[Resolved] My SpamCop Filters Failing to Grab "Watches" and more

[buffed]

The term "watches" and some other terms are not being grabbed when the filter icon is applied to the subject lines of mail in my Held Mail file. It seems to be working perfectly for most terms but for some reason certain words, especially "watches" seem to be immune to the filter. In anticipation of some likely suggestions: Yes, I've checked the settings for the filter rule. Also, it's the actual word "watches" and not trick spellings. There are a few other terms which seem to be able to resist the filter application. Is there some way the spammers can rig the subject lines to cause this to happen?

[turetzsr]

<snip>

In anticipation of some likely suggestions:

<snip>

...Another frequent problem that I've seen: is your e-mail address on the "From" header line of the e-mails with "watches" and do you have your own e-mail address whitelisted?

[Spamnophobic]

If you are collecting your mail from the server via POP3 without first viewing it via webmail, filter rules don't trigger. The ones "getting caught" could be getting caught by default blacklists and SpamAssassin anyway.

This is mentioned in an old post with quotes gleaned from even older discussions (be sure to read the second one!):

http://forum.spamcop.net/forums/index.php?showtopic=1543

, but as the topic no longer shows in the pinned items above the "SpamCop Email System & Accounts" page, I tested it myself with a testmail, testrule and webmail off. My testmail didn't get caught.

[michaelanglo]

The term "watches" and some other terms are not being grabbed when the filter icon is applied to the subject lines of mail in my Held Mail file. [..] Also, it's the actual word "watches" and not trick spellings. There are a few other terms which seem to be able to resist the filter application. Is there some way the spammers can rig the subject lines to cause this to happen?

I suggest you send yourself some emails with "watches" and the other terms in their subjects and see whether a webmail filter will catch them and move them to a test folder.

Also do a view source and indeed download copies of the resistant posts to be looked at by a simple viewer that doesn't decode.

This is to check on items like Subject: =?koi8-r? which says the rest of the line is encoded koi8-r (cyrillic) which indeed the filter may not be smart enough to deal with.

HTH

[buffed]

'Spamnophobic' -thanks for the info. The problem I'm encountering is client-based filters, not server-based. Clicking the funnel icon to apply the filters in the "Held Mail" file doesn't always seem to work. For example, I just had to apply them several times filter words like "casino."

Perhaps it is something in my filter settings. In setting-up a filter rule I'm a bit confused as to what the selection "Stop checking if this rule matches" is referring. Does this mean simply to delete the particular email once a particular filter word is tripped? Or does it mean to halt the entire filtering process and not check anymore of the rules down the list for other emails? I have 19 filter rules at this time.

[DavidT]

Or does it mean to halt the entire filtering process and not check anymore of the rules down the list for other emails?

That's what it means. And did you answer the question someone posed to you above?

do you have your own e-mail address whitelisted?

That can be the source of problems like this.

DT

[buffed]

Thanks for the help. I think I got it. Evidently one or two of my filter rules had the "Stop checking if this rule matches?" selected. This halted the filtering process before the other rules could be checked. I'd been uncertain as to whether the "stop checking..." meant that further filtering of an "INDIVIDUAL" email wouldn't be necessary once a trigger word had been tripped. However, it seems the rule means halting the filtering sweep of "ALL" the other emails.

[turetzsr]

<snip>

Thanks for the help. I think I got it.

<snip>

...Thank you for taking the time to post the good news! Based on this reply, I shall mark this Forum thread as "Resolved."

[StevenUnderwood]

Thanks for the help. I think I got it. Evidently one or two of my filter rules had the "Stop checking if this rule matches?" selected. This halted the filtering process before the other rules could be checked. I'd been uncertain as to whether the "stop checking..." meant that further filtering of an "INDIVIDUAL" email wouldn't be necessary once a trigger word had been tripped. However, it seems the rule means halting the filtering sweep of "ALL" the other emails.

You are not the first to be caught by that tidbit. Logically, most of us think it should be: I have found an issue and dealt with it, stop checking against this message and move on to the next message, but we did not write it.