Lking Posted July 3, 2014 Share Posted July 3, 2014 I was working under the assumption that, since I get so many of these, that a lot of other people are, too. ... Drake Timing is another thing to consider. For example: Lets assume the an IP address is not on the SpamCop Black list because it is a new IP or one of several used by the spammer in rotation so this IP has timed off of the BL. Using this unlisted IP the spammer starts sending his trash, being lucky they don't send anything to a honeypot. But during the first minute or two they send say 10,000 spam including several to you. Until some number of those spam are reported by you or others the IP will not get on, or back on, the BL. So from an individual's prospective it may look ineffective. However, those that receive any of the 90,000+ spam sent from this IP after it gets back on the list may have a different view. It is difficult to evaluate the "big" picture result when we are looking through the 'straw' of our own limited view/account. I assume the spam you are talking about are in you inbox, not placed in your hold folder as possible spam. Link to comment Share on other sites More sharing options...
Mighty Posted July 3, 2014 Author Share Posted July 3, 2014 I assume the spam you are talking about are in you inbox, not placed in your hold folder as possible spam. Correct. That's what prompted me to start this thread. Too bad Spamassassin doesn't spot big stretches of blank lines and generate separate Bayesian scores for the chunks of text. That could be another heuristic to watch for, to split out the spam text from the junk text. Sorry, just rambling. Drake Link to comment Share on other sites More sharing options...
raydragon Posted July 11, 2014 Share Posted July 11, 2014 If you can summarise the SpamAssassin scores for the ones that make it to your Inbox ? Where in the header do I find that score (I "think" I've got it, but just want to be sure). Link to comment Share on other sites More sharing options...
Dave_L Posted July 11, 2014 Share Posted July 11, 2014 Where in the header do I find that score (I "think" I've got it, but just want to be sure). I think it's this: X-spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter8 X-spam-Level: **** X-spam-Status: hits=4.7 tests=DATE_IN_PAST_12_24,TVD_SPACE_RATIO version=3.2.4 X-spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter8 X-spam-Level: X-spam-Status: hits=0.3 tests=DIET_1,HTML_MESSAGE version=3.2.4 In the first example, the score is 4.7. In the second, it's 0.3. Link to comment Share on other sites More sharing options...
Ex_Brit Posted July 11, 2014 Share Posted July 11, 2014 I think these lines are important too: X-SpamCop-Checked: X-SpamCop-Disposition: Blocked SpamAssassin=4 Link to comment Share on other sites More sharing options...
michaelanglo Posted July 11, 2014 Share Posted July 11, 2014 I think these lines are important too: X-SpamCop-Checked: X-SpamCop-Disposition: Blocked SpamAssassin=4 Interesting, rather. The =4 is a transcription of X-spam-Level: **** and the rest depends on what level you have set plus whitelisting and any other checks. Link to comment Share on other sites More sharing options...
Ex_Brit Posted July 11, 2014 Share Posted July 11, 2014 My SA limit is 1 and I use whitelisting. Everyone uses different ones. Link to comment Share on other sites More sharing options...
Mighty Posted July 12, 2014 Author Share Posted July 12, 2014 Today, most of my spam has a Spamassassin level of 0.5. A few have crept up close to 2. The few that have been stopped were 4 or 5. Drake Link to comment Share on other sites More sharing options...
michaelanglo Posted July 12, 2014 Share Posted July 12, 2014 Today, most of my spam has a Spamassassin level of 0.5. A few have crept up close to 2. The few that have been stopped were 4 or 5. So, if this is typical, even setting the level to 1 wouldn't help you much. Eash person's settings may vary of course but in the 10+ years I've used SC it's been excellent and I've hardly ever received any spam in my actual email client inbox. It's blocked everything bad. Settings I have are as follows but as I said, results may vary do play around with them: Options, Select your email filtering blacklists. Block All - yes (checked) Tag Only - blank (unchecked) SpamAssassin - Checked and set to limit '1' Block Russian - yes (checked) DNS Blacklists - all are selected. Click Submit if you changed anything. Try adjusting settings and I think you'll find it works well. I do not use the graylist as it, for me at least, simply adds complication to the equation. If you have Block All checked then surely the SpamAssassin limit doesn't do anything ? Link to comment Share on other sites More sharing options...
Ex_Brit Posted July 12, 2014 Share Posted July 12, 2014 That's a setting I was advised to use years ago and I've stuck with it. Not sure how it all works to be honest. Link to comment Share on other sites More sharing options...
