spamassassin

Private Sender nobody at snovc.com
Wed Feb 19 02:10:25 UTC 2014


Randy Bush wrote:
> in the last 3-4 days, a *massive* amount of spam is making it past
> spamassassin to my users and to me.  see appended for example.  not
> all has dkim.
>
> clue?
>
> randy
>
> From: "SmallCapStockPlays" <info at SmallCapStockPlays.com>
> Subject: Could VIIC be our biggest play in 2014?  Check the stock today
> To: <randy at psg.com>
> Date: Tue, 18 Feb 2014 20:48:02 -0500
> Return-path: <bounces+796782.50654126.285374 at icpbounce.com>
> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ran.psg.com
> X-Spam-Level:
> X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,HTML_MESSAGE,MIME_QP_LONG_LINE,T_DKIM_INVALID autolearn=ham version=3.3.2
> Received: from psg.com ([2001:418:1::62])
> 	by ran.psg.com with esmtp (Exim 4.76)
> 	(envelope-from <bounces+796782.50654126.285374 at icpbounce.com>)
> 	id 1WFwGl-0006al-Bu
> 	for randy at ran.psg.com; Wed, 19 Feb 2014 01:48:16 +0000
> Received: from [207.254.213.223] (helo=drone166.ral.icpbounce.com)
> 	by psg.com with esmtp (Exim 4.82 (FreeBSD))
> 	(envelope-from <bounces+796782.50654126.285374 at icpbounce.com>)
> 	id 1WFwGZ-000Lp8-0W
> 	for randy at psg.com; Wed, 19 Feb 2014 01:48:04 +0000
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=icontactmail3.com; h=Mime-Version:From:To:Date:Subject:List-Unsubscribe:X-Feedback-ID:Content-Type:Message-ID; bh=iihwvTJA/ZrrgzXpk+9Muk0Sqlfk5BqD+aI+mL91kn8=; b=wKHIYdl1BdMRK0Kak5Z/2CwsfFh5Byoe9ZlHaqQz3VK4ltYtLfCI3tg6y8Wq3HuULY+ere7Fzz9Q   camnKSvqcSx3u8LQWQGQSZoYkOmzcIemCHNNrsBD+WZhVA9R3W10V2NM6OTuJKFURxtmCNME29kH   5bYunRCoGolocQ5HmAw=
> Mime-Version: 1.0
> Errors-To: bounces+796782.50654126.285374 at icpbounce.com
> List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m=285374&c=796782>, <mailto:bounces+796782.50654126.285374 at icpbounce.com>
> X-List-Unsubscribe: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m=285374&c=796782>
> X-Unsubscribe-Web: <https://app.icontact.com/icp/listunsubscribe.php?r=50654126&l=4084&s=FSMC&m=285374&c=796782>
> X-Feedback-ID: 01_796782_285374:01_796782:01:vocus
> X-ICPINFO:
> X-Return-Path-Hint: bounces+796782.50654126.285374 at icpbounce.com
> Content-Type: multipart/alternative; boundary="cdf82e78-582d-4a55-9037-dacf81ae37d3"
> Message-ID: <0.1.F.AFD.1CF2D149FE8FD9E.0 at drone166.ral.icpbounce.com>
>
> [1  <text/plain; utf-8 (quoted-printable)>]
> HOME ABOUT US TRADE IDEAS PENNY STOCK ARTICLES DAILY NEWS
>
> [1][png] [2][png] [3][png]
>
They are smart and dkim sign their messages; even though it's invalid I 
believe that's why it has such a low bayes score.

It's getting marked as ham and not spam. Are you positive your 
definitions are still updating?



More information about the NANOG mailing list