2014 I've dropped my Spamassassin to 2. That's managed to increase the stoppage rate to around 50%. But, of course, now I'm seeing some false positives. Again, frustrating and disappointing that the old techniques went south so suddenly. Drake Share this post Link to post Share on other sites
michaelanglo 0 Posted July 19, 2014 I've dropped my Spamassassin to 2. That's managed to increase the stoppage rate to around 50%. But, of course, now I'm seeing some false positives. Again, frustrating and disappointing that the old techniques went south so suddenly. Drake If you now whitelist the false positives and blacklist all the country codes (that you don't have senders using) things should improve a bit more. Most of the leakers I see can't be stopped without triggering yet more false positives. Share this post Link to post Share on other sites
Mighty 0 Posted July 19, 2014 I've been whitelisting for years. So, most of my contact list is in there by now. But not all of them, I think. Share this post Link to post Share on other sites
AggieLady 0 Posted July 21, 2014 Thanks for the helpful suggestions. I've dropped spam Assassin to 1. It doesn't seem to have made much difference. I'm trying to build a personal blacklist now to try to filter out as much as possible. Share this post Link to post Share on other sites
michaelanglo 0 Posted July 21, 2014 Thanks for the helpful suggestions. I've dropped spam Assassin to 1. It doesn't seem to have made much difference. I'm trying to build a personal blacklist now to try to filter out as much as possible. I don't think going down to 1 helps much. Curiously my spam rate has just doubled from a rate of 20/month to 40/month but all the extras have been stopped by xbl or SA=3 Share this post Link to post Share on other sites
davem4 0 Posted July 22, 2014 40 per month??? Wow! I've received 1652 spams in the last month. Are you using additional spam filtering service(s) prior to spamcop? Share this post Link to post Share on other sites
michaelanglo 0 Posted July 23, 2014 (edited) 40 per month??? Wow! I've received 1652 spams in the last month. Are you using additional spam filtering service(s) prior to spamcop? (above) "But last month I only got 10 Spams in Held of which 4 were from personal blacklist items and 2 leaks (my oldest mailbox now is strong filtering applied by the ISP)." Can't switch it off but until I can prove something I want didn't arrive, nothing much to complain of. (edit add) Back in 2008 I noted last month I got 2799 spams (90/d), 130 leakers (=4.6 %), 3 false positive(s) == Edited July 23, 2014 by michaelanglo Share this post Link to post Share on other sites
Mighty 0 Posted July 23, 2014 I dropped my Spamassassin to 2 a coupla days ago, and it has raised the stop rate to about 60%. It's nice to finally see a long list on the Held Mail page, again. Except, there have been a few false positives. Share this post Link to post Share on other sites