AggieLady Posted July 18, 2014 Share Posted July 18, 2014 I am having the same problem: SpamCop used to block most (maybe 90%) of the spam and send it to Held Mail. For the past few months, more spam has been getting through than is sent to Held Mail, and less than 10 % is being blocked. For example, I cleaned out my held mail box yesterday afternoon. Since that time, I've gotten 60 emails, 43 of which were spam that was NOT filtered out. My held mailbox was empty. I have spam Assassin set to 3 and all the other filters checked. The only thing I haven't used is "Block All." Is there a less drastic option that will work? It does seem that the filters are just not working. Link to comment Share on other sites More sharing options...
michaelanglo Posted July 19, 2014 Share Posted July 19, 2014 I am having the same problem: SpamCop used to block most (maybe 90%) of the spam and send it to Held Mail. For the past few months, more spam has been getting through than is sent to Held Mail, and less than 10 % is being blocked. For example, I cleaned out my held mail box yesterday afternoon. Since that time, I've gotten 60 emails, 43 of which were spam that was NOT filtered out. My held mailbox was empty. I have spam Assassin set to 3 and all the other filters checked. The only thing I haven't used is "Block All." Is there a less drastic option that will work? It does seem that the filters are just not working. As noted we to need to look at the SpamAssassin hits for those that got through ('Leaked') it may be that setting the level to 2 will help. Somewhere you can find my notes on How I use SpamCop mail. The only extras I use is that I have items in my personal blacklist such as Blacklist br (Brazil) and biz and mx But last month I only got 10 Spams in Held of which 4 were from personal blacklist items and 2 leaks (my oldest mailbox now is strong filtering applied by the ISP). Link to comment Share on other sites More sharing options...
Mighty Posted July 19, 2014 Author Share Posted July 19, 2014 I've dropped my Spamassassin to 2. That's managed to increase the stoppage rate to around 50%. But, of course, now I'm seeing some false positives. Again, frustrating and disappointing that the old techniques went south so suddenly. Drake Link to comment Share on other sites More sharing options...
michaelanglo Posted July 19, 2014 Share Posted July 19, 2014 I've dropped my Spamassassin to 2. That's managed to increase the stoppage rate to around 50%. But, of course, now I'm seeing some false positives. Again, frustrating and disappointing that the old techniques went south so suddenly. Drake If you now whitelist the false positives and blacklist all the country codes (that you don't have senders using) things should improve a bit more. Most of the leakers I see can't be stopped without triggering yet more false positives. Link to comment Share on other sites More sharing options...
Mighty Posted July 19, 2014 Author Share Posted July 19, 2014 I've been whitelisting for years. So, most of my contact list is in there by now. But not all of them, I think. Link to comment Share on other sites More sharing options...
AggieLady Posted July 21, 2014 Share Posted July 21, 2014 Thanks for the helpful suggestions. I've dropped spam Assassin to 1. It doesn't seem to have made much difference. I'm trying to build a personal blacklist now to try to filter out as much as possible. Link to comment Share on other sites More sharing options...
michaelanglo Posted July 21, 2014 Share Posted July 21, 2014 Thanks for the helpful suggestions. I've dropped spam Assassin to 1. It doesn't seem to have made much difference. I'm trying to build a personal blacklist now to try to filter out as much as possible. I don't think going down to 1 helps much. Curiously my spam rate has just doubled from a rate of 20/month to 40/month but all the extras have been stopped by xbl or SA=3 Link to comment Share on other sites More sharing options...
davem4 Posted July 22, 2014 Share Posted July 22, 2014 40 per month??? Wow! I've received 1652 spams in the last month. Are you using additional spam filtering service(s) prior to spamcop? Link to comment Share on other sites More sharing options...
michaelanglo Posted July 23, 2014 Share Posted July 23, 2014 40 per month??? Wow! I've received 1652 spams in the last month. Are you using additional spam filtering service(s) prior to spamcop? (above) "But last month I only got 10 Spams in Held of which 4 were from personal blacklist items and 2 leaks (my oldest mailbox now is strong filtering applied by the ISP)." Can't switch it off but until I can prove something I want didn't arrive, nothing much to complain of. (edit add) Back in 2008 I noted last month I got 2799 spams (90/d), 130 leakers (=4.6 %), 3 false positive(s) == Link to comment Share on other sites More sharing options...
Mighty Posted July 23, 2014 Author Share Posted July 23, 2014 I dropped my Spamassassin to 2 a coupla days ago, and it has raised the stop rate to about 60%. It's nice to finally see a long list on the Held Mail page, again. Except, there have been a few false positives. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.